openzfs/zfs

zfs redact should have a separate delegatable permissions

Open

#10,296 opened on May 6, 2020

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C (1,703 forks)batch import
Type: Featuregood first issue

Repository metrics

Stars
 (9,908 stars)
PR merge metrics
 (Avg merge 5d 21h) (62 merged PRs in 30d)

Description

zfs redact currently uses the secpolicy_config, restricting its use to users who can modify the pool's config. There's no reason to restrict such a command so tightly; it should have a delegatable permission, like most other zfs ioctls.

Contributor guide

Research direction
Investigate the current secpolicy config usage in the ZFS codebase, understand the permission model for ioctls, and identify the location to add a new delegatable permission for zfs redact. Look at how other ioctls have separate permissions.
Tech stack
c
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
CZFS
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50