Commit e980f623 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Jens Axboe

dm: don't allow ioctls to targets that don't map to whole devices

.. at least for unprivileged users.  Before we called into the SCSI
ioctl code to allow excemptions for a few SCSI passthrough ioctls,
but this is pretty unsafe and except for this call dm knows nothing
about SCSI ioctls.

As the SCSI ioctl code is now optional, we really don't want to
drag it in for DM, and the exception is not very useful anyway.
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Acked-by: default avatarMike Snitzer <snitzer@redhat.com>
Acked-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@kernel.org>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent e4d750c9
...@@ -465,13 +465,16 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode, ...@@ -465,13 +465,16 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
if (r > 0) { if (r > 0) {
/* /*
* Target determined this ioctl is being issued against * Target determined this ioctl is being issued against a
* a logical partition of the parent bdev; so extra * subset of the parent bdev; require extra privileges.
* validation is needed.
*/ */
r = scsi_verify_blk_ioctl(NULL, cmd); if (!capable(CAP_SYS_RAWIO)) {
if (r) DMWARN_LIMIT(
"%s: sending ioctl %x to DM device without required privilege.",
current->comm, cmd);
r = -ENOIOCTLCMD;
goto out; goto out;
}
} }
r = __blkdev_driver_ioctl(bdev, mode, cmd, arg); r = __blkdev_driver_ioctl(bdev, mode, cmd, arg);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment