Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: bQbRRKv4mVQucX46Lw6rk71W/S95/nK39tmX32jXLrknhDTyQe1nwe1JX5HPCKMUx0D6/bA471
 fXrplec/jqu0NVOv5liFeMRVRO49ZdiphyflbDEP/RaVJUCSSwmZLvQdBpDd9h7apaQTrd0exj
 lxMGntHKGARIOyuB0Mh6zJVbRR7WpSK1FKrmOEePDdUGstfIVIm9ba1w5EzbBYwVwqA+1Cjvvb
 whf3hhh5gEGoa65WvGQV1MtF3LdjVdBiV6ysji9vajpRgkRR/CdsDAK2l2tmcoXegj0hb0H4C+
 2ig=
From:   Aravind Ramesh <Aravind.Ramesh@wdc.com>
To:     Niklas Cassel <Niklas.Cassel@wdc.com>,
        Jens Axboe <axboe@kernel.dk>,
        Damien Le Moal <Damien.LeMoal@wdc.com>,
        Shaun Tancheff <shaun@tancheff.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        Hannes Reinecke <hare@suse.com>
CC:     Damien Le Moal <Damien.LeMoal@wdc.com>,
        Niklas Cassel <Niklas.Cassel@wdc.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        Jens Axboe <axboe@fb.com>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH v3 1/2] blk-zoned: allow zone management send operations
 without CAP_SYS_ADMIN
Thread-Topic: [PATCH v3 1/2] blk-zoned: allow zone management send operations
 without CAP_SYS_ADMIN
Thread-Index: AQHXYRgmF8KejSRZnk+qFcY64aClOqsWpS8g
Date:   Wed, 16 Jun 2021 13:42:47 +0000
Message-ID: <BYAPR04MB4056CD5501CAB658B2B274358C0F9@BYAPR04MB4056.namprd04.prod.outlook.com>
References: <20210614122303.154378-1-Niklas.Cassel@wdc.com>
 <20210614122303.154378-2-Niklas.Cassel@wdc.com>
In-Reply-To: <20210614122303.154378-2-Niklas.Cassel@wdc.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?yTnuYAarFnvtiysiJve1O1+Pdewp0Ij2eG02nH155fU71gkb42tBU9WI+z0y?=
 =?us-ascii?Q?XhqlEtORQnlSwMB71/bXPt2T+Gpv59KpAGLR2Ft7/N5rLcsMHo4HBQNYHuRP?=
 =?us-ascii?Q?bpIdGIWvIXG3pBmJxQXDKpG3x7eVOjU+a0HA2THCU7RjP5yiXTPuTh9eGkDi?=
 =?us-ascii?Q?JPqsUp933Gt4F0INDtQadSOPppHBWYxBS7e+50loL79FD8kgr+l0YY0Hm4jD?=
 =?us-ascii?Q?PwFET5JLSpMfAtnjD/I1MELwE0RRk9Hk5AG8ABN9BN+GV1eaLdai8TJ7ArKz?=
 =?us-ascii?Q?DHpoUxIuoNrXtsZAkcTjM7Mu/zGyqNE57EAlyJ64Y8LgAJBzRWsHALtgJ/vF?=
 =?us-ascii?Q?NFr9M1Hwxw+eVwX1kuC7xPN6wiCm48TqeA3oepQQmJKqHH7jdAdDMESlz0sD?=
 =?us-ascii?Q?dFjaEPb3Yv0VsxzjFnpRTsEyyVjomI0HoFxE9nfD6HynG7+dCuvzf7p1CSbC?=
 =?us-ascii?Q?u7IcdoJrfgCECaX3GMoaY9v/LdGmq/WN+z1c774/ujlwWBxqdqaLoYtZHlIM?=
 =?us-ascii?Q?jtQymbBVhHPgLGW27p0G0rm8nU3sQhaT0KUYDCzvBH+3OFieIAi0KOVPXuWL?=
 =?us-ascii?Q?fwa1yJxbFaxFBeCcqICdQFtTNMVMcr8HaaZlNfP96nRpqlCGlVB8NqWDCJb6?=
 =?us-ascii?Q?dxEUcGK7I1p5Bz78Tff7JEM/UbhZs+RuHnQGCxwNLOpqShQk/hlJWhfFe9l5?=
 =?us-ascii?Q?VSUuh4XmJwxzlOxa8t2PbFCRbS8h54q6U75I9VsOYMuIytuU/z7XgVqCKxs4?=
 =?us-ascii?Q?zUZek+5pYYD74aOrG4g+psPddFVe3Rj2hJA1dN4gZRhY+rKylftbZTD2LQfw?=
 =?us-ascii?Q?QAtOMMMM/+e+mLt5jqE5hV8sROxxTeC/B6CNaNeS2MxRclFspY9q2tqJ50D6?=
 =?us-ascii?Q?D9ZNX67uF7qj93f2sZO2CSm7yHYVbughjevrt8SpYL5NXY6BHJ7TrscFoiLR?=
 =?us-ascii?Q?gwzkTzrvNutSPAB2NOzTuH/FXDH917/jzhrkhUgFvbGyclfpusxD0JHObnY7?=
 =?us-ascii?Q?gFs+PV2z8PMtBpm1lUwOg3AG2tNW6+MChTxOTcoK67RwsThUoFQupd05WfO1?=
 =?us-ascii?Q?uv+p3XYk5cNpKOkf0CLbtL+7tfZORh+VVkSKJA5avy9xrizXpJ71VhKPeIZw?=
 =?us-ascii?Q?8DD4Hd3kZgYqfR2TD3zLkDsDCHrfEa4buF/k5quSd1U+nDus7HOz6IJXWXNM?=
 =?us-ascii?Q?2BjVya5wvXeZQN+f+OYgVv9XG6foqfh/Qi/veX9TH2rKoWQwUqgLEtY878gI?=
 =?us-ascii?Q?SoirTrFPnEgnPLtAgdi+LG3QC9tPUP7SH0Tli7+Tlfh8g/7R3zIKZBtrQbx7?=
 =?us-ascii?Q?Fw8=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: wdc.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BYAPR04MB4056.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 30d8c825-6cf9-435c-0ad4-08d930cca069
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jun 2021 13:42:47.1176
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: vA4ndkPUMciYh7WVlDnsiGHk2hwgS5ZcP2rBTRNbH2MrDpS11UOe0+hMb4fpEyQVx8LCf+HqMBZV79o9x6CdCw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR04MB6133
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> -----Original Message-----
> From: Niklas Cassel <Niklas.Cassel@wdc.com>
> Sent: Monday, June 14, 2021 5:53 PM
> To: Jens Axboe <axboe@kernel.dk>; Damien Le Moal <Damien.LeMoal@wdc.com>;
> Shaun Tancheff <shaun@tancheff.com>; Martin K. Petersen
> <martin.petersen@oracle.com>; Hannes Reinecke <hare@suse.com>
> Cc: Damien Le Moal <Damien.LeMoal@wdc.com>; Niklas Cassel
> <Niklas.Cassel@wdc.com>; stable@vger.kernel.org; Jens Axboe <axboe@fb.com=
>;
> linux-block@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: [PATCH v3 1/2] blk-zoned: allow zone management send operations
> without CAP_SYS_ADMIN
>=20
> From: Niklas Cassel <niklas.cassel@wdc.com>
>=20
> Zone management send operations (BLKRESETZONE, BLKOPENZONE,
> BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissi=
ons
> as write().
> (write() does not require CAP_SYS_ADMIN).
>=20
> Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check i=
f the fd
> was successfully opened with FMODE_WRITE.
> (They do not require CAP_SYS_ADMIN).
>=20
> Currently, zone management send operations require both CAP_SYS_ADMIN and
> that the fd was successfully opened with FMODE_WRITE.
>=20
> Remove the CAP_SYS_ADMIN requirement, so that zone management send
> operations match the access control requirement of write(), BLKSECDISCARD=
 and
> BLKZEROOUT.
>=20
> Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls")
> Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
> Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
> Cc: stable@vger.kernel.org # v4.10+
> ---
> Changes since v2:
> -None
>=20
> Note to backporter:
> Function was added as blkdev_reset_zones_ioctl() in v4.10.
> Function was renamed to blkdev_zone_mgmt_ioctl() in v5.5.
> The patch is valid both before and after the function rename.
>=20
>  block/blk-zoned.c | 3 ---
>  1 file changed, 3 deletions(-)
>=20
> diff --git a/block/blk-zoned.c b/block/blk-zoned.c index
> 250cb76ee615..0789e6e9f7db 100644
> --- a/block/blk-zoned.c
> +++ b/block/blk-zoned.c
> @@ -349,9 +349,6 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev,
> fmode_t mode,
>  	if (!blk_queue_is_zoned(q))
>  		return -ENOTTY;
>=20
> -	if (!capable(CAP_SYS_ADMIN))
> -		return -EACCES;
> -
>  	if (!(mode & FMODE_WRITE))
>  		return -EBADF;
>=20
> --
> 2.31.1

Looks good,

Reviewed-by: Aravind Ramesh <aravind.ramesh@wdc.com>