found it.
it's a new piece of kernel code verify_command in
drivers/block/scsi_ioctl.c, which checks for the capability
CAP_SYS_RAWIO.
ah, dammit.
for k3b to work, you'd have to install it setuid root, call
getcap(), remove all but the necessary capabilities (i.e. don't
remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
a setcap().
fuse (file system in userspace) uses this technique for allowing
mount and unmount but nothing else
[which doesn't work on 2.6.8 btw: the getcap() fails, but i did notice
that debian doesn't install fusermount as setuid to root which is half
the problem...]
l.
On Mon, Oct 04, 2004 at 02:10:14PM +0100, Luke Kenneth Casson Leighton wrote:
> additional info:
>
> kernel 2.6.8. ioctl ("/dev/hdc", CDROM_SEND_PACKET, cmd)
>
> commands that are failing as non-root, even when permission is granted
> rwxrwxrwx to /dev/hdc, are, according to some debug info added to k3b:
>
> GET CONFIGURATION (46)
> error code: 0
> sense key: NO SENSE (2)
> asc: 0
> ascq: 0
>
> and:
>
> MODE SELECT (55)
> error code: 0
> sense key: NO SENSE (2)
> asc: 0
> ascq: 0
>
> the result is that k3b cannot determine that the drive exists, therefore
> it cannot use it even though cdrecord might actually work.
>
>
> as root, the following errors occur:
>
> MODE SELECT (46)
> errorcode: 70
> sense key: ILLEGAL REQUEST (5)
> asc: 26
> ascq: 0
>
> READ DVD STRUCTURE (ad)
> errorcode: 70
> sense key: NOT READY (2)
> asc: 3a
> ascq: 0
>
> presumably it can be concluded that the GET CONFIGURATION ioctl command
> is the one at fault.
>
> ... what gives?
>
> l.
>
> --
> --
> Truth, honesty and respect are rare commodities that all spring from
> the same well: Love. If you love yourself and everyone and everything
> around you, funnily and coincidentally enough, life gets a lot better.
> --
> <a href="http://lkcl.net"> lkcl.net </a> <br />
> <a href="mailto:[email protected]"> [email protected] </a> <br />
>
> --
> --
> Truth, honesty and respect are rare commodities that all spring from
> the same well: Love. If you love yourself and everyone and everything
> around you, funnily and coincidentally enough, life gets a lot better.
> --
> <a href="http://lkcl.net"> lkcl.net </a> <br />
> <a href="mailto:[email protected]"> [email protected] </a> <br />
>
--
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love. If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net"> lkcl.net </a> <br />
<a href="mailto:[email protected]"> [email protected] </a> <br />
On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
> found it.
>
> it's a new piece of kernel code verify_command in
> drivers/block/scsi_ioctl.c, which checks for the capability
> CAP_SYS_RAWIO.
>
> ah, dammit.
>
> for k3b to work, you'd have to install it setuid root, call
> getcap(), remove all but the necessary capabilities (i.e. don't
> remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
> a setcap().
it works in 2.6.9-rcX.
--
Jens Axboe
On Mon, Oct 04, 2004 at 04:01:46PM +0200, Jens Axboe wrote:
> On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
> > found it.
> >
> > it's a new piece of kernel code verify_command in
> > drivers/block/scsi_ioctl.c, which checks for the capability
> > CAP_SYS_RAWIO.
> >
> > ah, dammit.
> >
> > for k3b to work, you'd have to install it setuid root, call
> > getcap(), remove all but the necessary capabilities (i.e. don't
> > remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
> > a setcap().
>
> it works in 2.6.9-rcX.
okay so someone has added the GET_CAPABILITY to verify_command in
scsi_block.c there, yes?
Jens Axboe wrote:
> On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
>
>>found it.
>>
>>it's a new piece of kernel code verify_command in
>>drivers/block/scsi_ioctl.c, which checks for the capability
>>CAP_SYS_RAWIO.
>>
>>ah, dammit.
>>
>>for k3b to work, you'd have to install it setuid root, call
>>getcap(), remove all but the necessary capabilities (i.e. don't
>>remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
>>a setcap().
>
>
> it works in 2.6.9-rcX.
>
I don't know for sure if this is related or not, but it sure sounds like
it. I have noticed the following in at least the last few versions (I
believe 2.6.9-rc2 also): Even though CONFIG_SECURITY_CAPABILITIES can be
configured as a module, if I don't compile it into the kernel getcap and
setcap fail.
kr
On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
> On Mon, Oct 04, 2004 at 04:01:46PM +0200, Jens Axboe wrote:
> > On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
> > > found it.
> > >
> > > it's a new piece of kernel code verify_command in
> > > drivers/block/scsi_ioctl.c, which checks for the capability
> > > CAP_SYS_RAWIO.
> > >
> > > ah, dammit.
> > >
> > > for k3b to work, you'd have to install it setuid root, call
> > > getcap(), remove all but the necessary capabilities (i.e. don't
> > > remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
> > > a setcap().
> >
> > it works in 2.6.9-rcX.
>
> okay so someone has added the GET_CAPABILITY to verify_command in
> scsi_block.c there, yes?
GET_CONFIGURATION, yes. There have been a number of additions since
2.6.8.
--
Jens Axboe