public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 part3 0/7] Customize the SG_IO whitelist for different device classes
@ 2013-05-23 13:59 Paolo Bonzini
  2013-05-23 13:59 ` [PATCH v3 part3 1/7] sg_io: complete transition to per-class lists of allowed commands Paolo Bonzini
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: Paolo Bonzini @ 2013-05-23 13:59 UTC (permalink / raw)
  To: linux-kernel; +Cc: tj

The last problem in the SG_IO whitelist is that because the bitmap
of allowed commands is designed for MMC devices only, some commands
are missing even though they are generally useful and not insecure.
At least, they are not more insecure than anything else you can do
if you have access to /dev/sdX or /dev/stX nodes.

In particular, the whitelist is hardly usable for tapes; and in the
case of virtualization, the few missing commands for disks may cause
guests to log errors.

Paolo

Paolo Bonzini (7):
  sg_io: complete transition to per-class lists of allowed commands
  sg_io: create separate entries for conflicting commands
  sg_io: cleanup and complete whitelist for rare device types
  sg_io: whitelist another command for multimedia devices
  sg_io: cleanup and complete whitelist for media changers
  sg_io: cleanup and complete whitelist for tapes
  sg_io: cleanup and complete whitelist for disks

 block/scsi_ioctl.c  | 309 ++++++++++++++++++++++++++++++++++------------------
 include/scsi/scsi.h |   3 +
 2 files changed, 206 insertions(+), 106 deletions(-)

-- 
1.8.1.4


^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2013-05-23 14:01 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-23 13:59 [PATCH v3 part3 0/7] Customize the SG_IO whitelist for different device classes Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 1/7] sg_io: complete transition to per-class lists of allowed commands Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 2/7] sg_io: create separate entries for conflicting commands Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 3/7] sg_io: cleanup and complete whitelist for rare device types Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 4/7] sg_io: whitelist another command for multimedia devices Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 5/7] sg_io: cleanup and complete whitelist for media changers Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 6/7] sg_io: cleanup and complete whitelist for tapes Paolo Bonzini
2013-05-23 13:59 ` [PATCH v3 part3 7/7] sg_io: cleanup and complete whitelist for disks Paolo Bonzini

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox