Re: 2.6.5-rc1-aa1

[Bill Davidsen <davidsen@tmr.com>]

Diego Calleja García wrote:
> El Thu, 18 Mar 2004 11:49:52 -0500 (EST) Rik van Riel <riel@redhat.com> escribió:
> 
> 
>>I suspect the security paranoid will like this patch too,
>>because it allows gnupg to mlock the memory it wants to
>>have locked.
> 
> 
> I think it's good for cd-burning too. Currently most of the distros set
> the suid bit for cdrecord (wich implies some security bugs). You can
> workaround that by changing the devide node's permissions and kill the suid bit:
> brw-rw----    1 root     burning     22,   0 2003-05-23 16:41 /dev/cd-rw
> 
> but still cdrecord will cry:
> cdrecord: Operation not permitted. WARNING: Cannot do mlockall(2).
> cdrecord: WARNING: This causes a high risk for buffer underruns.
> 
> With that patch desktop users will be able to burn cds without falling into
> buffer underruns and without using the suid hack, I guess? Nice work :)

Have a bit of caution there, cdrecord sets itself realtime priority, 
locks pages in memory, and ensures that the process is likely to work 
even under load. I don't think addressing just a part of the problem 
will result in reliability under load. You would have to look at 
capabilities to allow these things to be done, under load they may not 
keep up depending on what's going on. Good to get a start, don't assume 
all the issues are addressed.

-- 
    -bill davidsen (davidsen@tmr.com)
"The secret to procrastination is to put things off until the
  last possible moment - but no longer"  -me