Move policy on SG_IO access to userspace. Some level of checking at the kernel level (compared to just having an opt-out for the default whitelist) is needed because any userspace whitelist is too easily circumvented by doing ptrace on the program that has a file descriptor open. This would be a regression for those who are using Unix permissions, security modules or the device cgroup to confine programs.
A meaningful whitelist can then be set by udev, for example. Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- This is not yet usable, because sg devices do not have a link to the queue object. block/Kconfig | 12 ++++++++++++ block/scsi_ioctl.c | 10 ++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/block/Kconfig b/block/Kconfig index e89d6a2..67d1f68 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -75,6 +75,18 @@ config BLK_DEV_SG_FILTER_SYSFS If unsure, say Y. +config BLK_DEV_SG_FILTER_MMC + bool "Backwards-compatible default SG_IO filter" + default y + help + Saying Y here will let you send several commands (mostly based + on the MMC command set) by default to SCSI devices via /dev/sg, + /dev/bsg or ioctls such as SG_IO) even for unprivileged users. + Saying N will restrict the set of commands that unprivileged + users can send to the bare minimum. + + If unsure, say Y. + config BLK_DEV_BSGLIB bool "Block layer SG support v4 helper lib" default n diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c index 5db39b5..079dfa2 100644 --- a/block/scsi_ioctl.c +++ b/block/scsi_ioctl.c @@ -113,9 +113,12 @@ static int sg_emulated_host(struct request_queue *q, int __user *p) static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter) { memset(filter, 0, sizeof(*filter)); - - /* Basic read-only commands */ + __set_bit(INQUIRY, filter->read_ok); __set_bit(TEST_UNIT_READY, filter->read_ok); + __set_bit(REPORT_LUNS, filter->read_ok); + +#ifdef BLK_DEV_SG_FILTER_MMC + /* Basic read-only commands */ __set_bit(REQUEST_SENSE, filter->read_ok); __set_bit(READ_6, filter->read_ok); __set_bit(READ_10, filter->read_ok); @@ -125,14 +128,12 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter) __set_bit(READ_DEFECT_DATA, filter->read_ok); __set_bit(READ_CAPACITY, filter->read_ok); __set_bit(READ_LONG, filter->read_ok); - __set_bit(INQUIRY, filter->read_ok); __set_bit(MODE_SENSE, filter->read_ok); __set_bit(MODE_SENSE_10, filter->read_ok); __set_bit(LOG_SENSE, filter->read_ok); __set_bit(START_STOP, filter->read_ok); __set_bit(GPCMD_VERIFY_10, filter->read_ok); __set_bit(VERIFY_16, filter->read_ok); - __set_bit(REPORT_LUNS, filter->read_ok); __set_bit(SERVICE_ACTION_IN, filter->read_ok); __set_bit(RECEIVE_DIAGNOSTIC, filter->read_ok); __set_bit(MAINTENANCE_IN, filter->read_ok); @@ -193,6 +194,7 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter) __set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok); __set_bit(GPCMD_SET_STREAMING, filter->write_ok); __set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok); +#endif } int blk_verify_command(struct blk_cmd_filter *filter, -- 1.8.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html