[PATCH 0/1] Allow non-root users to perform ZBC commands

[PATCH 0/1] Allow non-root users to perform ZBC commands

[rattard]

The source of this issue is that a group is configured that allows a service 
user to perform read and writes to a specific set of disks, and the permissions 
on the sd device entries for a host managed device have permissions 0660, same 
as the sg device entry. Operations succeed on the sg device (since there is
a different code path for handling those operations). 

There was some hand wringing around adding CAP_SYS_RAWIO capabilities to that 
user, since it includes things like /dev/mem access which was not desired or 
required to perform disk write operations. 

Example failure:
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sdh -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
ioctl(SG_IO v3) failed: Operation not permitted (errno=1)
report zones: pass through os error: Operation not permitted
Report zones command: Sense category: -1
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sg7 -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
zl_len available is 2624, response length is 128
Report zones response:
  Same=0: zone type and length may differ in each descriptor
<snip>


Example with patch:
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sdh -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
zl_len available is 2624, response length is 128
Report zones response:
  Same=0: zone type and length may differ in each descriptor
<snip>


Thanks,

Ryan

[PATCH 1/1] Allow non-root users to perform ZBC commands.

[rattard]

From: Ryan Attard <ryanattard@ryanattard.info>

Allow users with read permissions to issue REPORT ZONE commands and
users with write permissions to manage zones on devices supporting the
ZBC specification.

Signed-off-by: Ryan Attard <ryanattard@ryanattard.info>
---
 block/scsi_ioctl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 260fa80ef575..005a84b2ecdb 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -194,6 +194,11 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
 	__set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok);
 	__set_bit(GPCMD_SET_STREAMING, filter->write_ok);
 	__set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);
+
+	/* ZBC Commands */
+	__set_bit(ZBC_OUT, filter->write_ok);
+	__set_bit(ZBC_IN, filter->read_ok);
+
 }
 
 int blk_verify_command(unsigned char *cmd, fmode_t has_write_perm)
-- 
2.24.0