Messages in this thread | | | Date | Mon, 9 Aug 2004 10:36:28 -0400 (EDT) | From | Eric Lammerts <> | Subject | Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices |
| |
On Mon, 9 Aug 2004, Joerg Schilling wrote: > >From: Eric Lammerts <eric@lammerts.org> > > >On Fri, 6 Aug 2004, Joerg Schilling wrote: > >> The CAM interface (which is from the SCSI standards group) > >> usually is implemeted in a way that applications open /dev/cam and > >> later supply bus, target and lun in order to get connected > >> to any device on the system that talks SCSI. > >> > >> Let me repeat: If you believe that this is a bad idea, give very > >> good reasons. > > >With this interface, how do you grant non-root users access to a CD > >writer, but prevent them from directly accessing a SCSI harddisk? > > On Linux, it is impossible to run cdrecord without root privilleges. > Make cdrecord suid root, it has been audited.... > > On Solaris, there is ACLs, RBAC & getppriv() / setppriv()
Interesting. How do you use those to grant someone access to a particular CD writer device behind /dev/cam _without_ at the same time granting them access to other SCSI devices too? I know that it's possible with a trusted binary (like cdrecord) that's setuid root, or that gets some priviledges some other way, but if that is the _only_ way, then that's a flaw in the CAM interface.
On Linux you can simply change permissions on the CD writer's device node to allow non-root users to burn CDs.
Eric - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |