lkml.org 
[lkml]   [2004]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: PATCH: cdrecord: avoiding scsi device numbering for ide devices

On Mon, 9 Aug 2004, Joerg Schilling wrote:
> >From: Eric Lammerts <eric@lammerts.org>
>
> >On Fri, 6 Aug 2004, Joerg Schilling wrote:
> >> The CAM interface (which is from the SCSI standards group)
> >> usually is implemeted in a way that applications open /dev/cam and
> >> later supply bus, target and lun in order to get connected
> >> to any device on the system that talks SCSI.
> >>
> >> Let me repeat: If you believe that this is a bad idea, give very
> >> good reasons.
>
> >With this interface, how do you grant non-root users access to a CD
> >writer, but prevent them from directly accessing a SCSI harddisk?
>
> On Linux, it is impossible to run cdrecord without root privilleges.
> Make cdrecord suid root, it has been audited....
>
> On Solaris, there is ACLs, RBAC & getppriv() / setppriv()

Interesting. How do you use those to grant someone access to a
particular CD writer device behind /dev/cam _without_ at the same time
granting them access to other SCSI devices too? I know that it's
possible with a trusted binary (like cdrecord) that's setuid root, or
that gets some priviledges some other way, but if that is the _only_
way, then that's a flaw in the CAM interface.

On Linux you can simply change permissions on the CD writer's device
node to allow non-root users to burn CDs.

Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:05    [W:0.038 / U:3.316 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site