[PATCH 2/2] nvme: fine-granular CAP_SYS_ADMIN for nvme io/admin commands

[Christoph Hellwig]

On Thu, Oct 19, 2023 at 12:00:03AM +0530, Kanchan Joshi wrote:
> Passthrough commands are guarded by heavy-handed CAP_SYS_ADMIN checks
> that neglects the file-mode completely.
> 
> Add a fine-granular policy that considers file-mode and various other
> parameters for any approval/denial. Also enable few admin commands that
> are necssary to get the information required to form the i/o commands.
> The policy is implemented in a new helper 'nvme_cmd_allowed'.
> 
> I/O commands needing data-transfers are sent only via SGL.

This looks mostly good to me, but we should not even send the command
if we know SGLs aren't supported.