lkml.org 
[lkml]   [2004]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: PATCH: cdrecord: avoiding scsi device numbering for ide devices
    On Sun, 22 Aug 2004, Joerg Schilling wrote:

    > Christer Weinigel <christer@weinigel.se> wrote:
    >
    ...
    > > One is to make cdrecord suid root and then make it drop all
    > > capabilities except for SYS_CAP_RAWIO. But even if cdrecord is
    > > audited, there are a lot of other applications that need to be able to
    > > send raw SCSI commands such as mt (to change the compression or tape
    > > format of a streamer). And this violates goal 2, every security guide
    > > I've seen lately recommends minimizing the amount of suid binaries,
    > > not adding more.
    >
    > A better way is to have services like this in /usr/bin/pfexec that
    > do the ecirity related parts before calling the other binaries.
    >
    > BTW: 'mt' should not need to send SCSI comands. THis shoul dbe handled via
    > specilized ioctls.
    >
    There are already ioctls for changing the tape parameters. Christer, there
    is no need to introduce tapes into this discussion.

    --
    Kai
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:05    [W:0.019 / U:30.908 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site