[PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

[PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

[Jingbo Xu]

changes since v2:
- patch 1: disallow reservations on partitions entirely and make it into
  a separate patch (hch)
- patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
  and execute permission check upon blk_mode_t (hch)

changes since RFC:
- only allow unprivileged reservations if the file descriptor is open
  for write (Christoph Hellwig)
- refuse the unprivileged reservations on partitions (Christoph Hellwig)
  (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)


RFC: https://lore.kernel.org/all/20230609102122.118800-1-jefflexu@linux.alibaba.com/
v2: https://lore.kernel.org/all/20230612074103.4866-1-jefflexu@linux.alibaba.com/

Jingbo Xu (2):
  block: disallow Persistent Reservation on partitions
  block: fine-granular CAP_SYS_ADMIN for Persistent Reservation

 block/ioctl.c | 47 +++++++++++++++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 16 deletions(-)

-- 
2.19.1.6.gb485710b

[PATCH v3 1/2] block: disallow Persistent Reservation on partitions

[Jingbo Xu]

Refuse Persistent Reservation operations on partitions as reservation
on partitions doesn't make sense.

Besides, introduce blkdev_pr_allowed() helper, where more policies could
be placed here later.

Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
---
 block/ioctl.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/block/ioctl.c b/block/ioctl.c
index 61bb94fd4281..c75299006bdd 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -254,13 +254,25 @@ int blkdev_compat_ptr_ioctl(struct block_device *bdev, blk_mode_t mode,
 EXPORT_SYMBOL(blkdev_compat_ptr_ioctl);
 #endif
 
+static bool blkdev_pr_allowed(struct block_device *bdev)
+{
+	/* no sense to make reservations for partitions */
+	if (bdev_is_partition(bdev))
+		return false;
+
+	if (capable(CAP_SYS_ADMIN))
+		return true;
+
+	return false;
+}
+
 static int blkdev_pr_register(struct block_device *bdev,
 		struct pr_registration __user *arg)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_registration reg;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!blkdev_pr_allowed(bdev))
 		return -EPERM;
 	if (!ops || !ops->pr_register)
 		return -EOPNOTSUPP;
@@ -278,7 +290,7 @@ static int blkdev_pr_reserve(struct block_device *bdev,
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_reservation rsv;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!blkdev_pr_allowed(bdev))
 		return -EPERM;
 	if (!ops || !ops->pr_reserve)
 		return -EOPNOTSUPP;
@@ -296,7 +308,7 @@ static int blkdev_pr_release(struct block_device *bdev,
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_reservation rsv;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!blkdev_pr_allowed(bdev))
 		return -EPERM;
 	if (!ops || !ops->pr_release)
 		return -EOPNOTSUPP;
@@ -314,7 +326,7 @@ static int blkdev_pr_preempt(struct block_device *bdev,
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_preempt p;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!blkdev_pr_allowed(bdev))
 		return -EPERM;
 	if (!ops || !ops->pr_preempt)
 		return -EOPNOTSUPP;
@@ -332,7 +344,7 @@ static int blkdev_pr_clear(struct block_device *bdev,
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_clear c;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!blkdev_pr_allowed(bdev))
 		return -EPERM;
 	if (!ops || !ops->pr_clear)
 		return -EOPNOTSUPP;
-- 
2.19.1.6.gb485710b

[PATCH v3 2/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation

[Jingbo Xu]

Allow of unprivileged Persistent Reservation operations on devices
if the write permission check on the device node has passed.

brw-rw---- 1 root disk 259, 0 Jun 13 07:09 /dev/nvme0n1

In the example above, the "disk" group of nvme0n1 is also allowed to
make reservations on the device even without CAP_SYS_ADMIN.

Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
---
 block/ioctl.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/block/ioctl.c b/block/ioctl.c
index c75299006bdd..3be11941fb2d 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -254,7 +254,7 @@ int blkdev_compat_ptr_ioctl(struct block_device *bdev, blk_mode_t mode,
 EXPORT_SYMBOL(blkdev_compat_ptr_ioctl);
 #endif
 
-static bool blkdev_pr_allowed(struct block_device *bdev)
+static bool blkdev_pr_allowed(struct block_device *bdev, blk_mode_t mode)
 {
 	/* no sense to make reservations for partitions */
 	if (bdev_is_partition(bdev))
@@ -262,17 +262,20 @@ static bool blkdev_pr_allowed(struct block_device *bdev)
 
 	if (capable(CAP_SYS_ADMIN))
 		return true;
-
-	return false;
+	/*
+	 * Only allow unprivileged reservations if the file descriptor is open
+	 * for writing.
+	 */
+	return mode & BLK_OPEN_WRITE;
 }
 
-static int blkdev_pr_register(struct block_device *bdev,
+static int blkdev_pr_register(struct block_device *bdev, blk_mode_t mode,
 		struct pr_registration __user *arg)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_registration reg;
 
-	if (!blkdev_pr_allowed(bdev))
+	if (!blkdev_pr_allowed(bdev, mode))
 		return -EPERM;
 	if (!ops || !ops->pr_register)
 		return -EOPNOTSUPP;
@@ -284,13 +287,13 @@ static int blkdev_pr_register(struct block_device *bdev,
 	return ops->pr_register(bdev, reg.old_key, reg.new_key, reg.flags);
 }
 
-static int blkdev_pr_reserve(struct block_device *bdev,
+static int blkdev_pr_reserve(struct block_device *bdev, blk_mode_t mode,
 		struct pr_reservation __user *arg)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_reservation rsv;
 
-	if (!blkdev_pr_allowed(bdev))
+	if (!blkdev_pr_allowed(bdev, mode))
 		return -EPERM;
 	if (!ops || !ops->pr_reserve)
 		return -EOPNOTSUPP;
@@ -302,13 +305,13 @@ static int blkdev_pr_reserve(struct block_device *bdev,
 	return ops->pr_reserve(bdev, rsv.key, rsv.type, rsv.flags);
 }
 
-static int blkdev_pr_release(struct block_device *bdev,
+static int blkdev_pr_release(struct block_device *bdev, blk_mode_t mode,
 		struct pr_reservation __user *arg)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_reservation rsv;
 
-	if (!blkdev_pr_allowed(bdev))
+	if (!blkdev_pr_allowed(bdev, mode))
 		return -EPERM;
 	if (!ops || !ops->pr_release)
 		return -EOPNOTSUPP;
@@ -320,13 +323,13 @@ static int blkdev_pr_release(struct block_device *bdev,
 	return ops->pr_release(bdev, rsv.key, rsv.type);
 }
 
-static int blkdev_pr_preempt(struct block_device *bdev,
+static int blkdev_pr_preempt(struct block_device *bdev, blk_mode_t mode,
 		struct pr_preempt __user *arg, bool abort)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_preempt p;
 
-	if (!blkdev_pr_allowed(bdev))
+	if (!blkdev_pr_allowed(bdev, mode))
 		return -EPERM;
 	if (!ops || !ops->pr_preempt)
 		return -EOPNOTSUPP;
@@ -338,13 +341,13 @@ static int blkdev_pr_preempt(struct block_device *bdev,
 	return ops->pr_preempt(bdev, p.old_key, p.new_key, p.type, abort);
 }
 
-static int blkdev_pr_clear(struct block_device *bdev,
+static int blkdev_pr_clear(struct block_device *bdev, blk_mode_t mode,
 		struct pr_clear __user *arg)
 {
 	const struct pr_ops *ops = bdev->bd_disk->fops->pr_ops;
 	struct pr_clear c;
 
-	if (!blkdev_pr_allowed(bdev))
+	if (!blkdev_pr_allowed(bdev, mode))
 		return -EPERM;
 	if (!ops || !ops->pr_clear)
 		return -EOPNOTSUPP;
@@ -546,17 +549,17 @@ static int blkdev_common_ioctl(struct block_device *bdev, blk_mode_t mode,
 	case BLKTRACETEARDOWN:
 		return blk_trace_ioctl(bdev, cmd, argp);
 	case IOC_PR_REGISTER:
-		return blkdev_pr_register(bdev, argp);
+		return blkdev_pr_register(bdev, mode, argp);
 	case IOC_PR_RESERVE:
-		return blkdev_pr_reserve(bdev, argp);
+		return blkdev_pr_reserve(bdev, mode, argp);
 	case IOC_PR_RELEASE:
-		return blkdev_pr_release(bdev, argp);
+		return blkdev_pr_release(bdev, mode, argp);
 	case IOC_PR_PREEMPT:
-		return blkdev_pr_preempt(bdev, argp, false);
+		return blkdev_pr_preempt(bdev, mode, argp, false);
 	case IOC_PR_PREEMPT_ABORT:
-		return blkdev_pr_preempt(bdev, argp, true);
+		return blkdev_pr_preempt(bdev, mode, argp, true);
 	case IOC_PR_CLEAR:
-		return blkdev_pr_clear(bdev, argp);
+		return blkdev_pr_clear(bdev, mode, argp);
 	default:
 		return -ENOIOCTLCMD;
 	}
-- 
2.19.1.6.gb485710b

Re: [PATCH v3 1/2] block: disallow Persistent Reservation on partitions

[Christoph Hellwig]

On Tue, Jun 13, 2023 at 04:40:07PM +0800, Jingbo Xu wrote:
> Refuse Persistent Reservation operations on partitions as reservation
> on partitions doesn't make sense.
> 
> Besides, introduce blkdev_pr_allowed() helper, where more policies could
> be placed here later.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v3 2/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

[Jingbo Xu]

Hi, Jens,

Would do you think of this series?


On 6/13/23 4:40 PM, Jingbo Xu wrote:
> changes since v2:
> - patch 1: disallow reservations on partitions entirely and make it into
>   a separate patch (hch)
> - patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
>   and execute permission check upon blk_mode_t (hch)
> 
> changes since RFC:
> - only allow unprivileged reservations if the file descriptor is open
>   for write (Christoph Hellwig)
> - refuse the unprivileged reservations on partitions (Christoph Hellwig)
>   (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)
> 
> 
> RFC: https://lore.kernel.org/all/20230609102122.118800-1-jefflexu@linux.alibaba.com/
> v2: https://lore.kernel.org/all/20230612074103.4866-1-jefflexu@linux.alibaba.com/
> 
> Jingbo Xu (2):
>   block: disallow Persistent Reservation on partitions
>   block: fine-granular CAP_SYS_ADMIN for Persistent Reservation
> 
>  block/ioctl.c | 47 +++++++++++++++++++++++++++++++----------------
>  1 file changed, 31 insertions(+), 16 deletions(-)
> 

-- 
Thanks,
Jingbo

Re: [PATCH v3 0/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation ioctl

[Jens Axboe]

On Tue, 13 Jun 2023 16:40:06 +0800, Jingbo Xu wrote:
> changes since v2:
> - patch 1: disallow reservations on partitions entirely and make it into
>   a separate patch (hch)
> - patch 2: rebase to hch's series of converting fmode_t to blk_mode_t
>   and execute permission check upon blk_mode_t (hch)
> 
> changes since RFC:
> - only allow unprivileged reservations if the file descriptor is open
>   for write (Christoph Hellwig)
> - refuse the unprivileged reservations on partitions (Christoph Hellwig)
>   (maybe this checking shall also be done when CAP_SYS_ADMIN is set?)
> 
> [...]

Applied, thanks!

[1/2] block: disallow Persistent Reservation on partitions
      commit: 12629621669b239445727256d1a5dab616b30deb
[2/2] block: fine-granular CAP_SYS_ADMIN for Persistent Reservation
      commit: 9a72a02456a839676fe8f220a44ef00951596047

Best regards,
-- 
Jens Axboe