Alasdair G Kergon wrote:
On Sun, Jul 10, 2011 at 10:40:13AM -0700, Linda A. Walsh wrote:I could write to the darn things!, but all I NEED is read (hmmmI thought so too when we first began work on LVM, but - surprising to me - there's been hardly any demand expressed for this feature.The proposed method of handling this was to accept dm ioctls on the actual devices themselves controlled by normal ioctl permissions. Currently, you need CAP_SYS_ADMIN (and access to /dev/mapper/control).
Ishtar:/suse/x86_64> filecap /sbin/lvm file capabilities /sbin/lvm sys_admin Ishtar:/suse/x86_64> llg /dev/mapper/control crw-rw---- 1 root disk 10, 236 Jul 8 16:52 /dev/mapper/control (am in group disk). --- Doesn't work. Still get access failures. (open not permitted) I got slightly further with cap_rawio, (gave more error messages). I'm sure with enough experimenting, I could eventually find the required set, but it seems to be a bit more than 1 cap. Oh well, not that important...just found the caplibs on my system and decided to give them a try...(didn't know the bins were in yet!....only remember discussing their implementation about 11 years back. At least ACL's were faster... (I made the exec +eip on the binary for sys_admin and rawio, and that wasn't sufficient).