lkml.org 
[lkml]   [2012]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] scsi: Silence unnecessary warnings about ioctl to partition
    > Sure, but then disallowing the ioctls for processes with CAP_SYS_RAWIO
    > will not cause regressions and _can_ happen. The transition period only

    The user has CAP_SYS_RAWIO, they can already do it by poking the
    registers on the chip directly. It is a nonsense to attempt to block or
    warn about this.

    > up and implement a very restrictive filter for SCSI commands sent to
    > partition.

    The process has CAP_SYS_RAWIO it can already bypass any check you try and
    put in place.

    > The right patch is one that prepares for these step,

    Doesn't look very right to me.

    > http://permalink.gmane.org/gmane.linux.kernel/1254625 for example. It
    > leaves the warning only for SG_IO, and silently blocks the rest (more
    > rationale in the commit message there).

    Even the printk in that patch is wrong. We have capabilities. Being a
    "root" user is a meaningless distinction here so your ratelimited printk
    isn't just bogus - its wrong. It may have got into RHEL somehow but the
    kernel QA process is a bit higher standard than this proposed patch.

    A process with CAP_SYS_RAWIO has total power. It's assumed to know what
    it is doing. Trying to block it doing stuff like that simply makes
    authors do them via different more crass methods.

    Alan


    \
     
     \ /
      Last update: 2012-05-02 13:41    [W:0.023 / U:32.888 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site