Skip to content

L
linux
Commit 7353dc06 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Martin K. Petersen
Browse files
Options

scsi: scsi_ioctl: Simplify SCSI passthrough permission checking 

Remove the separate command filter structure and just use a switch
statement (which also cought two duplicate commands), return a bool and
give the function a sensible name.

Link: https://lore.kernel.org/r/20210724072033.1284840-18-hch@lst.deSigned-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent b69367df
Hide whitespace changes
Inline Side-by-side
Showing with 104 additions and 124 deletions
block/scsi_ioctl.c
View file @ 7353dc06
......@@ -22,13 +22,6 @@
#include <scsi/scsi_cmnd.h>
#include <scsi/sg.h>
struct blk_cmd_filter {
unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
};
static struct blk_cmd_filter blk_default_cmd_filter;
static int sg_get_version(int __user *p)
{
static const int sg_version_num = 30527;
......@@ -80,115 +73,108 @@ static int sg_emulated_host(struct request_queue *q, int __user *p)
return put_user(1, p);
}
static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
{
/* Basic read-only commands */
__set_bit(TEST_UNIT_READY, filter->read_ok);
__set_bit(REQUEST_SENSE, filter->read_ok);
__set_bit(READ_6, filter->read_ok);
__set_bit(READ_10, filter->read_ok);
__set_bit(READ_12, filter->read_ok);
__set_bit(READ_16, filter->read_ok);
__set_bit(READ_BUFFER, filter->read_ok);
__set_bit(READ_DEFECT_DATA, filter->read_ok);
__set_bit(READ_CAPACITY, filter->read_ok);
__set_bit(READ_LONG, filter->read_ok);
__set_bit(INQUIRY, filter->read_ok);
__set_bit(MODE_SENSE, filter->read_ok);
__set_bit(MODE_SENSE_10, filter->read_ok);
__set_bit(LOG_SENSE, filter->read_ok);
__set_bit(START_STOP, filter->read_ok);
__set_bit(GPCMD_VERIFY_10, filter->read_ok);
__set_bit(VERIFY_16, filter->read_ok);
__set_bit(REPORT_LUNS, filter->read_ok);
__set_bit(SERVICE_ACTION_IN_16, filter->read_ok);
__set_bit(RECEIVE_DIAGNOSTIC, filter->read_ok);
__set_bit(MAINTENANCE_IN, filter->read_ok);
__set_bit(GPCMD_READ_BUFFER_CAPACITY, filter->read_ok);
/* Audio CD commands */
__set_bit(GPCMD_PLAY_CD, filter->read_ok);
__set_bit(GPCMD_PLAY_AUDIO_10, filter->read_ok);
__set_bit(GPCMD_PLAY_AUDIO_MSF, filter->read_ok);
__set_bit(GPCMD_PLAY_AUDIO_TI, filter->read_ok);
__set_bit(GPCMD_PAUSE_RESUME, filter->read_ok);
/* CD/DVD data reading */
__set_bit(GPCMD_READ_CD, filter->read_ok);
__set_bit(GPCMD_READ_CD_MSF, filter->read_ok);
__set_bit(GPCMD_READ_DISC_INFO, filter->read_ok);
__set_bit(GPCMD_READ_CDVD_CAPACITY, filter->read_ok);
__set_bit(GPCMD_READ_DVD_STRUCTURE, filter->read_ok);
__set_bit(GPCMD_READ_HEADER, filter->read_ok);
__set_bit(GPCMD_READ_TRACK_RZONE_INFO, filter->read_ok);
__set_bit(GPCMD_READ_SUBCHANNEL, filter->read_ok);
__set_bit(GPCMD_READ_TOC_PMA_ATIP, filter->read_ok);
__set_bit(GPCMD_REPORT_KEY, filter->read_ok);
__set_bit(GPCMD_SCAN, filter->read_ok);
__set_bit(GPCMD_GET_CONFIGURATION, filter->read_ok);
__set_bit(GPCMD_READ_FORMAT_CAPACITIES, filter->read_ok);
__set_bit(GPCMD_GET_EVENT_STATUS_NOTIFICATION, filter->read_ok);
__set_bit(GPCMD_GET_PERFORMANCE, filter->read_ok);
__set_bit(GPCMD_SEEK, filter->read_ok);
__set_bit(GPCMD_STOP_PLAY_SCAN, filter->read_ok);
/* Basic writing commands */
__set_bit(WRITE_6, filter->write_ok);
__set_bit(WRITE_10, filter->write_ok);
__set_bit(WRITE_VERIFY, filter->write_ok);
__set_bit(WRITE_12, filter->write_ok);
__set_bit(WRITE_VERIFY_12, filter->write_ok);
__set_bit(WRITE_16, filter->write_ok);
__set_bit(WRITE_LONG, filter->write_ok);
__set_bit(WRITE_LONG_2, filter->write_ok);
__set_bit(WRITE_SAME, filter->write_ok);
__set_bit(WRITE_SAME_16, filter->write_ok);
__set_bit(WRITE_SAME_32, filter->write_ok);
__set_bit(ERASE, filter->write_ok);
__set_bit(GPCMD_MODE_SELECT_10, filter->write_ok);
__set_bit(MODE_SELECT, filter->write_ok);
__set_bit(LOG_SELECT, filter->write_ok);
__set_bit(GPCMD_BLANK, filter->write_ok);
__set_bit(GPCMD_CLOSE_TRACK, filter->write_ok);
__set_bit(GPCMD_FLUSH_CACHE, filter->write_ok);
__set_bit(GPCMD_FORMAT_UNIT, filter->write_ok);
__set_bit(GPCMD_REPAIR_RZONE_TRACK, filter->write_ok);
__set_bit(GPCMD_RESERVE_RZONE_TRACK, filter->write_ok);
__set_bit(GPCMD_SEND_DVD_STRUCTURE, filter->write_ok);
__set_bit(GPCMD_SEND_EVENT, filter->write_ok);
__set_bit(GPCMD_SEND_KEY, filter->write_ok);
__set_bit(GPCMD_SEND_OPC, filter->write_ok);
__set_bit(GPCMD_SEND_CUE_SHEET, filter->write_ok);
__set_bit(GPCMD_SET_SPEED, filter->write_ok);
__set_bit(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL, filter->write_ok);
__set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok);
__set_bit(GPCMD_SET_STREAMING, filter->write_ok);
__set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);
/* ZBC Commands */
__set_bit(ZBC_OUT, filter->write_ok);
__set_bit(ZBC_IN, filter->read_ok);
}
int blk_verify_command(unsigned char *cmd, fmode_t mode)
/*
* Check if the given command is allowed.
*
* For unprivileged users only a small set of whitelisted command is allowed so
* that they can't format the drive or update the firmware.
*/
bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode)
{
struct blk_cmd_filter *filter = &blk_default_cmd_filter;
/* root can do any command. */
if (capable(CAP_SYS_RAWIO))
return 0;
return true;
/* Anybody who can open the device can do a read-safe command */
if (test_bit(cmd[0], filter->read_ok))
return 0;
/* Write-safe commands require a writable open */
if (test_bit(cmd[0], filter->write_ok) && (mode & FMODE_WRITE))
return 0;
return -EPERM;
switch (cmd[0]) {
/* Basic read-only commands */
case TEST_UNIT_READY:
case REQUEST_SENSE:
case READ_6:
case READ_10:
case READ_12:
case READ_16:
case READ_BUFFER:
case READ_DEFECT_DATA:
case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */
case READ_LONG:
case INQUIRY:
case MODE_SENSE:
case MODE_SENSE_10:
case LOG_SENSE:
case START_STOP:
case GPCMD_VERIFY_10:
case VERIFY_16:
case REPORT_LUNS:
case SERVICE_ACTION_IN_16:
case RECEIVE_DIAGNOSTIC:
case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */
case GPCMD_READ_BUFFER_CAPACITY:
/* Audio CD commands */
case GPCMD_PLAY_CD:
case GPCMD_PLAY_AUDIO_10:
case GPCMD_PLAY_AUDIO_MSF:
case GPCMD_PLAY_AUDIO_TI:
case GPCMD_PAUSE_RESUME:
/* CD/DVD data reading */
case GPCMD_READ_CD:
case GPCMD_READ_CD_MSF:
case GPCMD_READ_DISC_INFO:
case GPCMD_READ_DVD_STRUCTURE:
case GPCMD_READ_HEADER:
case GPCMD_READ_TRACK_RZONE_INFO:
case GPCMD_READ_SUBCHANNEL:
case GPCMD_READ_TOC_PMA_ATIP:
case GPCMD_REPORT_KEY:
case GPCMD_SCAN:
case GPCMD_GET_CONFIGURATION:
case GPCMD_READ_FORMAT_CAPACITIES:
case GPCMD_GET_EVENT_STATUS_NOTIFICATION:
case GPCMD_GET_PERFORMANCE:
case GPCMD_SEEK:
case GPCMD_STOP_PLAY_SCAN:
/* ZBC */
case ZBC_IN:
return true;
/* Basic writing commands */
case WRITE_6:
case WRITE_10:
case WRITE_VERIFY:
case WRITE_12:
case WRITE_VERIFY_12:
case WRITE_16:
case WRITE_LONG:
case WRITE_LONG_2:
case WRITE_SAME:
case WRITE_SAME_16:
case WRITE_SAME_32:
case ERASE:
case GPCMD_MODE_SELECT_10:
case MODE_SELECT:
case LOG_SELECT:
case GPCMD_BLANK:
case GPCMD_CLOSE_TRACK:
case GPCMD_FLUSH_CACHE:
case GPCMD_FORMAT_UNIT:
case GPCMD_REPAIR_RZONE_TRACK:
case GPCMD_RESERVE_RZONE_TRACK:
case GPCMD_SEND_DVD_STRUCTURE:
case GPCMD_SEND_EVENT:
case GPCMD_SEND_OPC:
case GPCMD_SEND_CUE_SHEET:
case GPCMD_SET_SPEED:
case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
case GPCMD_LOAD_UNLOAD:
case GPCMD_SET_STREAMING:
case GPCMD_SET_READ_AHEAD:
/* ZBC */
case ZBC_OUT:
return (mode & FMODE_WRITE);
default:
return false;
}
}
EXPORT_SYMBOL(blk_verify_command);
EXPORT_SYMBOL(scsi_cmd_allowed);
static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
struct sg_io_hdr *hdr, fmode_t mode)
......@@ -197,7 +183,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
return -EFAULT;
if (blk_verify_command(req->cmd, mode))
if (!scsi_cmd_allowed(req->cmd, mode))
return -EPERM;
/*
......@@ -428,8 +414,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
goto error;
err = blk_verify_command(req->cmd, mode);
if (err)
err = -EPERM;
if (!scsi_cmd_allowed(req->cmd, mode))
goto error;
/* default. possible overriden later */
......@@ -808,10 +794,3 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
return err;
}
EXPORT_SYMBOL(scsi_cmd_ioctl);
static int __init blk_scsi_ioctl_init(void)
{
blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
return 0;
}
fs_initcall(blk_scsi_ioctl_init);
drivers/scsi/scsi_bsg.c
View file @ 7353dc06
......@@ -36,7 +36,7 @@ static int scsi_bsg_fill_hdr(struct request *rq, struct sg_io_v4 *hdr,
if (copy_from_user(sreq->cmd, uptr64(hdr->request), sreq->cmd_len))
return -EFAULT;
if (blk_verify_command(sreq->cmd, mode))
if (!scsi_cmd_allowed(sreq->cmd, mode))
return -EPERM;
return 0;
}
......
drivers/scsi/sg.c
View file @ 7353dc06
......@@ -238,8 +238,9 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
if (sfp->parentdp->device->type == TYPE_SCANNER)
return 0;
return blk_verify_command(cmd, filp->f_mode);
if (!scsi_cmd_allowed(cmd, filp->f_mode))
return -EPERM;
return 0;
}
static int
......
include/linux/blkdev.h
View file @ 7353dc06
......@@ -1343,7 +1343,7 @@ static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
gfp_mask, 0);
}
extern int blk_verify_command(unsigned char *cmd, fmode_t mode);
bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode);
static inline bool bdev_is_partition(struct block_device *bdev)
{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7