Messages in this thread Patch in this message | | | From | Mario Limonciello <> | Subject | [RFC 2/2] nvme: Use CAP_FIRMWARE_UPGRADE to check user commands | Date | Thu, 18 Feb 2021 11:09:47 -0600 |
| |
Software that is running with CAP_FIRMWARE_UPGRADE needs a limited set of opcode access: * Identify the disk * Download firmware to the disk * Commit the firmwware to the disk
Signed-off-by: Mario Limonciello <mario.limonciello@dell.com> --- drivers/nvme/host/core.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index f13eb4ded95f..80be3d6b7437 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1593,13 +1593,23 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u64 result; int status; - if (!capable(CAP_SYS_ADMIN)) - return -EACCES; if (copy_from_user(&cmd, ucmd, sizeof(cmd))) return -EFAULT; if (cmd.flags) return -EINVAL; + switch (cmd.opcode) { + case nvme_admin_identify: + case nvme_admin_activate_fw: + case nvme_admin_download_fw: + if (!firmware_upgrade_capable()) + return -EACCES; + break; + default: + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + } + memset(&c, 0, sizeof(c)); c.common.opcode = cmd.opcode; c.common.flags = cmd.flags; @@ -1637,13 +1647,23 @@ static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns, unsigned timeout = 0; int status; - if (!capable(CAP_SYS_ADMIN)) - return -EACCES; if (copy_from_user(&cmd, ucmd, sizeof(cmd))) return -EFAULT; if (cmd.flags) return -EINVAL; + switch (cmd.opcode) { + case nvme_admin_identify: + case nvme_admin_activate_fw: + case nvme_admin_download_fw: + if (!firmware_upgrade_capable()) + return -EACCES; + break; + default: + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + } + memset(&c, 0, sizeof(c)); c.common.opcode = cmd.opcode; c.common.flags = cmd.flags; -- 2.25.1
| |