Alasdair G Kergon wrote:
On Sun, Jul 10, 2011 at 10:40:13AM -0700, Linda A. Walsh wrote:
I could write to the darn things!, but all I NEED is read (hmmm
I thought so too when we first began work on LVM, but - surprising
to me - there's been hardly any demand expressed for this feature.
The proposed method of handling this was to accept dm ioctls on
the actual devices themselves controlled by normal ioctl permissions.
Currently, you need CAP_SYS_ADMIN (and access to /dev/mapper/control).
Ishtar:/suse/x86_64> filecap /sbin/lvm
file capabilities
/sbin/lvm sys_admin
Ishtar:/suse/x86_64> llg /dev/mapper/control
crw-rw---- 1 root disk 10, 236 Jul 8 16:52 /dev/mapper/control
(am in group disk).
---
Doesn't work. Still get access failures.
(open not permitted)
I got slightly further with cap_rawio, (gave more error messages).
I'm sure with enough experimenting, I could eventually find the
required set, but it seems to be a bit more than 1 cap.
Oh well, not that important...just found the caplibs on my system
and decided to give them a try...(didn't know the bins were
in yet!....only remember discussing their implementation about
11 years back. At least ACL's were faster...
(I made the exec +eip on the binary for sys_admin and rawio, and
that wasn't sufficient).
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://www.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
