[23889] in bugtraq
Re: cdrdao insecure filehandling
daemon@ATHENA.MIT.EDU (martin f krafft)
Wed Jan 16 21:29:35 2002
Date: Wed, 16 Jan 2002 14:49:13 +0100
From: martin f krafft <madduck@madduck.net>
To: bugtraq@securityfocus.com
Message-ID: <20020116134913.GG16146@fishbowl.madduck.net>
Mail-Followup-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="yZnyZsPjQYjG7xG7"
Content-Disposition: inline
In-Reply-To: <E16QSRj-0006F6-00@asd.ppp0.com>
--yZnyZsPjQYjG7xG7
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
also sprach Anthony DeRobertis <asd@suespammers.org> [2002.01.15.1312 +0100=
]:
> dpkg-statoverride --update --add root root 0755 /usr/bin/cdrdao=20
>=20
> This tells dpkg that cdrdao is not to be suid root anymore, at least unti=
l=20
> you change or delete that override.=20
but then you have to be root to burn CDs. there is a reason why cdrdao
is setuid - it needs access to root-owned device files like /dev/scd0
and /dev/sg0 (on Linux that is).
i believe the right solution is to create a new group just for that, and
chgrp these device files to that group. then cdrdao works non-setuid,
and you have user-level control over who should be able to use the
burner, and who shouldn't.
--=20
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
=20
"when I was a boy I was told
that anybody could become president.
now i'm beginning to believe it."
-- clarence darrow
--yZnyZsPjQYjG7xG7
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjxFhNkACgkQIgvIgzMMSnWXTgCfS/UlpLlu5pe3KvYTsKQXJKzi
8cUAoOoGkXBWPOwax7C6/R+/DtePG6Rj
=Vf17
-----END PGP SIGNATURE-----
--yZnyZsPjQYjG7xG7--
