Messages in this thread | | | Date | Mon, 23 Aug 2004 21:16:39 +0300 (EEST) | From | Kai Makisara <> | Subject | Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices |
| |
On Sun, 22 Aug 2004, Joerg Schilling wrote:
> Christer Weinigel <christer@weinigel.se> wrote: > ... > > One is to make cdrecord suid root and then make it drop all > > capabilities except for SYS_CAP_RAWIO. But even if cdrecord is > > audited, there are a lot of other applications that need to be able to > > send raw SCSI commands such as mt (to change the compression or tape > > format of a streamer). And this violates goal 2, every security guide > > I've seen lately recommends minimizing the amount of suid binaries, > > not adding more. > > A better way is to have services like this in /usr/bin/pfexec that > do the ecirity related parts before calling the other binaries. > > BTW: 'mt' should not need to send SCSI comands. THis shoul dbe handled via > specilized ioctls. > There are already ioctls for changing the tape parameters. Christer, there is no need to introduce tapes into this discussion.
-- Kai - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |