Bug#330506: cdrecord: root vs. suid vs. cdrom group ... Contradiction (?)

2005-12-21 Thread Joerg Schilling

Your problem may be a result of the patches applied by Debian..

 90% of all bug reports against cdrtools on Linux are caused by the
unneded abd broken patches applied by various Linux distributions.

A recent k3b and a recent unmodified cdrtools (where cdrecord is installed suid 
root)
should fix your problems. This is the feedback I have from the kb3 authors.


BTW: once Linux distributions develop a usable RBAC framework similar to what
Solaris offers, cdrecord will work without the need for being root.

On Solaris, an entry:

CD RW:solaris:cmd:::/usr/bin/cdrecord: 
privs=file_dac_read,sys_devices,proc_lock_memory,proc_priocntl,net_privaddr 

in /etc/security/exec_attr

and an entry

joeprofiles=CD RW

allows user 'joe' to seamlessly use cdrecord from any profile aware shell
without the need for being root.

Linux already includes fine grained process privilege rights but it seems that
an integrated framework similar to what's available on Solaris is still missing.

Jörg

-- 
 EMail:[EMAIL PROTECTED] (home) Jörg Schilling D-13353 Berlin
   [EMAIL PROTECTED](uni)  
   [EMAIL PROTECTED](work) Blog: http://schily.blogspot.com/
 URL:  http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily



Bug#330506: cdrecord: root vs. suid vs. cdrom group ... Contradiction (?)

2005-09-28 Thread Gilles
Package: cdrecord
Version: 4:2.01+01a03-2
Severity: important

Hi.

Each time I upgrade the system (and cdrecord is updated), I get into
problems writing CDs.  I use cdrecord through k3b; I've just tried
to blank a CD-RW and got the following error message (k3b log):

---BEGIN LOG---
System
---
K3b Version: 0.12

KDE Version: 3.4.2
QT Version:  3.3.5
Kernel:  2.6.13.2-vs2.0.1-pre2+g2
Devices
---
PLEXTOR CD-R   PX-W1210A 1.07 (/dev/hdc, ) at /media/cdrom0 [CD-R; CD-RW; 
CD-ROM] [Error] [SAO; TAO; RAW; SAO/R96P; SAO/R96R; RAW/R16; RAW/R96P; RAW/R96R]

Used versions
---
cdrecord: 2.1.1a03

cdrecord command:
---
/usr/bin/cdrecord.mmap -v gracetime=2 dev=/dev/hdc speed=1 -tao 
driveropts=burnfree -eject blank=fast -force 

cdrecord
---
/usr/bin/cdrecord: Warning: Running on Linux-2.6.13.2-vs2.0.1-pre2+g2

/usr/bin/cdrecord: There are unsettled issues with Linux-2.5 and newer.
/usr/bin/cdrecord: If you have unexpected problems, please try Linux-2.4 or 
Solaris.
/usr/bin/cdrecord: Operation not permitted. WARNING: Cannot set RR-scheduler
/usr/bin/cdrecord: Permission denied. WARNING: Cannot set priority using 
setpriority().
/usr/bin/cdrecord: WARNING: This causes a high risk for buffer underruns.
scsidev: '/dev/hdc'
devname: '/dev/hdc'
scsibus: -2 target: -2 lun: -2
Warning: Open by 'devname' is unintentional and not supported.
Linux sg driver version: 3.5.27
Error: Cannot gain SYS_RAWIO capability.Is cdrecord installed SUID root?
: Operation not permitted
/usr/bin/cdrecord: Warning: using inofficial version of libscg 
(ubuntu-0.8ubuntu1 '@(#)scsitransp.c 1.91 04/06/17 Copyright 
1988,1995,2000-2004 J. Schilling').
SCSI buffer size: 64512
/usr/bin/cdrecord: Operation not permitted. Cannot send SCSI cmd via ioctl
Cdrecord-Clone 2.01.01a03 (x86_64-unknown-linux-gnu) Copyright (C) 1995-2005 
Joerg Schilling
NOTE: this version of cdrecord is an inofficial (modified) release of cdrecord
  and thus may have bugs that are not present in the original version.
  Please send bug reports and support requests to [EMAIL PROTECTED].
  The original author should not be bothered with problems of this version.
TOC Type: 1 = CD-ROM
Using libscg version 'ubuntu-0.8ubuntu1'.
Driveropts: 'burnfree'
atapi: 1
Device type: Removable CD-ROM
Version: 0
Response Format: 1
Vendor_info: 'PLEXTOR '
Identifikation : 'CD-R   PX-W1210A'
Revision   : '1.07'
Device seems to be: Generic mmc CD-RW.
---END LOG---


From the above, cdrecord seems to complain that it is not suid-root.
[Or is the problem somewhere else?]

So I used 'dpkg-reconfigure cdrecord' to make it suid.  I restarted k3b
which itself then complained that cdrecord *is* suid root (stressing
that newer kernels won't accept to run it for security reasons).

Does that mean that cdrecord and hence k3b can only be run as root?

From explanations given by dpkg-reconfigure as well as by k3b, it
would seem that belonging to the cdrom group should be enough to be
able to burn CDs!

So, what is exactly the recommended setting?


Best regards,
Gilles


-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'stable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.13.2-vs2.0.1-pre2+g2
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages cdrecord depends on:
ii  debconf   1.4.58 Debian configuration management sy
ii  libc6 2.3.5-6GNU C Library: Shared libraries an
ii  libcap1   1:1.10-14  support for getting/setting POSIX.
ii  makedev   2.3.1-78   creates device files in /dev

Versions of packages cdrecord recommends:
ii  mkisofs   4:2.01+01a03-2 Creates ISO-9660 CD-ROM filesystem

-- debconf information:
* cdrecord/SUID_bit: false
  cdrecord/MAKEDEVNEW: true
  cdrecord/do_it_yourself:


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]