[PATCH v3 0/2] allow blk-zoned ioctls without CAP_SYS_ADMIN

From: Niklas Cassel
Date: Mon Jun 14 2021 - 08:23:28 EST


From: Niklas Cassel <niklas.cassel@xxxxxxx>

Allow the following blk-zoned ioctls: BLKREPORTZONE, BLKRESETZONE,
BLKOPENZONE, BLKCLOSEZONE, and BLKFINISHZONE to be performed without
CAP_SYS_ADMIN.

Neither read() nor write() requires CAP_SYS_ADMIN, and considering
the close relationship between read()/write() and these ioctls, there
is no reason to require CAP_SYS_ADMIN for these ioctls either.

Changes since v2:
-Drop the FMODE_READ check from patch 2/2.
Right now it is possible to open() the device with O_WRONLY
and get the zone report from that fd. Therefore adding a
FMODE_READ check on BLKREPORTZONE would break existing applications.
Instead, just remove the existing CAP_SYS_ADMIN check.


Niklas Cassel (2):
blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN

block/blk-zoned.c | 6 ------
1 file changed, 6 deletions(-)

--
2.31.1