[v3] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

[PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

Posted by Jingbo Xu 2 years, 7 months ago

changes since v2:
- patch 1: disallow reservations on partitions entirely and make it into
  a separate patch (hch)
- patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
  and execute permission check upon blk_mode_t (hch)

changes since RFC:
- only allow unprivileged reservations if the file descriptor is open
  for write (Christoph Hellwig)
- refuse the unprivileged reservations on partitions (Christoph Hellwig)
  (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)


RFC: https://lore.kernel.org/all/20230609102122.118800-1-jefflexu@linux.alibaba.com/
v2: https://lore.kernel.org/all/20230612074103.4866-1-jefflexu@linux.alibaba.com/

Jingbo Xu (2):
  block: disallow Persistent Reservation on partitions
  block: fine-granular CAP_SYS_ADMIN for Persistent Reservation

 block/ioctl.c | 47 +++++++++++++++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 16 deletions(-)

-- 
2.19.1.6.gb485710b

Re: [PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

Posted by Jens Axboe 2 years, 7 months ago

On Tue, 13 Jun 2023 16:40:06 +0800, Jingbo Xu wrote:
> changes since v2:
> - patch 1: disallow reservations on partitions entirely and make it into
>   a separate patch (hch)
> - patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
>   and execute permission check upon blk_mode_t (hch)
> 
> changes since RFC:
> - only allow unprivileged reservations if the file descriptor is open
>   for write (Christoph Hellwig)
> - refuse the unprivileged reservations on partitions (Christoph Hellwig)
>   (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)
> 
> [...]

Applied, thanks!

[1/2] block: disallow Persistent Reservation on partitions
      commit: 12629621669b239445727256d1a5dab616b30deb
[2/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation
      commit: 9a72a02456a839676fe8f220a44ef00951596047

Best regards,
-- 
Jens Axboe

Re: [PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

Posted by Jingbo Xu 2 years, 7 months ago

Hi, Jens,

Would do you think of this series?


On 6/13/23 4:40 PM, Jingbo Xu wrote:
> changes since v2:
> - patch 1: disallow reservations on partitions entirely and make it into
>   a separate patch (hch)
> - patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
>   and execute permission check upon blk_mode_t (hch)
> 
> changes since RFC:
> - only allow unprivileged reservations if the file descriptor is open
>   for write (Christoph Hellwig)
> - refuse the unprivileged reservations on partitions (Christoph Hellwig)
>   (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)
> 
> 
> RFC: https://lore.kernel.org/all/20230609102122.118800-1-jefflexu@linux.alibaba.com/
> v2: https://lore.kernel.org/all/20230612074103.4866-1-jefflexu@linux.alibaba.com/
> 
> Jingbo Xu (2):
>   block: disallow Persistent Reservation on partitions
>   block: fine-granular CAP_SYS_ADMIN for Persistent Reservation
> 
>  block/ioctl.c | 47 +++++++++++++++++++++++++++++++----------------
>  1 file changed, 31 insertions(+), 16 deletions(-)
> 

-- 
Thanks,
Jingbo