[lkml]   [2012]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] scsi: Silence unnecessary warnings about ioctl to partition
    > Sure, but then disallowing the ioctls for processes with CAP_SYS_RAWIO
    > will not cause regressions and _can_ happen. The transition period only

    The user has CAP_SYS_RAWIO, they can already do it by poking the
    registers on the chip directly. It is a nonsense to attempt to block or
    warn about this.

    > up and implement a very restrictive filter for SCSI commands sent to
    > partition.

    The process has CAP_SYS_RAWIO it can already bypass any check you try and
    put in place.

    > The right patch is one that prepares for these step,

    Doesn't look very right to me.

    > for example. It
    > leaves the warning only for SG_IO, and silently blocks the rest (more
    > rationale in the commit message there).

    Even the printk in that patch is wrong. We have capabilities. Being a
    "root" user is a meaningless distinction here so your ratelimited printk
    isn't just bogus - its wrong. It may have got into RHEL somehow but the
    kernel QA process is a bit higher standard than this proposed patch.

    A process with CAP_SYS_RAWIO has total power. It's assumed to know what
    it is doing. Trying to block it doing stuff like that simply makes
    authors do them via different more crass methods.


     \ /
      Last update: 2012-05-02 13:41    [W:0.021 / U:4.980 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site