Re: [PATCH] allow root to modify raw scsi command permissions list

[Peter Jones <pjones@redhat.com>]

On Wed, 2004-09-15 at 21:50 +0200, Jens Axboe wrote:
> > This could also be done in your approach. One possibility would be to 
> > start with empty filter and call from CD/DVD registering a function that 
> > sets the filter you currently have as default. This would be both flexible 
> > and safe.
> 
> I think that's a really nice idea. I've said right from the beginning
> that the command tables cannot even be per-device type, at least with
> CDROMs we have examples of commands with different meanings. But at
> least with a device-type default list we're a little closer.

It'd be pretty easy to add device-type defaults to my patch, and make
them registered by the individual drivers.

I'm just not sure I see the point in doing it.  Without them, you get a
_somewhat_ reasonable set of defaults if you don't want to mess with it,
and distros can easily set their own per-device tables for each device
type, vendor specific commands, etc.  It's even pretty simple to just
deny everything, if that's what distro maintainers or sysadmins want to
do.

Not doing it also means that the device driver code itself needs less
maintenance, and won't need to be updated every time some vendor comes
up with a new READ command.  That makes it easier if for example distros
decide to push new command tables as updates, I think.

> A good reminder of why the whole thing is a mess :-)

It sure is.
-- 
        Peter