diff options
| author | Kanchan Joshi <joshi.k@samsung.com> | 2022-11-01 10:43:07 +0100 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2022-11-15 10:50:30 +0100 |
| commit | e4fbcf32c860f98103ca7f1dc8c0dc69e2219ec6 (patch) | |
| tree | 9ea6c97adb7f995c50d863bdea264c7bd6bfd917 /drivers/nvme | |
| parent | 855b7717f44b13e0990aa5ad36bbf9aa35051516 (diff) | |
| download | linux-stable-e4fbcf32c860f98103ca7f1dc8c0dc69e2219ec6.tar.gz linux-stable-e4fbcf32c860f98103ca7f1dc8c0dc69e2219ec6.tar.bz2 linux-stable-e4fbcf32c860f98103ca7f1dc8c0dc69e2219ec6.zip | |
nvme: identify-namespace without CAP_SYS_ADMIN
Allow all identify-namespace variants (CNS 00h, 05h and 08h) without
requiring CAP_SYS_ADMIN. The information (retrieved using id-ns) is
needed to form IO commands for passthrough interface.
Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'drivers/nvme')
| -rw-r--r-- | drivers/nvme/host/ioctl.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index 1d68f161064a..9550a69029b3 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -22,9 +22,23 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, c->common.opcode == nvme_fabrics_command) return false; - /* do not allow unprivileged admin commands */ - if (!ns) + /* + * Do not allow unprivileged passthrough of admin commands except + * for a subset of identify commands that contain information required + * to form proper I/O commands in userspace and do not expose any + * potentially sensitive information. + */ + if (!ns) { + if (c->common.opcode == nvme_admin_identify) { + switch (c->identify.cns) { + case NVME_ID_CNS_NS: + case NVME_ID_CNS_CS_NS: + case NVME_ID_CNS_NS_CS_INDEP: + return true; + } + } return false; + } /* * Only allow I/O commands that transfer data to the controller if the |