Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: LZV3pIej4MHOL7/4enAsL15oYyHt0/eCnKmQKPV4CUf2L+f7yj+s+eww6J5Ax0s4sqMvTHtRqi
 +5t/D17z3Oznc4A6v4/M8EKPaiyk9MdHZnVpLthH3zC45Vsns39QgeD6rDxR2sHJVfbRX+3ro7
 OlpXdCUB6oDE59Ji3BVY3gWD7rrzvh+n+ikogE28mHMrTw77OqxRhugfgq9SwPEUcuG8bn9fnT
 n/+DCIyoyezkk6lh35LOFNhrMW80b4hwy8Nr7kPjhNqejdFfQCmoixJD6mtGSqPjW/o6cCjyzo
 08I=
From:   Niklas Cassel <Niklas.Cassel@wdc.com>
To:     Jens Axboe <axboe@kernel.dk>
CC:     Damien Le Moal <Damien.LeMoal@wdc.com>,
        Niklas Cassel <Niklas.Cassel@wdc.com>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: [PATCH 1/2] blk-zoned: allow zone management send operations without
 CAP_SYS_ADMIN
Thread-Topic: [PATCH 1/2] blk-zoned: allow zone management send operations
 without CAP_SYS_ADMIN
Thread-Index: AQHXViSHoqrmKcnFs0emlJmdZPJZxw==
Date:   Mon, 31 May 2021 13:54:52 +0000
Message-ID: <20210531135444.122018-2-Niklas.Cassel@wdc.com>
References: <20210531135444.122018-1-Niklas.Cassel@wdc.com>
In-Reply-To: <20210531135444.122018-1-Niklas.Cassel@wdc.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 33ffd291-7a29-4e88-2dcf-08d9243baa13
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 May 2021 13:54:52.2818
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /IwRjap4hcqK8lapKxZHYggalFguGIscVyZEGtCzpDNWngtNJam2ML3Re2gqEk6tostCzeOrrBwqyVxSdAMroA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR04MB7349
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Niklas Cassel <niklas.cassel@wdc.com>

Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE
and BLKFINISHZONE) should be allowed under the same permissions as write().
(write() does not require CAP_SYS_ADMIN).

Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if
the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).

Currently, zone management send operations require both CAP_SYS_ADMIN
and that the fd was successfully opened with FMODE_WRITE.

Remove the CAP_SYS_ADMIN requirement, so that zone management send
operations match the access control requirement of write(), BLKSECDISCARD
and BLKZEROOUT.

Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
---
 block/blk-zoned.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 250cb76ee615..0789e6e9f7db 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -349,9 +349,6 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, f=
mode_t mode,
 	if (!blk_queue_is_zoned(q))
 		return -ENOTTY;
=20
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
-
 	if (!(mode & FMODE_WRITE))
 		return -EBADF;
=20
--=20
2.31.1