Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices

Marc Ballarin
2004-08-21T07:36:02Z

On Sat, 21 Aug 2004 07:58:03 +0100
David Greaves <david@dgreaves.com> wrote:

> Can someone explain why it isn't anyone with _write_ access to the
> device? Surely it's better to drop a user into a group or setgid a
> program?
>
> If I have write access to a device then I can wipe it's media anyway.
> Is there something I'm missing?
>

With RAW_IO access you cannot only wipe the media, but the entire
firmware (not only wipe it, but also upload a malicious version that will
screw up the entire SCSI or IDE bus).

Andreas Messer and I are working on an improved filter that works per
device and is configurable from userspace. It's not easy though.

Regards