From: Richard Weinberger <richard@sigma-star.at>
To: Richard Weinberger <richard@nod.at>,
"linux-nvme@lists.infradead.org" <linux-nvme@lists.infradead.org>,
upstream@sigma-star.at
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"a.hindborg@kernel.org" <a.hindborg@kernel.org>,
"leitao@debian.org" <leitao@debian.org>,
Chaitanya Kulkarni <chaitanyak@nvidia.com>,
"sagi@grimberg.me" <sagi@grimberg.me>, "hch@lst.de" <hch@lst.de>,
"upstream+nvme@sigma-star.at" <upstream+nvme@sigma-star.at>,
Chaitanya Kulkarni <chaitanyak@nvidia.com>
Subject: Re: [PATCH 2/2] nvmet: Restrict in-band config files to root
Date: Tue, 22 Apr 2025 08:36:41 +0200 [thread overview]
Message-ID: <29921235.1r3eYUQgxm@anvil> (raw)
In-Reply-To: <cb7dc726-f12b-4cd7-a121-aebc9c510771@nvidia.com>
On Dienstag, 22. April 2025 08:32 'Chaitanya Kulkarni' via upstream wrote:
> Patch looks good to me, can we do something like this and
> use in the rest of the patch ?
>
> #define NVMET_CFGFS_ATTR_DEF_PERM (S_IRUSR | S_IWUSR)
>
> or
>
> Create a helper on the top of CONFIGFS_ATTR_PERM to wrap
> permission into that for all the CONFIGFS_ATTR_PERM()
Sounds like you want to restrict read access to all nvmet configfs
files? My focus was only on files that contain secrets.
Applying this to all files increases the risk of breaking existing
userspace tooling.
Thanks,
//richard
--
sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr:
ATU 66964118 | FN: 374287y
next prev parent reply other threads:[~2025-04-22 6:36 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-20 10:47 [PATCH 1/2] configfs: Add CONFIGFS_ATTR_PERM helper Richard Weinberger
2025-04-20 10:47 ` [PATCH 2/2] nvmet: Restrict in-band config files to root Richard Weinberger
2025-04-22 6:32 ` Chaitanya Kulkarni
2025-04-22 6:36 ` Richard Weinberger [this message]
2025-04-22 11:53 ` Sagi Grimberg
2025-04-22 6:27 ` [PATCH 1/2] configfs: Add CONFIGFS_ATTR_PERM helper Chaitanya Kulkarni
2025-04-22 11:53 ` Sagi Grimberg
2025-04-25 6:27 ` Andreas Hindborg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=29921235.1r3eYUQgxm@anvil \
--to=richard@sigma-star.at \
--cc=a.hindborg@kernel.org \
--cc=chaitanyak@nvidia.com \
--cc=hch@lst.de \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=richard@nod.at \
--cc=sagi@grimberg.me \
--cc=upstream+nvme@sigma-star.at \
--cc=upstream@sigma-star.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®