[PATCH] blktrace: require CAP_SYS_ADMIN for the BLKTRACE ioctls

[Tao Cui]

From: Tao Cui <cuitao@xxxxxxxxxx>

BLKTRACESETUP allocates user-sized relay buffers and sets up a trace
that outlives the creating fd.  Every command of the interface,
BLKTRACESETUP, BLKTRACESETUP2, BLKTRACESTART, BLKTRACESTOP,
BLKTRACETEARDOWN and the 32-bit variant, can be issued by anyone who
can open the block device node.  The sg passthrough path
(sg_ioctl_common) reaches the same code with an sg char device, so a
container that is handed either node can hold trace state and relay
memory on shared devices.  The trace data itself stays root-only: the
debugfs relay files are not readable past root.

Gate the whole family behind CAP_SYS_ADMIN.

Verified on next-20261104 under qemu: with the patch, BLKTRACESETUP
with all capabilities dropped is rejected with EPERM; without the
patch the same call succeeds.

Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
---
 kernel/trace/blktrace.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 8cd2520b4c99..c1bf8ca350fe 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -927,6 +927,9 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
 	int ret, start = 0;
 	char b[BDEVNAME_SIZE];
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	switch (cmd) {
 	case BLKTRACESETUP2:
 		snprintf(b, sizeof(b), "%pg", bdev);
-- 
2.43.0