[PATCH 0/1 RESEND] Allow non-root users to perform ZBC commands.

[Ryan Attard <ryanattard@ryanattard.info>]

Resending since I missed some emails on the first:

The source of this issue is that a group is configured that allows a service
user to perform read and writes to a specific set of disks, and the permissions
on the sd device entries for a host managed device have permissions 0660, same
as the sg device entry. Operations succeed on the sg device (since there is
a different code path for handling those operations).

There was some hand wringing around adding CAP_SYS_RAWIO capabilities to that
user, since it includes things like /dev/mem access which was not desired or
required to perform disk write operations.

Example failure:
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sdh -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
ioctl(SG_IO v3) failed: Operation not permitted (errno=1)
report zones: pass through os error: Operation not permitted
Report zones command: Sense category: -1
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sg7 -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
zl_len available is 2624, response length is 128
Report zones response:
  Same=0: zone type and length may differ in each descriptor
<snip>


Example with patch:
root@device_with_zbc_disks:~# su -s /bin/bash -c 'sg_rep_zones -vv /dev/sdh -m 128' USER_LOW_PERMS
open /dev/sdh with flags=0x802
    Report zones cdb: 95 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00
zl_len available is 2624, response length is 128
Report zones response:
  Same=0: zone type and length may differ in each descriptor
<snip>


Thanks,

Ryan