Messages in this thread | | | From | Joerg Schilling <> | Date | Fri, 27 May 2005 12:31:28 +0200 | Subject | Re: [OT] Joerg Schilling flames Linux on his Blog |
| |
"Alexander E. Patrakov" <patrakov@ums.usu.ru> wrote:
> On Thursday 26 May 2005 16:15, Joerg Schilling wrote: > > > The problem was that you could send SCSI commands on R/O fds and fixing the > > problem would have been to forbid sending SCSI commands on R/O fds. > > Unfortunately, this is not going to work. It would work only if the only app > that has to send SCSI commands were cdrecord. Then really, a non-setuid > program just would not be able to get a R/W fd, and setuid ones are assumed > to be trusted.
If these programs did rely on the named security bug, then these programs were broken anyway and need to be fixed. Note that the _old_ (non ioctl based) /dev/sg interface needed write access in order to send SCSI commands.
> The problem is that many CD audio players also send SCSI commands in order to > extract digital audio data. Are you proposing to make them setuid root? use a > well-defined setuid helper? other solution?
If these programs did ever work before, someone did break them meanwhile.
Jörg
-- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |