openzfs/zfs

zfs redact should have a separate delegatable permissions

Open

#10,296 创建于 2020年5月6日

在 GitHub 查看
 (0 评论) (0 反应) (0 负责人)C (9,908 star) (1,703 fork)batch import
Type: Featuregood first issue

描述

zfs redact currently uses the secpolicy_config, restricting its use to users who can modify the pool's config. There's no reason to restrict such a command so tightly; it should have a delegatable permission, like most other zfs ioctls.

贡献者指南

技术栈
c
领域
authenticationauthorization
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
4
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
over 1 week
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
Understanding of ZFS permission modelC programming experienceFamiliarity with ZFS ioctl interface
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
15
研究方向
Examine how other ZFS ioctls define their own delegatable permissions, for example by searching for 'zfs secpolicy' or 'zfs deleg' in the codebase. Look at existing permissions like 'ZFS DELEG PERM DESTROY' or 'ZFS DELEG PERM SNAPSHOT' to understand the pattern. Then implement a new permission for 'zfs redact' following the same structure, modifying the relevant policy check in the redact ioctl handler.
zfs redact should have a separate delegatable permissions · openzfs/zfs#10296 | Good First Issue