Red Hat Bugzilla – Bug 61447
gtoaster not using console permissions
Last modified: 2007-04-18 12:41:01 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2.1) Gecko/20010901
Description of problem:
The permission policy on gtoaster seems a bit strange. Right now the
console.perms file includes the cdwriter, which means it would be possible for a
normal user to run gtoaster if it weren't setup with consolehelper.
Unfortunetly, if they do that they're prompted for the root password. If they
provide the root password the gtoaster is run as root and they can access
privledged files on the system.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.Login as a normal user
Actual Results: Notice that it pops up a dialog box asking for the root password.
Expected Results: Gtoaster should just run
I think there are two distinct uses. One is normal use where the user is just
writing some of their files and the other is doing a backup where the user needs
to access all the files on the system.
Currently, gtoaster is setup for the backup case, where the user has to provide
the root password then they can access any file on the system. I'd like to see a
way where users could write cds as themselves.
This is actually with beta2 and beta3 as well as 7.2
You should install package kapabilities. This package allows you to configure
any users to do that without root password
No, kapabilities is not the right answer. I don't want the user to run gtoaster
as root, I want them to run it as themselves. If I wanted them to have access to
it I could have modified the pam configuration to use pam_console. I don't want
them to have root access to all the files on the system, I just want them to be
able to burn a CD of files they normally have access to.
You've got two security systems working and they are conflicting. The first
security system is /etc/security/console.perms. It is setting the permissions on
/dev/scd0 so the user has access to it. If this was all you were doing
everything would be great for what I want, because the user could run gtoaster
and it would work.
The second security system is the consolehelper wrapper. It requires a root
password and gives you root access to the system. This is good if the user wants
to do a root backup of the system to a CD and needs to write system files.
Unfortunetly, once you've done this you break the first capability of users
being able to burn CDs as themselves.
Both capabilities are useful, but you've broken the first in the way you've
setup the second.
gtoaster is not included in Fedora anymore, please report the bug to author. Thanks