Public SourceMage Discussion List

[Arwed von Merkatz <v.merkatz AT gmx.net>]

On Sat, Oct 30, 2004 at 05:22:16PM +0200, Flavien Bridault wrote:
> Hi everyone,
> 
> I wish to discuss with you about the cd recording. I just filled a bug to 
> allow non-root users to use cdrecord with kernel >= 2.6.8.1
> 
> http://bugs.sourcemage.org/show_bug.cgi?id=7590
> 
> Here is the summary :
> "After upgrading to 2.6.9 kernel, users are not able to burn cds with 
> cdrecord 
> even with suid-bit set. So there are two options : burn only as root, or 
> allow cdrecord to burn with normal users. In the second case, there are 
> also 
> two options : patch the kernel or patch cdrecord.
> I found a patch for cdrecord here :
> http://kerneltrap.org/node/view/4022
> This patch didn't work with current cdrecord version in the (test) 
> grimoire, 
> so I build an another. I changed CONFIGURE in order to apply this patch if 
> the user select the option "Allow any user to write with cdrecord?". As 
> this 
> option only set the suid-bit, it is currently useless. But with the patch 
> applied, users can really use cdrecord.
> However, I wondered if it will no be safer to set the suid-bit and only 
> allow 
> execution for a dedicated group (-rws--x--- root burning), as k3bsetup do. 
> So 
> the spell would also add the group and add the user in that group if it is 
> not already the case (I can do this if you want). What do you think about 
> that ?"
> 
> All opinions are welcome. :-)
> I'm not very aware about security issues, so tell if you think burning as 
> non-root user is too risky, if allowing a group to burn is safer than 
> allowing all users, etc...

My setup of cdrecord works without the suid bit and allows all users in
the burning group to burn cds, not sure if that's also affected by that
problem with kernel 2.6.9.
The only thing i did was setting the cd recorder device to be writable
by group burning:
brw-rw-r--  1 root burning 22, 0 Oct 30 14:07 /dev/hdc

With this cdrecord without suid bit happily writes cds as user.

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org