Privilege restrictions for SG_IO right now apply without distinction to all devices, based on the single capability CAP_SYS_RAWIO. This is a very broad capability, and makes it difficult to give SG_IO access to trusted clients that need access to persistent reservations, trim/discard, or vendor-specific commands. One problem here is that CAP_SYS_RAWIO allows to escape a partition and issue commands that affect the full disk, thus making DAC almost useless. For simplicity, this series attempts to solve one case only: you want to pass through almost everything, but still run as confined as possible. This is for example the case for virtualization, where more complex filtering can be done just as easily in userspace, in the virtual machine monitor. (This does mean the filter can be subverted if the guest can escape the QEMU jail, but a more generic approach involving a bitmap was NACKed). Ok for 3.8? v2->v3: change bitmap filter to boolean Paolo Bonzini (2): sg_io: pass request_queue to blk_verify_command sg_io: introduce unpriv_sgio queue flag block/blk-sysfs.c | 32 ++++++++++++++++++++++++++++++++ block/bsg.c | 2 +- block/scsi_ioctl.c | 9 +++++---- drivers/scsi/sg.c | 3 ++- include/linux/blkdev.h | 6 +++++- 5 files changed, 45 insertions(+), 7 deletions(-) -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
