To fix this (if your file system supports file capabilities):

1. Install the libcap2-bin package.
2. As root, enter the following command:
        setcap cap_sys_resource=ep /usr/bin/wodim

Note that this enables wodim to override a variety of resource limits,
which is a risk to system security and stability. You might want to
mitigate that risk by only allowing trusted user accounts to execute it.
For example:

        chgrp users /usr/bin/wodim
        chmod o-x /usr/bin/wodim
        setcap cap_sys_resource=ep /usr/bin/wodim

Note also that all of these changes (permissions and file capabilities)
will be reset next time the wodim package is upgraded or reinstalled.

-----------------------------------------------------------------------

Ideally, the wodim executable should be given the file capability by a
package installation script, and it should drop that privilege early in
its execution, right after making its setrlimit call. This would solve
the problem while greatly mitigating the risks.

Reply via email to