[EMAIL PROTECTED] wrote:
> > > I am looking since quite a while for the particular
> > > and substantial security problems which one is said
> > > to have if one allows w-access to a CD/DVD writer.
> > Matthias Andree wrote:
> > As far as I understand Jörg, vendor-specific commands are often involved
> > in CD writing, and if they are filtered out, CD writing may not work
> > with certain devices -- this is the central point of his criticism.
>
> I understand this puts my 60 Euro burner at risk
> if i allow w-access. (It is also at risk if i allow
> physical access with a few drops of Loctite.)
THe bug in the linux kernel was to allow _any_ commands even if only
_read_ access was present.
Instead of fixing this, Linus did change the interface in an incompatible way.
> The setuid privileges demand w-rights ?
NO, with a suid-root installation you can make cdrecord and Linux
more secure than by chmod +w /dev/*
Jörg
--
EMail:[EMAIL PROTECTED] (home) Jörg Schilling D-13353 Berlin
[EMAIL PROTECTED] (uni)
[EMAIL PROTECTED] (work) Blog: http://schily.blogspot.com/
URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
