From: Paolo Bonzini <pbonzini@redhat.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: linux-kernel@vger.kernel.org, axboe@kernel.dk,
linux-scsi@vger.kernel.org
Subject: Re: [PATCH] scsi: allow persistent reservations without CAP_SYS_RAWIO
Date: Tue, 12 Jun 2012 20:39:21 +0200 [thread overview]
Message-ID: <4FD78CD9.6080807@redhat.com> (raw)
In-Reply-To: <1339524176.3050.18.camel@dabdike.int.hansenpartnership.com>
Il 12/06/2012 20:02, James Bottomley ha scritto:
>> > Thanks for taking the time to explain---I knew about this, but I thought
>> > it could (perhaps should) be disabled on the SAN. Anybody could already
>> > use reservation by transport ID if they had root access on the local
>> > machine, no?
> No ... it's required for multipath to work correctly and multipath is a
> usual enterprise feature.
>
> The only way around this is either to trust your users or not to give
> out root ... and most data centres choose the latter. It causes real
> pain from NPIV and SR-IOV ...
I can imagine... my impression was that it would only affect whatever
LUNs the zoning allowed access to (NPIV is pretty much required to use
persistent reservations on guests, or guests will all share the same WWN).
Would it be acceptable to restrict access to PR OUT with ALL_TG_PT set,
and allow it freely without the flag?
Paolo
next prev parent reply other threads:[~2012-06-12 18:39 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-06-12 16:08 [PATCH] scsi: allow persistent reservations without CAP_SYS_RAWIO Paolo Bonzini
2012-06-12 16:21 ` James Bottomley
2012-06-12 16:24 ` Paolo Bonzini
2012-06-12 16:54 ` Paolo Bonzini
2012-06-12 17:20 ` James Bottomley
2012-06-12 17:25 ` Paolo Bonzini
2012-06-12 18:02 ` James Bottomley
2012-06-12 18:39 ` Paolo Bonzini [this message]
2012-06-12 16:55 ` Alan Cox
2012-06-12 17:08 ` Paolo Bonzini
2012-06-12 18:52 ` Can we pass a file handle down to the block ioctls to implement per file filters on scsi SG_IO ? Alan Cox
2012-06-12 19:13 ` Paolo Bonzini
2012-06-12 17:08 ` [PATCH] scsi: allow persistent reservations without CAP_SYS_RAWIO John Stoffel
2012-06-12 17:13 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4FD78CD9.6080807@redhat.com \
--to=pbonzini@redhat.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).