scsi: scsi_ioctl: Simplify SCSI passthrough permission checking
Remove the separate command filter structure and just use a switch statement (which also cought two duplicate commands), return a bool and give the function a sensible name. Link: https://lore.kernel.org/r/20210724072033.1284840-18-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Christoph Hellwig
Martin K. Petersen
parent
b69367dffd
commit
7353dc06c9
|
|
@ -22,13 +22,6 @@
|
|||
#include <scsi/scsi_cmnd.h>
|
||||
#include <scsi/sg.h>
|
||||
|
||||
struct blk_cmd_filter {
|
||||
unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
|
||||
unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
|
||||
};
|
||||
|
||||
static struct blk_cmd_filter blk_default_cmd_filter;
|
||||
|
||||
static int sg_get_version(int __user *p)
|
||||
{
|
||||
static const int sg_version_num = 30527;
|
||||
|
|
@ -80,115 +73,108 @@ static int sg_emulated_host(struct request_queue *q, int __user *p)
|
|||
return put_user(1, p);
|
||||
}
|
||||
|
||||
static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
|
||||
/*
|
||||
* Check if the given command is allowed.
|
||||
*
|
||||
* For unprivileged users only a small set of whitelisted command is allowed so
|
||||
* that they can't format the drive or update the firmware.
|
||||
*/
|
||||
bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode)
|
||||
{
|
||||
/* Basic read-only commands */
|
||||
__set_bit(TEST_UNIT_READY, filter->read_ok);
|
||||
__set_bit(REQUEST_SENSE, filter->read_ok);
|
||||
__set_bit(READ_6, filter->read_ok);
|
||||
__set_bit(READ_10, filter->read_ok);
|
||||
__set_bit(READ_12, filter->read_ok);
|
||||
__set_bit(READ_16, filter->read_ok);
|
||||
__set_bit(READ_BUFFER, filter->read_ok);
|
||||
__set_bit(READ_DEFECT_DATA, filter->read_ok);
|
||||
__set_bit(READ_CAPACITY, filter->read_ok);
|
||||
__set_bit(READ_LONG, filter->read_ok);
|
||||
__set_bit(INQUIRY, filter->read_ok);
|
||||
__set_bit(MODE_SENSE, filter->read_ok);
|
||||
__set_bit(MODE_SENSE_10, filter->read_ok);
|
||||
__set_bit(LOG_SENSE, filter->read_ok);
|
||||
__set_bit(START_STOP, filter->read_ok);
|
||||
__set_bit(GPCMD_VERIFY_10, filter->read_ok);
|
||||
__set_bit(VERIFY_16, filter->read_ok);
|
||||
__set_bit(REPORT_LUNS, filter->read_ok);
|
||||
__set_bit(SERVICE_ACTION_IN_16, filter->read_ok);
|
||||
__set_bit(RECEIVE_DIAGNOSTIC, filter->read_ok);
|
||||
__set_bit(MAINTENANCE_IN, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_BUFFER_CAPACITY, filter->read_ok);
|
||||
|
||||
/* Audio CD commands */
|
||||
__set_bit(GPCMD_PLAY_CD, filter->read_ok);
|
||||
__set_bit(GPCMD_PLAY_AUDIO_10, filter->read_ok);
|
||||
__set_bit(GPCMD_PLAY_AUDIO_MSF, filter->read_ok);
|
||||
__set_bit(GPCMD_PLAY_AUDIO_TI, filter->read_ok);
|
||||
__set_bit(GPCMD_PAUSE_RESUME, filter->read_ok);
|
||||
|
||||
/* CD/DVD data reading */
|
||||
__set_bit(GPCMD_READ_CD, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_CD_MSF, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_DISC_INFO, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_CDVD_CAPACITY, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_DVD_STRUCTURE, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_HEADER, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_TRACK_RZONE_INFO, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_SUBCHANNEL, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_TOC_PMA_ATIP, filter->read_ok);
|
||||
__set_bit(GPCMD_REPORT_KEY, filter->read_ok);
|
||||
__set_bit(GPCMD_SCAN, filter->read_ok);
|
||||
__set_bit(GPCMD_GET_CONFIGURATION, filter->read_ok);
|
||||
__set_bit(GPCMD_READ_FORMAT_CAPACITIES, filter->read_ok);
|
||||
__set_bit(GPCMD_GET_EVENT_STATUS_NOTIFICATION, filter->read_ok);
|
||||
__set_bit(GPCMD_GET_PERFORMANCE, filter->read_ok);
|
||||
__set_bit(GPCMD_SEEK, filter->read_ok);
|
||||
__set_bit(GPCMD_STOP_PLAY_SCAN, filter->read_ok);
|
||||
|
||||
/* Basic writing commands */
|
||||
__set_bit(WRITE_6, filter->write_ok);
|
||||
__set_bit(WRITE_10, filter->write_ok);
|
||||
__set_bit(WRITE_VERIFY, filter->write_ok);
|
||||
__set_bit(WRITE_12, filter->write_ok);
|
||||
__set_bit(WRITE_VERIFY_12, filter->write_ok);
|
||||
__set_bit(WRITE_16, filter->write_ok);
|
||||
__set_bit(WRITE_LONG, filter->write_ok);
|
||||
__set_bit(WRITE_LONG_2, filter->write_ok);
|
||||
__set_bit(WRITE_SAME, filter->write_ok);
|
||||
__set_bit(WRITE_SAME_16, filter->write_ok);
|
||||
__set_bit(WRITE_SAME_32, filter->write_ok);
|
||||
__set_bit(ERASE, filter->write_ok);
|
||||
__set_bit(GPCMD_MODE_SELECT_10, filter->write_ok);
|
||||
__set_bit(MODE_SELECT, filter->write_ok);
|
||||
__set_bit(LOG_SELECT, filter->write_ok);
|
||||
__set_bit(GPCMD_BLANK, filter->write_ok);
|
||||
__set_bit(GPCMD_CLOSE_TRACK, filter->write_ok);
|
||||
__set_bit(GPCMD_FLUSH_CACHE, filter->write_ok);
|
||||
__set_bit(GPCMD_FORMAT_UNIT, filter->write_ok);
|
||||
__set_bit(GPCMD_REPAIR_RZONE_TRACK, filter->write_ok);
|
||||
__set_bit(GPCMD_RESERVE_RZONE_TRACK, filter->write_ok);
|
||||
__set_bit(GPCMD_SEND_DVD_STRUCTURE, filter->write_ok);
|
||||
__set_bit(GPCMD_SEND_EVENT, filter->write_ok);
|
||||
__set_bit(GPCMD_SEND_KEY, filter->write_ok);
|
||||
__set_bit(GPCMD_SEND_OPC, filter->write_ok);
|
||||
__set_bit(GPCMD_SEND_CUE_SHEET, filter->write_ok);
|
||||
__set_bit(GPCMD_SET_SPEED, filter->write_ok);
|
||||
__set_bit(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL, filter->write_ok);
|
||||
__set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok);
|
||||
__set_bit(GPCMD_SET_STREAMING, filter->write_ok);
|
||||
__set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);
|
||||
|
||||
/* ZBC Commands */
|
||||
__set_bit(ZBC_OUT, filter->write_ok);
|
||||
__set_bit(ZBC_IN, filter->read_ok);
|
||||
}
|
||||
|
||||
int blk_verify_command(unsigned char *cmd, fmode_t mode)
|
||||
{
|
||||
struct blk_cmd_filter *filter = &blk_default_cmd_filter;
|
||||
|
||||
/* root can do any command. */
|
||||
if (capable(CAP_SYS_RAWIO))
|
||||
return 0;
|
||||
return true;
|
||||
|
||||
/* Anybody who can open the device can do a read-safe command */
|
||||
if (test_bit(cmd[0], filter->read_ok))
|
||||
return 0;
|
||||
|
||||
/* Write-safe commands require a writable open */
|
||||
if (test_bit(cmd[0], filter->write_ok) && (mode & FMODE_WRITE))
|
||||
return 0;
|
||||
|
||||
return -EPERM;
|
||||
switch (cmd[0]) {
|
||||
/* Basic read-only commands */
|
||||
case TEST_UNIT_READY:
|
||||
case REQUEST_SENSE:
|
||||
case READ_6:
|
||||
case READ_10:
|
||||
case READ_12:
|
||||
case READ_16:
|
||||
case READ_BUFFER:
|
||||
case READ_DEFECT_DATA:
|
||||
case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */
|
||||
case READ_LONG:
|
||||
case INQUIRY:
|
||||
case MODE_SENSE:
|
||||
case MODE_SENSE_10:
|
||||
case LOG_SENSE:
|
||||
case START_STOP:
|
||||
case GPCMD_VERIFY_10:
|
||||
case VERIFY_16:
|
||||
case REPORT_LUNS:
|
||||
case SERVICE_ACTION_IN_16:
|
||||
case RECEIVE_DIAGNOSTIC:
|
||||
case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */
|
||||
case GPCMD_READ_BUFFER_CAPACITY:
|
||||
/* Audio CD commands */
|
||||
case GPCMD_PLAY_CD:
|
||||
case GPCMD_PLAY_AUDIO_10:
|
||||
case GPCMD_PLAY_AUDIO_MSF:
|
||||
case GPCMD_PLAY_AUDIO_TI:
|
||||
case GPCMD_PAUSE_RESUME:
|
||||
/* CD/DVD data reading */
|
||||
case GPCMD_READ_CD:
|
||||
case GPCMD_READ_CD_MSF:
|
||||
case GPCMD_READ_DISC_INFO:
|
||||
case GPCMD_READ_DVD_STRUCTURE:
|
||||
case GPCMD_READ_HEADER:
|
||||
case GPCMD_READ_TRACK_RZONE_INFO:
|
||||
case GPCMD_READ_SUBCHANNEL:
|
||||
case GPCMD_READ_TOC_PMA_ATIP:
|
||||
case GPCMD_REPORT_KEY:
|
||||
case GPCMD_SCAN:
|
||||
case GPCMD_GET_CONFIGURATION:
|
||||
case GPCMD_READ_FORMAT_CAPACITIES:
|
||||
case GPCMD_GET_EVENT_STATUS_NOTIFICATION:
|
||||
case GPCMD_GET_PERFORMANCE:
|
||||
case GPCMD_SEEK:
|
||||
case GPCMD_STOP_PLAY_SCAN:
|
||||
/* ZBC */
|
||||
case ZBC_IN:
|
||||
return true;
|
||||
/* Basic writing commands */
|
||||
case WRITE_6:
|
||||
case WRITE_10:
|
||||
case WRITE_VERIFY:
|
||||
case WRITE_12:
|
||||
case WRITE_VERIFY_12:
|
||||
case WRITE_16:
|
||||
case WRITE_LONG:
|
||||
case WRITE_LONG_2:
|
||||
case WRITE_SAME:
|
||||
case WRITE_SAME_16:
|
||||
case WRITE_SAME_32:
|
||||
case ERASE:
|
||||
case GPCMD_MODE_SELECT_10:
|
||||
case MODE_SELECT:
|
||||
case LOG_SELECT:
|
||||
case GPCMD_BLANK:
|
||||
case GPCMD_CLOSE_TRACK:
|
||||
case GPCMD_FLUSH_CACHE:
|
||||
case GPCMD_FORMAT_UNIT:
|
||||
case GPCMD_REPAIR_RZONE_TRACK:
|
||||
case GPCMD_RESERVE_RZONE_TRACK:
|
||||
case GPCMD_SEND_DVD_STRUCTURE:
|
||||
case GPCMD_SEND_EVENT:
|
||||
case GPCMD_SEND_OPC:
|
||||
case GPCMD_SEND_CUE_SHEET:
|
||||
case GPCMD_SET_SPEED:
|
||||
case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
|
||||
case GPCMD_LOAD_UNLOAD:
|
||||
case GPCMD_SET_STREAMING:
|
||||
case GPCMD_SET_READ_AHEAD:
|
||||
/* ZBC */
|
||||
case ZBC_OUT:
|
||||
return (mode & FMODE_WRITE);
|
||||
default:
|
||||
return false;
|
||||
}
|
||||
}
|
||||
EXPORT_SYMBOL(blk_verify_command);
|
||||
EXPORT_SYMBOL(scsi_cmd_allowed);
|
||||
|
||||
static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
|
||||
struct sg_io_hdr *hdr, fmode_t mode)
|
||||
|
|
@ -197,7 +183,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
|
|||
|
||||
if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
|
||||
return -EFAULT;
|
||||
if (blk_verify_command(req->cmd, mode))
|
||||
if (!scsi_cmd_allowed(req->cmd, mode))
|
||||
return -EPERM;
|
||||
|
||||
/*
|
||||
|
|
@ -428,8 +414,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
|
|||
if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
|
||||
goto error;
|
||||
|
||||
err = blk_verify_command(req->cmd, mode);
|
||||
if (err)
|
||||
err = -EPERM;
|
||||
if (!scsi_cmd_allowed(req->cmd, mode))
|
||||
goto error;
|
||||
|
||||
/* default. possible overriden later */
|
||||
|
|
@ -808,10 +794,3 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
|
|||
return err;
|
||||
}
|
||||
EXPORT_SYMBOL(scsi_cmd_ioctl);
|
||||
|
||||
static int __init blk_scsi_ioctl_init(void)
|
||||
{
|
||||
blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
|
||||
return 0;
|
||||
}
|
||||
fs_initcall(blk_scsi_ioctl_init);
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ static int scsi_bsg_fill_hdr(struct request *rq, struct sg_io_v4 *hdr,
|
|||
|
||||
if (copy_from_user(sreq->cmd, uptr64(hdr->request), sreq->cmd_len))
|
||||
return -EFAULT;
|
||||
if (blk_verify_command(sreq->cmd, mode))
|
||||
if (!scsi_cmd_allowed(sreq->cmd, mode))
|
||||
return -EPERM;
|
||||
return 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -238,8 +238,9 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
|
|||
|
||||
if (sfp->parentdp->device->type == TYPE_SCANNER)
|
||||
return 0;
|
||||
|
||||
return blk_verify_command(cmd, filp->f_mode);
|
||||
if (!scsi_cmd_allowed(cmd, filp->f_mode))
|
||||
return -EPERM;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
|
|
|
|||
|
|
@ -1343,7 +1343,7 @@ static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
|
|||
gfp_mask, 0);
|
||||
}
|
||||
|
||||
extern int blk_verify_command(unsigned char *cmd, fmode_t mode);
|
||||
bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode);
|
||||
|
||||
static inline bool bdev_is_partition(struct block_device *bdev)
|
||||
{
|
||||
|
|
|
|||
Loading…
Reference in New Issue