Re: ide-cd problems

[Jens Axboe <axboe@suse.de>]

On Sun, Aug 01 2004, Alexander E. Patrakov wrote:
> Zinx Verituse wrote:
> >I don't believe command filtering is neccessary, since all of the
> >ide-cd ioctls are still there (ioctls that allow playing, reading, etc)
> >Only the SG_IO ioctl itself would have to be checked (i.e., not each
> >individual command available with SG_IO, just the overall ioctl itself,
> >categorizing all of SG_IO more or less as raw IO.  If this isn't doable
> >with the current design, then the ide-cd interface should at least be
> >very conspicuously documented as being extremely insecure as far as
> >"read" access is concerned, as I know I wouldn't expect users to be able
> >to overwrite my drive's firmware simply by granting the read access.
> >
> 
> Remember that it is still possible to write CDs through ide-cd in 2.4.x 
> using some pre-alpha code in cdrecord:
> 
> cdrecord dev=ATAPI:1,1,0 image.iso

(don't trim cc lists on linux-kernel!)

Don't ever use that interface, period. It's not just the cdrecord code
that may be alpha (I doubt it matters, it's easy to use), the interface
it uses is not worth the lines of code it occupies.

-- 
Jens Axboe