Messages in this thread | | | Subject | Re: [PATCH] scsi: allow persistent reservations without CAP_SYS_RAWIO | From | James Bottomley <> | Date | Tue, 12 Jun 2012 17:21:09 +0100 |
| |
On Tue, 2012-06-12 at 18:08 +0200, Paolo Bonzini wrote: > Persistent reservations commands cannot be issued right now without > giving CAP_SYS_RAWIO to the process who wishes to send them. This > is a bit heavy-handed, allow these two commands.
Why is this heavy handed? If you remove CAP_SYS_RAWIO, any userspace process can send these, which would allow any user to completely disrupt a SAN by injecting spurious reservations ... that doesn't look to be terribly safe for an operating system running in a data centre.
James
| |