Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: Sa1p7tKt2T1KKxTnSG48NIzJNr2tOueD6zH2cITT4ALLaTX6sZjKfioJAWDH1y7McgBICUWeaj
 u9UMm0sv49FpqOdJpq1jYpyXu2z9u7EkvxnpI2WQmS757i4CP9NEpKiGY0JAY5l0qIrhP0osm7
 qIHKQo07+Qp0QRfTA39cKyMtKCa7ltO6du4WpSPX+3uV9E7CLJH4OhAJShpUyLckJUH40Euob5
 3vMrgtlVhyF9UTEGqFWIhqsXcMNpKQvsL+sb9gnanBa4ior32XDin+AZzjmslBgZYT91b5BMrE
 aDc=
From:   Damien Le Moal <Damien.LeMoal@wdc.com>
To:     "dsterba@suse.cz" <dsterba@suse.cz>,
        Niklas Cassel <Niklas.Cassel@wdc.com>
CC:     Jens Axboe <axboe@kernel.dk>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 2/2] blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
Thread-Topic: [PATCH 2/2] blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
Thread-Index: AQHXViSI8g5t53fJ2UqQanQJze0fFQ==
Date:   Thu, 3 Jun 2021 10:00:08 +0000
Message-ID: <DM6PR04MB7081B69E31BB7ADDF02E2D9BE73C9@DM6PR04MB7081.namprd04.prod.outlook.com>
References: <20210531135444.122018-1-Niklas.Cassel@wdc.com>
 <20210531135444.122018-3-Niklas.Cassel@wdc.com>
 <20210603095117.GU31483@twin.jikos.cz>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f824e368-c7ca-4b7c-59f2-08d926765e72
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2021 10:00:08.0512
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 9bBtNsrEL3JFu8baYZF9Ck9iIn8guADscfdKAr49n5z2dWmEr8Pa77kzSYKRR5QQwOCVoLW2YxHlrGJ68RUfkg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR04MB5595
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2021/06/03 18:54, David Sterba wrote:=0A=
> On Mon, May 31, 2021 at 01:54:53PM +0000, Niklas Cassel wrote:=0A=
>> From: Niklas Cassel <niklas.cassel@wdc.com>=0A=
>>=0A=
>> Performing a BLKREPORTZONE operation should be allowed under the same=0A=
>> permissions as read(). (read() does not require CAP_SYS_ADMIN).=0A=
>>=0A=
>> Remove the CAP_SYS_ADMIN requirement, and instead check that the fd was=
=0A=
>> successfully opened with FMODE_READ. This way BLKREPORTZONE will match=
=0A=
>> the access control requirement of read().=0A=
> =0A=
> Does this mean that a process that does not have read nor write access=0A=
> to the device itself (blocks) is capable of reading the zone=0A=
> information? Eg. some monitoring tool.=0A=
=0A=
With this change, to do a report zones, the process will only need to have =
read=0A=
access to the device. And if it has read access, it also means that it can =
read=0A=
the zones content.=0A=
=0A=
=0A=
-- =0A=
Damien Le Moal=0A=
Western Digital Research=0A=