* [PATCH v2 1/3] block: add back queue-private command filter
2012-09-25 15:30 [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs Paolo Bonzini
@ 2012-09-25 15:30 ` Paolo Bonzini
2012-09-25 15:30 ` [PATCH v2 2/3] scsi: create an all-zero filter for scanners Paolo Bonzini
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2012-09-25 15:30 UTC (permalink / raw)
To: linux-kernel
Cc: Tejun Heo, James Bottomley, Jens Axboe, Ric Wheeler, Alan Cox,
linux-scsi
The command filter used to be mutable via sysfs, but this was broken
and backed out. Let's add it back. This patch adds the infrastructure
for filtering, but unlike the old code this one just adds a pointer to
request_queue, so as to make it cheaper in the majority of cases where
no special filtering is desired.
This is a partial (and massaged) revert of commit 018e044 (block: get
rid of queue-private command filter, 2009-06-26).
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
block/blk-sysfs.c | 2 ++
block/bsg.c | 2 +-
block/scsi_ioctl.c | 17 +++++------------
drivers/scsi/sg.c | 4 +++-
include/linux/blkdev.h | 10 +++++++++-
5 files changed, 20 insertions(+), 15 deletions(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 9628b29..5a0de07 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -487,6 +487,8 @@ static void blk_release_queue(struct kobject *kobj)
blkcg_exit_queue(q);
+ kfree(q->cmd_filter);
+
if (q->elevator) {
spin_lock_irq(q->queue_lock);
ioc_clear_queue(q);
diff --git a/block/bsg.c b/block/bsg.c
index ff64ae3..09956da 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -187,7 +187,7 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
return -EFAULT;
if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
- if (blk_verify_command(rq->cmd, has_write_perm))
+ if (blk_verify_command(q->cmd_filter, rq->cmd, has_write_perm))
return -EPERM;
} else if (!capable(CAP_SYS_RAWIO))
return -EPERM;
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 9a87daa..c8862e9 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -33,11 +33,6 @@
#include <scsi/scsi_ioctl.h>
#include <scsi/scsi_cmnd.h>
-struct blk_cmd_filter {
- unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
- unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
-};
-
static struct blk_cmd_filter blk_default_cmd_filter;
/* Command group 3 is reserved and should never be used. */
@@ -196,17 +191,15 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
__set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);
}
-int blk_verify_command(unsigned char *cmd, fmode_t has_write_perm)
+int blk_verify_command(struct blk_cmd_filter *filter,
+ unsigned char *cmd, fmode_t has_write_perm)
{
- struct blk_cmd_filter *filter = &blk_default_cmd_filter;
-
/* root can do any command. */
if (capable(CAP_SYS_RAWIO))
return 0;
- /* if there's no filter set, assume we're filtering everything out */
if (!filter)
- return -EPERM;
+ filter = &blk_default_cmd_filter;
/* Anybody who can open the device can do a read-safe command */
if (test_bit(cmd[0], filter->read_ok))
@@ -225,7 +218,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
{
if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
return -EFAULT;
- if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
+ if (blk_verify_command(q->cmd_filter, rq->cmd, mode & FMODE_WRITE))
return -EPERM;
/*
@@ -472,7 +465,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
goto error;
- err = blk_verify_command(rq->cmd, mode & FMODE_WRITE);
+ err = blk_verify_command(q->cmd_filter, rq->cmd, mode & FMODE_WRITE);
if (err)
goto error;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 9c5c5f2..2ba7c82 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -217,11 +217,13 @@ static void sg_put_dev(Sg_device *sdp);
static int sg_allow_access(struct file *filp, unsigned char *cmd)
{
struct sg_fd *sfp = filp->private_data;
+ struct request_queue *q = sfp->parentdp->device->request_queue;
if (sfp->parentdp->device->type == TYPE_SCANNER)
return 0;
- return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
+ return blk_verify_command(q->cmd_filter,
+ cmd, filp->f_mode & FMODE_WRITE);
}
static int get_exclude(Sg_device *sdp)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4a2ab7c..b5c5f8a 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -258,6 +258,11 @@ struct blk_queue_tag {
#define BLK_SCSI_MAX_CMDS (256)
#define BLK_SCSI_CMD_PER_LONG (BLK_SCSI_MAX_CMDS / (sizeof(long) * 8))
+struct blk_cmd_filter {
+ unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
+ unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
+};
+
struct queue_limits {
unsigned long bounce_pfn;
unsigned long seg_boundary_mask;
@@ -423,6 +428,8 @@ struct request_queue {
struct bsg_class_device bsg_dev;
#endif
+ struct blk_cmd_filter *cmd_filter;
+
#ifdef CONFIG_BLK_CGROUP
struct list_head all_q_node;
#endif
@@ -1005,7 +1012,8 @@ static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
gfp_mask);
}
-extern int blk_verify_command(unsigned char *cmd, fmode_t has_write_perm);
+extern int blk_verify_command(struct blk_cmd_filter *filter,
+ unsigned char *cmd, fmode_t has_write_perm);
enum blk_default_limits {
BLK_MAX_SEGMENTS = 128,
--
1.7.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v2 2/3] scsi: create an all-zero filter for scanners
2012-09-25 15:30 [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs Paolo Bonzini
2012-09-25 15:30 ` [PATCH v2 1/3] block: add back queue-private command filter Paolo Bonzini
@ 2012-09-25 15:30 ` Paolo Bonzini
2012-09-25 15:30 ` [PATCH v2 3/3] block: add back command filter modification via sysfs Paolo Bonzini
2012-10-04 10:12 ` [PATCH v2 0/3] block: add queue-private command filter, editable " Paolo Bonzini
3 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2012-09-25 15:30 UTC (permalink / raw)
To: linux-kernel
Cc: Tejun Heo, James Bottomley, Jens Axboe, Ric Wheeler, Alan Cox,
linux-scsi
Using /dev/sg for scanners is blocked from unprivileged users. Reimplement
this using customizable command filters, so that the sysfs knobs will work
in this case too.
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
v1->v2: OOM check [Alan Cox]
use GFP_ATOMIC, not GFP_KERNEL
drivers/scsi/scsi_scan.c | 8 +++++++-
drivers/scsi/sg.c | 3 ---
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 56a9379..81b1579 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -773,13 +773,19 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
}
switch (sdev->type) {
+ case TYPE_SCANNER:
+ sdev->request_queue->cmd_filter =
+ kzalloc(sizeof(struct blk_cmd_filter), GFP_ATOMIC);
+ if (sdev->request_queue->cmd_filter == NULL)
+ return SCSI_SCAN_NO_RESPONSE;
+ /* fallthrough */
+
case TYPE_RBC:
case TYPE_TAPE:
case TYPE_DISK:
case TYPE_PRINTER:
case TYPE_MOD:
case TYPE_PROCESSOR:
- case TYPE_SCANNER:
case TYPE_MEDIUM_CHANGER:
case TYPE_ENCLOSURE:
case TYPE_COMM:
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 2ba7c82..c7474f5 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -219,9 +219,6 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
struct sg_fd *sfp = filp->private_data;
struct request_queue *q = sfp->parentdp->device->request_queue;
- if (sfp->parentdp->device->type == TYPE_SCANNER)
- return 0;
-
return blk_verify_command(q->cmd_filter,
cmd, filp->f_mode & FMODE_WRITE);
}
--
1.7.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v2 3/3] block: add back command filter modification via sysfs
2012-09-25 15:30 [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs Paolo Bonzini
2012-09-25 15:30 ` [PATCH v2 1/3] block: add back queue-private command filter Paolo Bonzini
2012-09-25 15:30 ` [PATCH v2 2/3] scsi: create an all-zero filter for scanners Paolo Bonzini
@ 2012-09-25 15:30 ` Paolo Bonzini
2012-10-04 10:12 ` [PATCH v2 0/3] block: add queue-private command filter, editable " Paolo Bonzini
3 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2012-09-25 15:30 UTC (permalink / raw)
To: linux-kernel
Cc: Tejun Heo, James Bottomley, Jens Axboe, Ric Wheeler, Alan Cox,
linux-scsi
This adds two new sysfs attributes to the queue kobject. The attributes
allow reading and writing the whitelist of unprivileged commands.
This is again a bit different from what was removed in commit 018e044
(block: get rid of queue-private command filter, 2009-06-26), but the idea
is the same. One difference is that it does not use a separate kobject.
Also, the supported sysfs syntax is a bit more expressive: it includes
ranges, the ability to replace all of the filter with a single command,
and does not force usage of hexadecimal.
Since the names are different, and the old ones were anyway never enabled
(they were always #if 0-ed), the different API is not a problem.
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
v2->v3: OOM and capability check [Alan Cox]
Documentation/block/queue-sysfs.txt | 16 ++++++
block/Kconfig | 10 ++++
block/blk-sysfs.c | 41 ++++++++++++++
block/scsi_ioctl.c | 103 +++++++++++++++++++++++++++++++++++
include/linux/blkdev.h | 21 +++++++
5 files changed, 191 insertions(+), 0 deletions(-)
diff --git a/Documentation/block/queue-sysfs.txt b/Documentation/block/queue-sysfs.txt
index e54ac1d..1152b38 100644
--- a/Documentation/block/queue-sysfs.txt
+++ b/Documentation/block/queue-sysfs.txt
@@ -133,6 +133,22 @@ control of this block device to that new IO scheduler. Note that writing
an IO scheduler name to this file will attempt to load that IO scheduler
module, if it isn't already present in the system.
+sgio_read_filter (RW)
+---------------------
+When read, this file will display a list of SCSI commands (i.e. values of
+the first byte of a CDB) that are always available for unprivileged users
+(via /dev/bsg, /dev/sgNN, or ioctls such as SG_IO and CDROM_SEND_PACKET).
+When written, the list of commands will be modified. By default it
+will be completely replaced; writing a string that begins with '+' will
+add new commands, and writing a string that begins with '-' will remove
+some commands. Ranges of commands are supported, for example '0x00-0xff'.
+
+sgio_write_filter (RW)
+----------------------
+When read, this file will display a list of SCSI commands (i.e. values of
+the first byte of a CDB) that are available for unprivileged users
+when the block device is open for writing. Writing to this file behaves
+as for sgio_read_filter.
Jens Axboe <jens.axboe@oracle.com>, February 2009
diff --git a/block/Kconfig b/block/Kconfig
index 09acf1b..7c369d9 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -65,6 +65,16 @@ config BLK_DEV_BSG
If unsure, say Y.
+config BLK_DEV_SG_FILTER_SYSFS
+ bool "Customizable SG_IO filters in sysfs"
+ default y
+ help
+ Saying Y here will let you use sysfs to customize the list
+ of SCSI commands that are available (via /dev/sg, /dev/bsg or
+ ioctls such as SG_IO) to unprivileged users.
+
+ If unsure, say Y.
+
config BLK_DEV_BSGLIB
bool "Block layer SG support v4 helper lib"
default n
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 5a0de07..b287d62 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -394,6 +394,43 @@ static struct queue_sysfs_entry queue_random_entry = {
.store = queue_store_random,
};
+#ifdef CONFIG_BLK_DEV_SG_FILTER_SYSFS
+static ssize_t queue_sgio_filter_read_show(struct request_queue *q, char *page)
+{
+ return blk_filter_show(q, page, READ);
+}
+
+static ssize_t queue_sgio_filter_write_show(struct request_queue *q,
+ char *page)
+{
+ return blk_filter_show(q, page, WRITE);
+}
+
+static ssize_t queue_sgio_filter_read_store(struct request_queue *q,
+ const char *page, size_t count)
+{
+ return blk_filter_store(q, page, count, READ);
+}
+
+static ssize_t queue_sgio_filter_write_store(struct request_queue *q,
+ const char *page, size_t count)
+{
+ return blk_filter_store(q, page, count, WRITE);
+}
+
+static struct queue_sysfs_entry queue_sgio_filter_read_entry = {
+ .attr = { .name = "sgio_filter_read", .mode = S_IRUGO | S_IWUSR },
+ .show = queue_sgio_filter_read_show,
+ .store = queue_sgio_filter_read_store,
+};
+
+static struct queue_sysfs_entry queue_sgio_filter_write_entry = {
+ .attr = {.name = "sgio_filter_write", .mode = S_IRUGO | S_IWUSR },
+ .show = queue_sgio_filter_write_show,
+ .store = queue_sgio_filter_write_store,
+};
+#endif
+
static struct attribute *default_attrs[] = {
&queue_requests_entry.attr,
&queue_ra_entry.attr,
@@ -416,6 +453,10 @@ static struct attribute *default_attrs[] = {
&queue_rq_affinity_entry.attr,
&queue_iostats_entry.attr,
&queue_random_entry.attr,
+#ifdef CONFIG_BLK_DEV_SG_FILTER_SYSFS
+ &queue_sgio_filter_read_entry.attr,
+ &queue_sgio_filter_write_entry.attr,
+#endif
NULL,
};
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index c8862e9..d945b2a 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -18,6 +18,7 @@
*/
#include <linux/kernel.h>
#include <linux/errno.h>
+#include <linux/ctype.h>
#include <linux/string.h>
#include <linux/module.h>
#include <linux/blkdev.h>
@@ -110,6 +111,8 @@ static int sg_emulated_host(struct request_queue *q, int __user *p)
static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
{
+ memset(filter, 0, sizeof(*filter));
+
/* Basic read-only commands */
__set_bit(TEST_UNIT_READY, filter->read_ok);
__set_bit(REQUEST_SENSE, filter->read_ok);
@@ -738,6 +741,109 @@ int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
}
EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
+#ifdef CONFIG_BLK_DEV_SG_FILTER_SYSFS
+ssize_t blk_filter_show(struct request_queue *q, char *page, int rw)
+{
+ struct blk_cmd_filter *filter;
+ char *p = page;
+ unsigned long *okbits;
+ int i;
+
+ filter = q->cmd_filter;
+ if (!filter)
+ filter = &blk_default_cmd_filter;
+
+ if (rw == READ)
+ okbits = filter->read_ok;
+ else
+ okbits = filter->write_ok;
+
+ for (i = 0; i < BLK_SCSI_MAX_CMDS; i++)
+ if (test_bit(i, okbits))
+ p += sprintf(p, "0x%02x ", i);
+
+ if (p > page)
+ p[-1] = '\n';
+
+ return p - page;
+}
+EXPORT_SYMBOL_GPL(blk_filter_show);
+
+ssize_t blk_filter_store(struct request_queue *q,
+ const char *page, size_t count, int rw)
+{
+ unsigned long okbits[BLK_SCSI_CMD_PER_LONG], *target_okbits;
+ bool set;
+ const char *p = page;
+ char *endp;
+ int start = -1, cmd;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ if (!q->cmd_filter) {
+ q->cmd_filter = kmalloc(sizeof(struct blk_cmd_filter),
+ GFP_KERNEL);
+ if (!q->cmd_filter)
+ return -ENOMEM;
+
+ blk_set_cmd_filter_defaults(q->cmd_filter);
+ }
+
+ if (rw == READ)
+ target_okbits = q->cmd_filter->read_ok;
+ else
+ target_okbits = q->cmd_filter->write_ok;
+
+ set = (p[0] != '-');
+ if (p[0] != '-' && p[0] != '+')
+ memset(okbits, 0, sizeof(okbits));
+ else {
+ memcpy(okbits, target_okbits, sizeof(okbits));
+ p++;
+ }
+
+ while (p < page + count) {
+ if (start == -1 && isspace(*p)) {
+ p++;
+ continue;
+ }
+
+ cmd = simple_strtol(p, &endp, 0);
+
+ /* all of these cases means invalid input, so do nothing. */
+ if (endp == p || cmd < 0 || cmd >= BLK_SCSI_MAX_CMDS ||
+ (start != -1 && endp < page + count && !isspace(*endp)))
+ return -EINVAL;
+
+ p = endp;
+ if (p < page + count && *p == '-') {
+ BUG_ON(start != -1);
+ start = cmd;
+ p++;
+ continue;
+ }
+
+ if (start == -1)
+ start = cmd;
+
+ for (; start <= cmd; start++)
+ if (set)
+ __set_bit(start, okbits);
+ else
+ __clear_bit(start, okbits);
+ start = -1;
+ }
+
+ if (start != -1)
+ return -EINVAL;
+
+ memcpy(target_okbits, okbits, sizeof(okbits));
+ return count;
+}
+EXPORT_SYMBOL_GPL(blk_filter_store);
+#endif
+
static int __init blk_scsi_ioctl_init(void)
{
blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index b5c5f8a..18e7c25 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1012,9 +1012,30 @@ static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
gfp_mask);
}
+/*
+ * command filter functions
+ */
extern int blk_verify_command(struct blk_cmd_filter *filter,
unsigned char *cmd, fmode_t has_write_perm);
+#ifdef CONFIG_BLK_DEV_SG_FILTER_SYSFS
+ssize_t blk_filter_show(struct request_queue *q, char *page, int rw);
+ssize_t blk_filter_store(struct request_queue *q,
+ const char *page, size_t count, int rw);
+#else
+static inline ssize_t blk_filter_show(struct request_queue *q, char *page, int rw)
+{
+ return -EINVAL;
+}
+
+static inline ssize_t blk_filter_store(struct request_queue *q,
+ const char *page, size_t count, int rw);
+{
+ return -EINVAL;
+}
+#endif /* CONFIG_BLK_DEV_SG_FILTER_SYSFS */
+
+
enum blk_default_limits {
BLK_MAX_SEGMENTS = 128,
BLK_SAFE_MAX_SECTORS = 255,
--
1.7.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs
2012-09-25 15:30 [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs Paolo Bonzini
` (2 preceding siblings ...)
2012-09-25 15:30 ` [PATCH v2 3/3] block: add back command filter modification via sysfs Paolo Bonzini
@ 2012-10-04 10:12 ` Paolo Bonzini
2012-10-19 0:22 ` Tejun Heo
3 siblings, 1 reply; 7+ messages in thread
From: Paolo Bonzini @ 2012-10-04 10:12 UTC (permalink / raw)
Cc: linux-kernel, Tejun Heo, James Bottomley, Jens Axboe, Ric Wheeler,
Alan Cox, linux-scsi
Il 25/09/2012 17:30, Paolo Bonzini ha scritto:
> The set of use cases for SG_IO is quite variable that no single filter can
> accomodate all of them. The current filter is tailored very much to
> CD burning, and includes many MMC-specific commands that may have
> other meanings in different standards. Someone may want to remove
> those commands; at the same time, people that trust their users may
> want to add persistent reservations, trim/discard, or even access to
> vendor-specific commands.
>
> Filters used to be mutable via sysfs, but the implementation was
> never enabled. Add it back, and let the admin set this up per device.
>
> A simple bitmap does not let you do things like enabling command A with
> option B on a specific device for a certain block range. However, the
> question is really whether this is needed---in fact, neither of the known
> uses for the filtering need it.
>
> In one use case, the administrator then needs the ability to configure
> devices easily, for example to be much more restrictive on non-MMC
> devices. It must be done with the same tools it uses for other aspects
> of the policy---which will be a combination of DAC (Unix permissions and
> ACLs) and sysfs. Different SCSI standards may give different meanings
> for the same byte value, but a simple bitmap is enough for this.
>
> In the virtualization case, the problem is really that you want to
> pass through everything or almost everything, while still running as
> confined as possible (i.e. CAP_SYS_RAWIO is not a choice). But in this
> case a more complex filtering can be done just as easily in userspace,
> in the virtual machine monitor. While the userspace filter can be
> subverted if the guest can escape the QEMU jail, the bitmap still lets
> you block some commands at the kernel level if really necessary.
>
> One alternative is a ioctl to disable the filter altogether, to be
> used together with SCM_RIGHTS file descriptor passing. This works in
> the virtualization case but not for policy decisions. So this patch
> series provides the sysfs knob. It is a tweaked revert of commit 018e044
> (block: get rid of queue-private command filter, 2009-06-26).
>
> Please review!
>
> Paolo
>
> v1->v2: add OOM and capability checks
>
> Paolo Bonzini (3):
> block: add back queue-private command filter
> scsi: create an all-zero filter for scanners
> block: add back command filter modification via sysfs
>
> Documentation/block/queue-sysfs.txt | 16 +++++
> block/Kconfig | 10 +++
> block/blk-sysfs.c | 43 +++++++++++++
> block/bsg.c | 2 +-
> block/scsi_ioctl.c | 117 +++++++++++++++++++++++++++++++----
> drivers/scsi/scsi_scan.c | 6 ++-
> drivers/scsi/sg.c | 7 +-
> include/linux/blkdev.h | 31 +++++++++-
> 8 files changed, 213 insertions(+), 19 deletions(-)
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
Ping?
Tejun, Jens, anyone else, any hope that this gets in 3.7?
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs
2012-10-04 10:12 ` [PATCH v2 0/3] block: add queue-private command filter, editable " Paolo Bonzini
@ 2012-10-19 0:22 ` Tejun Heo
2012-10-19 9:07 ` Paolo Bonzini
0 siblings, 1 reply; 7+ messages in thread
From: Tejun Heo @ 2012-10-19 0:22 UTC (permalink / raw)
To: Paolo Bonzini
Cc: linux-kernel, James Bottomley, Jens Axboe, Ric Wheeler, Alan Cox,
linux-scsi
Hello, Paolo.
Sorry about the delay. -EWASTRAVELING and it seems Jens was too.
On Thu, Oct 04, 2012 at 12:12:12PM +0200, Paolo Bonzini wrote:
> Il 25/09/2012 17:30, Paolo Bonzini ha scritto:
> > The set of use cases for SG_IO is quite variable that no single filter can
> > accomodate all of them. The current filter is tailored very much to
> > CD burning, and includes many MMC-specific commands that may have
> > other meanings in different standards. Someone may want to remove
> > those commands; at the same time, people that trust their users may
> > want to add persistent reservations, trim/discard, or even access to
> > vendor-specific commands.
> >
> > Filters used to be mutable via sysfs, but the implementation was
> > never enabled. Add it back, and let the admin set this up per device.
> >
> > A simple bitmap does not let you do things like enabling command A with
> > option B on a specific device for a certain block range. However, the
> > question is really whether this is needed---in fact, neither of the known
> > uses for the filtering need it.
> >
> > In one use case, the administrator then needs the ability to configure
> > devices easily, for example to be much more restrictive on non-MMC
> > devices. It must be done with the same tools it uses for other aspects
> > of the policy---which will be a combination of DAC (Unix permissions and
> > ACLs) and sysfs. Different SCSI standards may give different meanings
> > for the same byte value, but a simple bitmap is enough for this.
> >
> > In the virtualization case, the problem is really that you want to
> > pass through everything or almost everything, while still running as
> > confined as possible (i.e. CAP_SYS_RAWIO is not a choice). But in this
> > case a more complex filtering can be done just as easily in userspace,
> > in the virtual machine monitor. While the userspace filter can be
> > subverted if the guest can escape the QEMU jail, the bitmap still lets
> > you block some commands at the kernel level if really necessary.
> >
> > One alternative is a ioctl to disable the filter altogether, to be
> > used together with SCM_RIGHTS file descriptor passing. This works in
> > the virtualization case but not for policy decisions. So this patch
> > series provides the sysfs knob. It is a tweaked revert of commit 018e044
> > (block: get rid of queue-private command filter, 2009-06-26).
If your use case at hand is mostly virtualization, I personally would
prefer the latter solution instead of extending in-kernel SG_IO
filter. It could be that I'm just not aware but I don't think there
have been too many complaints regarding other use cases. This type of
deep inspection and filtering has fairly strong tendency to be
unpopular. Userland configurable one is even scarier and I don't
think too many would know and make use of it in the end.
Jens, what are your thoughts?
Thanks.
--
tejun
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 0/3] block: add queue-private command filter, editable via sysfs
2012-10-19 0:22 ` Tejun Heo
@ 2012-10-19 9:07 ` Paolo Bonzini
0 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2012-10-19 9:07 UTC (permalink / raw)
To: Tejun Heo
Cc: linux-kernel, James Bottomley, Jens Axboe, Ric Wheeler, Alan Cox,
linux-scsi
> > In one use case, the administrator then needs the ability to configure
> > devices easily, for example to be much more restrictive on non-MMC
> > devices. It must be done with the same tools it uses for other
> > aspects of the policy---which will be a combination of DAC (Unix
> > permissions and ACLs) and sysfs. Different SCSI standards may give different
> > meanings for the same byte value, but a simple bitmap is enough for this.
> >
> > In the virtualization case, the problem is really that you want to
> > pass through everything or almost everything, while still running
> > as confined as possible (i.e. CAP_SYS_RAWIO is not a choice). But
> > in this case a more complex filtering can be done just as easily in
> > userspace, in the virtual machine monitor.
> >
> > One alternative is a ioctl to disable the filter altogether, to be
> > used together with SCM_RIGHTS file descriptor passing. This works in
> > the virtualization case but not for policy decisions. So this patch
> > series provides the sysfs knob. It is a tweaked revert of commit
> > 018e044 (block: get rid of queue-private command filter, 2009-06-26).
>
> If your use case at hand is mostly virtualization, I personally would
> prefer the latter solution instead of extending in-kernel SG_IO
> filter. It could be that I'm just not aware but I don't think there
> have been too many complaints regarding other use cases. This type
> of deep inspection and filtering has fairly strong tendency to be
> unpopular. Userland configurable one is even scarier and I don't
> think too many would know and make use of it in the end.
Actually I plan to set up the filtering in udev, so that we need not
pass through many MMC commands (some of which have completely different
meanings) to SBC devices. So it would really be useful.
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread