Re: [RFC PATCH 0/4] SG_IO filtering via sysfs and minimal whitelist

2013-07-05 Thread Paolo Bonzini
Il 25/06/2013 23:19, Paolo Bonzini ha scritto: Il 27/05/2013 15:50, Paolo Bonzini ha scritto: We've been running in circles for nine months now. Let's restart from the maintainer's suggestion, which was probably dismissed too quickly. This is still not a complete solution, because /dev/sgN

Re: [RFC PATCH 0/4] SG_IO filtering via sysfs and minimal whitelist

2013-06-25 Thread Paolo Bonzini
Il 27/05/2013 15:50, Paolo Bonzini ha scritto: We've been running in circles for nine months now. Let's restart from the maintainer's suggestion, which was probably dismissed too quickly. This is still not a complete solution, because /dev/sgN does not have access to its queue object.

[RFC PATCH 0/4] SG_IO filtering via sysfs and minimal whitelist

2013-05-27 Thread Paolo Bonzini
On Wed, 12 Sep 2012 09:05:41 +0100, James Bottomley wrote: This is why the whole filter thing was mutable via sysfs. That way the admin could set this up per device. It sounds like this is what you want to fix, rather than opening up more holes in an already leaky security apparatus. The