| |||||||||||||
The trouble with CAP_SYS_RAWIOThe trouble with CAP_SYS_RAWIOPosted Mar 22, 2013 4:36 UTC (Fri) by kevinm (guest, #69913)Parent article: The trouble with CAP_SYS_RAWIO
It still sounds to me like the simple solution is "remove CAP_SYS_RAWIO from the initial capability set on secure-booted kernels". So you'll lose the ability to perform some iffy SCSI commands - well, you signed up for some bondage and discipline when you asked for a locked-down, secure-booted kernel, didn't you?
(Log in to post comments)
The trouble with CAP_SYS_RAWIO Posted Mar 22, 2013 7:12 UTC (Fri) by dlang (✭ supporter ✭, #313) [Link]
the problem is that these 'iffy' scsi commands end up being things like the ability to burn CDs, not exactly easy things to do without.
Or in enterprise settings, commands to be able to manipulate tape changers
The trouble with CAP_SYS_RAWIO Posted Mar 31, 2013 7:12 UTC (Sun) by Duncan (guest, #6647) [Link]
> the problem is that these 'iffy' scsi commands end up being things like the ability to burn CDs, not exactly easy things to do without.
Actually, that's rather less of a problem now, and trending less so, than it was a few years ago when /the/ major form of removable media was optical, CD/DVD. Now days, the sub-GB size of a CD looks positively diminutive, and even the near-5-GB size of a standard DVD looks small, compared to the ubiquitous USB thumbdrive of say 8+GB. A Bluray's 25 gigs is a bit better priced media-only (US$6 individual, just over $1/ea in 25-packs, pricewatch.com), but while the stick's a bit more expensive (USB flash: 32G=US$15, 16G=$10) as it ships with its own housing and read/write hardware, it's also CONSIDERABLY less fragile and generally more easily handled, AND direct-block-device read-writable (well, as seen by the OS...).
Additionally, with current inet and smartphone penetrations, people that a few years ago might have used dedicated removable media (either USB sticks or CD/DVD) these days more often either use the inet directly (streaming what might have been on CD a few years ago, or pastebinning it to a friend if not attaching it to an email), or if they do play local media, say in the car, it's from a jacked-in phone more often than a CD.
Unfortunately when I upgraded machines last year I didn't think of that, and bought a blu-ray burner for it. I really haven't used it... Fortunately, it's a USB-based one and wasn't /that/ expensive, so it's usable on my netbook as well should I decide to and not taking any power when it's unplugged (see kernel 3.9's new ZPODD, only I've had that in the form of an unplugged USB-based bluray for a few months now), and being USB, as long as I don't mistreat it it should stay usable for years, so I suppose I'll get some use out of it, over time. But I'd have been better off simply not buying it at all.
So it's considerably easier to do without optical burning than it was even just a few years ago, to the point where many people would miss it about as much as they do their 1.44 MB floppy...
|
|||||||||||||