Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

2.6.8 and CD recording

Posted Aug 19, 2004 6:58 UTC (Thu) by evgeny (guest, #774)
Parent article: 2.6.8 and CD recording

Hmm.

the problem can be worked around by running the recording program from a root shell (setuid is not sufficient)

and then

Jörg Schilling got it right when he suggested that the most secure mode of operation is to simply restrict device access and run the CD recording application in a setuid mode.

So does setuid help or it doesn't?

(Log in to post comments)

Posted Aug 19, 2004 8:15 UTC (Thu) by dvrabel (subscriber, #9500) [Link]

cdrecord only uses root priviledges for setting real-time scheduling and locking memory. It drops them after that so it does the burning as a regular user.

2.6.8 and CD recording

Posted Aug 24, 2004 11:39 UTC (Tue) by mwilck (guest, #1966) [Link]

What about the special commands ("send OPC", "blank", etc.) mentioned in the text? According to the article, these should fail if they are executed with user priviliges.

2.6.8 and CD recording

Posted Aug 24, 2004 11:37 UTC (Tue) by mwilck (guest, #1966) [Link]

I can't imagine why a root shell should be necessary. Perhaps the burner executable needs to make a setuid() call to set the real uid to the effective uid.