linux-kernel - Writing CD/DVD on devices opened for read-only. Is it bad?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 19 Oct 2011 14:20:44 +0400
From:	Igor Zhbanov <izh1979@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: Writing CD/DVD on devices opened for read-only. Is it bad?

Hello!

I have a question about permissions needed for CD/DVD writing.
As I see in source code user must have capability CAP_SYS_RAWIO for
CD/DVD writing
in 2.6 kernels (I'm not sure that it is needed for all types of disk writing),
but (it seems that) kernel ignores device file permissions. So you can
open /dev/cdrom
for read-only and use IOCTLs for blanking disks and CD/DVD writing.

I think that f_mode for device file should be checked. Isn't it bad to
permit "writable" IOCTLs
for devices opened read-only?

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/