Restricting User Access to Removable Media with RBAC
By default, all users can access removable media in the Solaris 9 release. However, you can restrict user access to removable media by setting up a role through role based access control (RBAC). Access to removable media is restricted by assigning the role to a limited set of users.
For a discussion of using roles, see "Roles" in System Administration Guide: Security Services.
How to Restrict User Access to Removable Media with RBAC
Become superuser or assume an equivalent role.
Start the Solaris Management Console.
$ /usr/sadm/bin/smc &
For more information on starting the console, see "How to Start the Solaris Management Console in a Name Service Environment".
Set up a role that includes the Device Management rights.
For more information, see "How to Create a Role Using the Administrative Roles Tool" in System Administration Guide: Security Services.
Add users who need to use the cdrw command to the newly created role.
Comment the following line in the /etc/security/policy.conf file.
AUTHS_GRANTED=solaris.device.cdrw
If you do not do this step, all users still have access to the cdrw command, not just the members of the device management role.
After this file is modified, the device management role members are the only users who can use the cdrw command. Everyone else is denied access with the following message:
Authorization failed, Cannot access disks.
How to Identify a CD Writer
Use the cdrw -l command to identify the CD writers on the system.
% cdrw -l
Looking for CD devices...
Node | Connected Device | Device type
----------------------+--------------------------------+-----------------
cdrom0 | YAMAHA CRW8424S 1.0d | CD Reader/Writer
|
If you want to use a specific CD writer, use the -d option. For example:
% cdrw -a filename.wav -d cdrom2 |
Use the cdrw -M command to to identify whether the media is blank or whether there is an existing table of contents.
% cdrw -M Device : YAMAHA CRW8424S Firmware : Rev. 1.0d (06/10/99) Media is blank % |
How to Check the CD Media
The cdrw command works with or without vold running. However, you must have superuser or role access to stop and start the vold daemon.
Insert a CD into the CD-RW device.
The CD can be any CD that the device can read.
Check that the CD-RW drive is connected properly by listing the device.
$ cdrw -l Looking for CD devices... Node Connected Device Device type ----------------------+--------------------------------+----------------- cdrom1 | YAMAHA CRW8424S 1.0d | CD Reader/Writer(Optional) If you do not see the drive in the list, you might have to do a reconfiguration boot so that the system recognizes the device.
# touch /reconfigure # init 6
Or, use the following commands to add the CD-RW device without rebooting the system.
# drvconfig # disks
Then restart vold.
# /etc/init.d/vold stop # /etc/init.d/vold start
Creating a Data CD
Prepare the data first by using the mkisofs command to convert the file and file information into the High Sierra format used on CDs.
How to Create an ISO 9660 File System for a Data CD
Insert a blank CD into the CD-RW device.
Create the ISO 9660 file system on the new CD.
% mkisofs -r /pathname > cd-file-system
-r
Creates Rock Ridge information and resets file ownerships to zero.
/pathname
Identifies the pathname used to create the ISO 9660 file system.
> cd-file-system
Identifies the name of the file system to be put on the CD.
Copy the CD file system onto the CD.
% cdrw -i cd-file-system
-i cd-file-system
Specifies the image file for creating a data CD.
Example--Creating an ISO 9660 File System for a Data CD
The following example shows how to create a ISO 9660 file system for a data CD.
% mkisofs -r /home/dubs/ufs_dir > ufs_cd Total extents actually written = 56 Total translation table size: 0 Total rockridge attributes bytes: 329 Total directory bytes: 0 Path table size(bytes): 10 Max brk space used 8000 56 extents written (0 Mb) |
Then copy the CD file system onto the CD. For example:
% cdrw -i ufs_cd Initializing device...done. Writing track 1...done. Finalizing (Can take several minutes)...done. |
How to Create a Multi-Session Data CD
This procedure describes how to put more than one session on the CD. This procedure includes an example of copying the infoA and infoB directories onto the CD.
Create the file system for the first CD session.
% mkisofs -o infoA -r -V my_infoA /data/infoA Total translation table size: 0 Total rockridge attributes bytes: 24507 Total directory bytes: 34816 Path table size(bytes): 98 Max brk space used 2e000 8929 extents written (17 Mb)
-o infoA
Identifies the name of the ISO file system.
-r
Creates Rock Ridge information and resets file ownerships to zero.
-V my_infoA
Identifies a volume label to be used as the mount point by vold.
/data/infoA
Identifies the ISO image directory to create.
Copy the ISO file system for the first session onto the CD.
$ cdrw -iO infoA Initializing device...done. Writing track 1...done. done. Finalizing (Can take several minutes)...done.
-i infoA
Identifies the name of the image file to write to the CD.
-O
Keeps the CD open for writing.
Re-insert the CD after it is ejected.
Identify the pathname of the CD media to include in the next write session.
% eject -n . . . cdrom0 -> /vol/dev/rdsk/c2t4d0/my_infoA
Note the /vol/dev/... pathname.
Identify the next writeable address on the CD to write the next session.
cdrw -M /cdrom Device : YAMAHA CRW8424S Firmware : Rev. 1.0d (06/10/99) Track No. |Type |Start address ----------+--------+------------- 1 |Audio |0 2 |Audio |33057 3 |Data |60887 4 |Data |68087 5 |Data |75287 Leadout |Data |84218 Last session start address: 75287 Next writable address: 91118
Note the address in the Next writable address: output so you can provide this when you write the next session.
Create the next ISO file system for the next CD session and write it onto the CD.
mkisofs -o infoB -r -C 0,91118 -M /vol/dev/rdsk/c2t4d0/my_infoA /data/infoB Total translation table size: 0 Total rockridge attributes bytes: 16602 Total directory bytes: 22528 Path table size(bytes): 86 Max brk space used 20000 97196 extents written (189 Mb)
-o infoB
Identifies the name of the ISO file system.
-r
Creates Rock Ridge information and resets file ownerships to zero.
-C 0,91118
Identifies the starting address of the first session and the next writable address.
-M /vol/dev/rdsk/c2t4d0/my_infoA
Specifies the path of the existing ISO image to be merged.
/data/infoB
Identifies the ISO image directory to create.