Unless I'm off my rocker here, the installer creates symlinks for CD-ROM
drives as /dev/cdrom, /dev/cdrom1, ... Although by default these devices
are set up to be mountable by the user, /etc/security/console.perms only
changes the permissions on /dev/cdrom and /dev/cdwriter as opposed to
/dev/cdrom* and /dev/cdwriter
Fixed in pam-0.72-26.