lkml.org 
[lkml]   [2004]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: 2.6.8.1 Mis-detect CRDW as CDROM
Date
Frank Steiner wrote:

> So what's the target in this process? Should users finally be able to
> write cds again without or only with suid bit set? It would be good to
> know if I should try to set all cd writing applications suid or just
> have to wait for some patches coming up that would allow users to
> write cds without suid again...

I have now reviewed my changes to allow users-cdrecording using
the mmc4-spec
http://www.t10.org/ftp/t10/drafts/mmc4/mmc4r03a.pdf
Someone should check, if i set the permissions the right way. I have not used
the infomation Marc Ballarin, as i think the spec is more recent than the
programms. Perhaps there have some commands for old recorders to be added,
but i'm not sure if so much people use such old recorders.
My changes also include some things for reading and playing cds. The rest of
the commands mentioned in the mmc4-spec is already defined in the basic
commands.

>
> If the programs must be set suid, is that safe? In the past I was
> always told that setting e.g. cdrecord suid was a possible security issue.
> But I really don't understand enough of the new security model in the
> kernel to judge if that's right or wrong...

I don't think setting an application suid is the right way. If the rules are
changed the right way, rights for accessing devices may be set up clearer -
eg one usergroup may use the recorder for recording and another not. If
setting cdrecord siud root, this won't work.

>
> Can someone enlighten me? :-)
>
> cu,
> Frank

Here are my suggested changes:

-- linux-2.6.8.1/drivers/block/scsi_ioctl.c 2004-08-16 21:44:53.000000000
+0200
+++ linux/drivers/block/scsi_ioctl.c 2004-08-17 13:04:04.000000000 +0200
@@ -156,6 +156,53 @@
safe_for_write(WRITE_16),
safe_for_write(WRITE_BUFFER),
safe_for_write(WRITE_LONG),
+
+
+ /* Some additional defs for recording/reading CDs */
+
+ /* 0x01 REZERO_UNIT used by k3b, but also work without */
+
+ /* read-mode */
+ safe_for_read(GPCMD_GET_CONFIGURATION),
+ safe_for_read(GPCMD_GET_EVENT_STATUS_NOTIFICATION),
+ safe_for_read(GPCMD_GET_PERFORMANCE),
+ safe_for_read(GPCMD_MECHANISM_STATUS),
+
+ /* should this allowed for read ? */
+ safe_for_read(GPCMD_LOAD_UNLOAD),
+ safe_for_read(GPCMD_SET_SPEED),
+ safe_for_read(GPCMD_PAUSE_RESUME), /* playing audio cd */
+ safe_for_read(SEEK_10), /* playing audio cd */
+ safe_for_read(GPCMD_SET_READ_AHEAD),
+ safe_for_read(GPCMD_SET_STREAMING),
+ safe_for_read(GPCMD_STOP_PLAY_SCAN), /* playing audio cd */
+
+ /* k3b wont work without read - maybe bug in k3b, but
+ MODE_SELECT_10 seems not to be destructive */
+ safe_for_read(GPCMD_MODE_SELECT_10),
+
+ /* write-mode */
+ safe_for_write(GPCMD_BLANK),
+ safe_for_write(GPCMD_CLOSE_TRACK),
+ safe_for_write(0x2c), /* ERASE_10 */
+ safe_for_write(GPCMD_FORMAT_UNIT),
+ safe_for_write(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL),
+ safe_for_write(0x5c), /* READ_BUFFER_CAPACITY */
+ safe_for_write(GPCMD_READ_FORMAT_CAPACITIES),
+ safe_for_write(GPCMD_REPAIR_RZONE_TRACK),
+ safe_for_write(GPCMD_RESERVE_RZONE_TRACK),
+ safe_for_write(0x5d), /* SEND_CUE_SHEET */
+ safe_for_write(0xbf), /* SEND_DVD_STRUCTURE */
+ safe_for_write(GPCMD_SEND_KEY),
+ safe_for_write(GPCMD_SEND_OPC),
+ safe_for_write(SYNCHRONIZE_CACHE),
+ safe_for_write(VERIFY),
+
+ /* Disabled, may change firmware
+ safe_for_write(0x3b), WRITE_BUFFER */
+ /* Disabled due useless without WRITE_BUFFER
+ safe_for_write(0x3c), READ_BUFFER */
+
};
unsigned char type = cmd_type[cmd[0]];

@@ -173,6 +220,14 @@
if (capable(CAP_SYS_RAWIO))
return 0;

+ /* Added for debugging*/
+
+ if(file->f_mode & FMODE_WRITE)
+ printk(KERN_WARNING "SCSI-CMD Filter: 0x%x not allowed with
write-mode\n",cmd[0]);
+ else
+ printk(KERN_WARNING "SCSI-CMD Filter: 0x%x not allowed with
read-mode\n",cmd[0]);
+
+
/* Otherwise fail it with an "Operation not permitted" */
return -EPERM;
}

regards
Andreas
--
gnuPG keyid: 0xE94F63B7 fingerprint: D189 D5E3 FF4B 7E24 E49D 7638 07C5 924C
E94F 63B7
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:05    [W:0.084 / U:1.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site