Re: SG_IO and security

Alan Cox
2004-08-12T21:24:10Z

On Iau, 2004-08-12 at 19:29, Jens Axboe wrote:
> +static int sg_allowed_cmd(unsigned char opcode, int may_write)
> +{
> + if (capable(CAP_SYS_RAWIO))
> + return 1;
> + if (may_write)
> + return 1;

I agree with passing the data down, unfortunately anyone with a raw
device access they can open for write can still physically anihiliate
the hardware. That causes real problems for anyone allocating partitions
for databases like Oracle, giving direct user access to devices for
virtualization like UML, giving direct user access to a M/O drive.

It also doesn't solve the read/write outside of partition problem.

Alan