diff options
| author | Kanchan Joshi <[email protected]> | 2022-11-01 10:43:07 +0100 |
|---|---|---|
| committer | Christoph Hellwig <[email protected]> | 2022-11-15 10:50:30 +0100 |
| commit | e4fbcf32c860f98103ca7f1dc8c0dc69e2219ec6 (patch) | |
| tree | 9ea6c97adb7f995c50d863bdea264c7bd6bfd917 | |
| parent | 855b7717f44b13e0990aa5ad36bbf9aa35051516 (diff) | |
nvme: identify-namespace without CAP_SYS_ADMIN
Allow all identify-namespace variants (CNS 00h, 05h and 08h) without
requiring CAP_SYS_ADMIN. The information (retrieved using id-ns) is
needed to form IO commands for passthrough interface.
Signed-off-by: Kanchan Joshi <[email protected]>
Reviewed-by: Jens Axboe <[email protected]>
Reviewed-by: Keith Busch <[email protected]>
Reviewed-by: Chaitanya Kulkarni <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
| -rw-r--r-- | drivers/nvme/host/ioctl.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index 1d68f161064a..9550a69029b3 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -22,9 +22,23 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, c->common.opcode == nvme_fabrics_command) return false; - /* do not allow unprivileged admin commands */ - if (!ns) + /* + * Do not allow unprivileged passthrough of admin commands except + * for a subset of identify commands that contain information required + * to form proper I/O commands in userspace and do not expose any + * potentially sensitive information. + */ + if (!ns) { + if (c->common.opcode == nvme_admin_identify) { + switch (c->identify.cns) { + case NVME_ID_CNS_NS: + case NVME_ID_CNS_CS_NS: + case NVME_ID_CNS_NS_CS_INDEP: + return true; + } + } return false; + } /* * Only allow I/O commands that transfer data to the controller if the |