lkml.org 
[lkml]   [2006]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: CD writing in future Linux (stirring up a hornets' nest) (was: Rationale for RLIMIT_MEMLOCK?)
    Matthias Andree <matthias.andree@gmx.de> wrote:

    > S2 Jörg is concerned about the SCSI command filter being too
    > restrictive. I'm not sure if it still applies to 2.6.16-rc and what the
    > exact commands in question were. I'll let Jörg complete this list.

    I am tired today and I need to do other work, so let me parly reply:

    Iff there is a user space infrastructure for fine grained privileges,
    there is absolutely no problem with a planned and well known restriction.

    On Solaris, you (currently) use a profile enabled shell (pfsh, pfksh or pfcsh)
    that calls getexecuser() in order to find whether there is a specific treatment
    needed. If this specific treatment is needed, then the shell calls
    execve(/usr/bin/pfexec cmd <args>)
    else it calls execve(cmd <args>)

    I did recently voted to require all shells to be profile enabled by default.

    With the future plans for extending fine grained privs on Solaris, sending
    SCSI commands will become more than one priv.

    I proposed to have a low priv right to send commands like inquiry and test unit
    ready. These commands may e.g. be send without interfering a concurrent CD/DVD
    write operation.

    The next priv could be the permission for sending simple SCSI commands that
    allow reading from the device.

    The next priv could be the permission for sending simple SCSI Commands that
    allow writing.

    The final priv would allow even vendor specific commands: this is what cdrecord
    needs.

    Jörg

    --
    EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin
    js@cs.tu-berlin.de (uni)
    schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/
    URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-01-23 23:07    [W:0.028 / U:32.040 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site