Re: [OT] Joerg Schilling flames Linux on his Blog

[Joerg Schilling]

"Alexander E. Patrakov" <patrakov@xxxxxxxxxx> wrote:

> On Thursday 26 May 2005 16:15, Joerg Schilling wrote:
>
> > The problem was that you could send SCSI commands on R/O fds and fixing the
> > problem would have been to forbid sending SCSI commands on R/O fds.
>
> Unfortunately, this is not going to work. It would work only if the only app 
> that has to send SCSI commands were cdrecord. Then really, a non-setuid 
> program just would not be able to get a R/W fd, and setuid ones are assumed 
> to be trusted.

If these programs did rely on the named security bug, then these programs
were broken anyway and need to be fixed. Note that the _old_ (non ioctl based)
/dev/sg interface needed write access in order to send SCSI commands.


> The problem is that many CD audio players also send SCSI commands in order to 
> extract digital audio data. Are you proposing to make them setuid root? use a 
> well-defined setuid helper? other solution?

If these programs did ever work before, someone did break them meanwhile.


Jörg

-- 
 EMail:joerg@xxxxxxxxxxxxxxxxxxxxxxxxxxx (home) Jörg Schilling D-13353 Berlin
       js@xxxxxxxxxxxxxxx		(uni)  
       schilling@xxxxxxxxxxxxxxxxxxx	(work) Blog: http://schily.blogspot.com/
 URL:  http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/