On Iau, 2004-08-05 at 06:40, Jens Axboe wrote:
> Ok, that is definitely more acceptable. But then it should be done to
> CDROM_SEND_PACKET as well, and we risk breaking programs doing so (ie
> cdrecord run by user currently).

Definitely. Irrespective of any questions like filtering commands having
/dev device access allow you to compromise the entire system is not a
good model. CAP_SYS_RAWIO is the capability for "can do anything" so
seems appropriate here.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/