Virtual Storage Linux Storage Access Control

This topic applies only to Linux platforms.

In DriveOS Linux, all components should be enforced with minimal access privileges on the target. This section describes access privileges from the virtual storage device’s perspective. Refer to the Linux security topics for the configuration details of Linux security access control.

The storage-related access controls are in the following directory:

${NV_WORKSPACE}/ubuntu-filesystem/security_configs/linux/vscd

${NV_WORKSPACE}/ubuntu-filesystem/security_configs/linux/vscd#> ls
file_ownership.yaml
kmd_ownership.yaml
library_dependencies.yaml
process_information.yaml

To accommodate access privileges, each virtual storage device instance is made part of its unique group. The vblk partition of the type vblkdevXX (where XX represents the corresponding device instance number) will be part of the group vblkXX. For example, the virtual device “/dev/vblkdev80” will be part of the group “vblk80”. The partitions of type vblkdevXXpYY (where XX represents the device instance number and YY represents the partition id) is also configured to be part of the group vblkXX. For example, the virtual partition “/dev/vblkdev80p1” will also be part of the group vblk80. To add separate access privileges for the partitions of type vblkdevXXpYY, reconfigure the corresponding partition with their group. The sysfs paths of the corresponding virtual devices – “/sys/devices/platform/tegra_virt_storage[0-9]*/block/vblkdevXX” will be part of the group vblkXX_sys (where XX represents the corresponding device instance number).

The virtual device “/dev/vblkdev[0-9]*.ctl” belongs to the group vblk-ctl and its sysfs directory “/sys/devices/platform/tegra_virt_storage[0-9]*/block/vblkdev[0-9]*.ctl” belongs to the group vblk_sys_ctl.

The virtual device “/dev/vblkdev[0-9]*.ffu” belongs to the group vblk-ffu and its sysfs directory “/sys/devices/platform/tegra_virt_storage[0-9]*/block/vblkdev[0-9]*.ctl” belongs to the group vblk_sys_ffu.

Note

The [0-9]* is a regex that expresses that ctl and ffu node can be any number.

The mnandlib is part of the groups mnand-lib-public and mnand-lib-private. Additionally, the manadlib depends on “/dev/vblkdev[0-9]*.ctl” and “/dev/vblkdev[0-9]*.ffu”. The application that accesses the mnandlib should be part of the ffu/ctl groups (both devnode and sysfs groups) described in the previous section. Addition of the application to the ffu and/or ctl group is based on the use cases (for example, whether to get the storage device health info or update the storage device firmware).

Three mtd devices are added to access control. The device “/dev/mtd0” becomes part of the group mtd0. The device “/dev/mtdblock0” becomes part of the device mtdblock0. Similarly, the device “/dev/mtd0ro” becomes part of the group mtd0ro.