Messages in this thread | | | From | Joerg Schilling <> | Date | Sat, 21 Aug 2004 17:57:30 +0200 | Subject | Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices |
| |
Pascal Schmidt <der.eremit@email.de> wrote:
> On Sat, 21 Aug 2004 14:50:08 +0200, you wrote in linux.kernel: > > > If the owners and permissions of the filesystem have been set up correctly, > > then there is no security problem. > > The previous Linux implementation allowed users with *read* access > to the device to send arbitrary SG_IO commands. Giving read permission
This is of course a kernel bug - but it could be easily fixed. My scg driver for SunOS requires write permissions since it has been created in August 1986.
> to normal users is quite common, to allow them to run isosize or play > their freshly burned SVCDs with mplayer.
So changing the kernel to require write permissions would be a simple fix that would help without breaking cdrtools as libscg of course opens the devices with O_RDWR.
I am not against a long term change that would require euid root too, but this should be announced early enough to allow prominent users of the interface to keep track of the interface changes.
BTW: the currely used errno EACCESS applies to file permissions while EPERM applies to process permissions. So EPERM would be a more appropriate errno value.
Jörg
-- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) If you don't have iso-8859-1 schilling@fokus.fraunhofer.de (work) chars I am J"org Schilling URL: http://www.fokus.fraunhofer.de/usr/schilling ftp://ftp.berlios.de/pub/schily - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |