linux_dsm_epyc7002/drivers/block
Ilya Dryomov f44d04e696 rbd: require global CAP_SYS_ADMIN for mapping and unmapping
It turns out that currently we rely only on sysfs attribute
permissions:

  $ ll /sys/bus/rbd/{add*,remove*}
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add_single_major
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/remove
  --w------- 1 root root 4096 Sep  3 20:38 /sys/bus/rbd/remove_single_major

This means that images can be mapped and unmapped (i.e. block devices
can be created and deleted) by a UID 0 process even after it drops all
privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
as long as UID 0 is mapped into that user namespace.

Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
and require CAP_SYS_ADMIN in the initial user namespace for mapping and
unmapping, and also for dumping the configuration string and refreshing
the image header.

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
2020-09-07 13:14:30 +02:00
..
aoe treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
drbd treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
mtip32xx blk-mq: move failure injection out of blk_mq_complete_request 2020-06-24 09:15:57 -06:00
paride treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
rnbd block/rnbd: Ensure err is always initialized in process_rdma 2020-08-21 17:09:11 -06:00
rsxx treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
xen-blkback treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
zram for-5.9/block-20200802 2020-08-03 11:57:03 -07:00
amiflop.c
ataflop.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
brd.c block: move ->make_request_fn to struct block_device_operations 2020-07-01 07:27:24 -06:00
cryptoloop.c
floppy.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
loop.c block-5.9-2020-08-28 2020-08-28 16:38:29 -07:00
loop.h
Makefile
nbd.c nbd: restore default timeout when setting it to zero 2020-08-26 09:08:49 -06:00
null_blk_main.c null_blk: fix passing of REQ_FUA flag in null_handle_rq 2020-08-21 17:14:28 -06:00
null_blk_trace.c
null_blk_trace.h
null_blk_zoned.c null_blk: introduce zone capacity for zoned device 2020-07-08 16:16:19 +02:00
null_blk.h null_blk: introduce zone capacity for zoned device 2020-07-08 16:16:19 +02:00
pktcdvd.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ps3disk.c
ps3vram.c block: move ->make_request_fn to struct block_device_operations 2020-07-01 07:27:24 -06:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
rbd.c rbd: require global CAP_SYS_ADMIN for mapping and unmapping 2020-09-07 13:14:30 +02:00
skd_main.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
skd_s1120.h
sunvdc.c
swim3.c
swim_asm.S
swim.c
sx8.c
umem.c block: move ->make_request_fn to struct block_device_operations 2020-07-01 07:27:24 -06:00
umem.h
virtio_blk.c block: virtio_blk: fix handling single range discard request 2020-08-17 06:59:41 -07:00
xen-blkfront.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
xsysace.c
z2ram.c mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00