Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

Quoting Flavien Bridault <flavien.bridault AT free.fr>:
> Hi everyone,
>
> I wish to discuss with you about the cd recording. I just filled a bug to
> allow non-root users to use cdrecord with kernel >= 2.6.8.1
>
> http://bugs.sourcemage.org/show_bug.cgi?id=7590
>
> Here is the summary :
> "After upgrading to 2.6.9 kernel, users are not able to burn cds with
> cdrecord
> even with suid-bit set. So there are two options : burn only as root, or
> allow cdrecord to burn with normal users. In the second case, there are also
> two options : patch the kernel or patch cdrecord.
> I found a patch for cdrecord here :
> http://kerneltrap.org/node/view/4022
> This patch didn't work with current cdrecord version in the (test) grimoire,
> so I build an another. I changed CONFIGURE in order to apply this patch if
> the user select the option "Allow any user to write with cdrecord?". As this
> option only set the suid-bit, it is currently useless. But with the patch
> applied, users can really use cdrecord.
> However, I wondered if it will no be safer to set the suid-bit and only 
> allow
> execution for a dedicated group (-rws--x--- root burning), as k3bsetup do. 
> So
> the spell would also add the group and add the user in that group if it is
> not already the case (I can do this if you want). What do you think about
> that ?"
>
> All opinions are welcome. :-)
> I'm not very aware about security issues, so tell if you think burning as
> non-root user is too risky, if allowing a group to burn is safer than
> allowing all users, etc...
>
> Salut !

I'd rather have cdrecord use a burning group for permissions rather than 
letting
anyone with an account on my machines to burn. :)

-sandalle

--
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.