Cannot Burn CDs

merlinus · 24 January 2019 20:35

Since re-installing 18.04.1, I cannot burn cds (or dvds). I have set up my account to use cd-rom drives, and am a member of the root group. This happens with both Brasero and K3b. The error msg on K3b is to the effect that it does not have permission to burn discs.

The same thing happens on a different 18.04 computer as well. I am the owner of the files I want to burn. I tried to chown /dev/sr0 so that I am the owner, but that did not change anything.

Dave_Barnes · 24 January 2019 22:08

Is your user a member of the cdrom group too?

merlinus · 24 January 2019 22:55

Yes. Thanks! Here is the K3b error msg:

  cdrecord has no permission to open the device.  The cd drive is selected in Settings.

merlinus · 24 January 2019 23:29

This command seems to have solved the issue:

sudo chmod 4711 /usr/bin/wodim; sudo chmod 4711 /usr/bin/cdrdao

mdooley · 24 January 2019 23:33

Where did you find this solution?

merlinus · 25 January 2019 00:33

I found it online at:

Dave_Barnes · 25 January 2019 01:38

Your user must be a member of the cdrom group to write to the cdrom device (/dev/sr0).
You can check

grep cdrom /etc/group

If your user is not a member of the cdrom group you must add your user to the cdrom group as follows:

sudo usermod -aG cdrom "your_cdrom_user"

replacing “your_cdrom_user” with the actual username. The log out and log back in to get new permissions.

You can check the permissions of the cdrom device with

ls -al /dev/sr0

NOTE: Running stuff setuid root is bad. Do not do it!

djb

merlinus · 25 January 2019 03:13

Thanks for your suggestion. I had already tried all that, but no joy.

    It seems that with Ubuntu 18.04 (and perhaps later) permissions need to be changed on files in /usr/bin.  This command fixed the issue:

sudo chmod 4711 /usr/bin/wodim; sudo chmod 4711 /usr/bin/cdrdao

Dave_Barnes · 25 January 2019 03:53

NO! Burning CDROM works fine here. You have another problem if you have to run those files as root. Making /usr/bin/wodim and /usr/bin/cdrao setuid root is a security risk and breaks a great many other things in Linux. You are basically giving cdrdao permission to write all over everything on your system, CDROM , DISK, Network, Screen, etc..... You do not want to allow that permission. A crash with /usr/bin/cdrao will trash your system. That is why only users in group cdrom can use cdrao to write to the cdrom.

You don't want your user to be a member of the root group. Making your user a member of the root group breaks stuff too.

Here is a list of the general group permissions in Debian from which Ubuntu is derived:
https://wiki.debian.org/SystemGroups

I don't remember what step adds the group cdrom settings automatically.

djb

merlinus · 25 January 2019 04:01

I understand your point completely, but I cannot burn cds on both of my Ubuntu 18.04 computers, so really have no other choice.

I double-checked to make sure that I am a member of the cdrom group, but still no joy without changing the permission of those two system files. I logged out and back in, and even re-started, all in vain.

BTW, one of the computers had a fresh install of 18.04.1 a short while ago, so I do not have any idea why simply making myself a member of the cdrom group is not working.

merlinus · 25 January 2019 04:17

Here is the result of the terminal command you gave:

$ls -al /dev/sr0
brw-rw----+ 1 root cdrom 11, 0 Jan 24 16:25 /dev/sr0

Dave_Barnes · 25 January 2019 04:40

What does

grep cdrom /etc/group

show?

djb

Dave_Barnes · 25 January 2019 04:51

Does “eject /dev/sr0” work? Or do you have to put “sudo” in front?

merlinus · 25 January 2019 06:48

$ grep cdrom /etc/group

    cdrom:x:24:merlin

merlinus · 25 January 2019 06:49

It works without sudo. But this is with the permissions changed on the two system files.

merlinus · 25 January 2019 16:17

The command worked on the computer that did not have the system file permissions changed. So why it is refusing to burn cds is still a mystery.

Dave_Barnes · 25 January 2019 20:37

The problem must be with PAM security then. PAM messages are in “/var/log/auth.log”.

I do note that the authors of K3b have a 9 year old doc concerning permission problems:

github.com

KDE/k3b/blob/master/PERMISSIONS.txt

K3b needs some special permissions to work properly. Most distrobutions come with permissions that I don't like
very much and make problems when adding new CD/DVD devices to your system.
If you set up your system as follows you can be sure to never have K3b permission problems again.

1. Disable pam authentication for cdrom and burner devices in /etc/security/console.perm. Otherwise your permissions
   will be overwritten when loggin in and it's not possible for two users to use K3b at the same time.
   In my opinion one should disable this completely and create a proper configuration instead. The most annoying
   issue with this pam stuff is that you cannot have two sessions with two different users running because the first 
   one owns all the sound and cd devices.

2. Create a cdrom or cdrw or whatever group (if it not already exists) and add all users that should be able to
   use K3b to that group. You may also skip this step and let everybody use K3b. In that case simply use root as
   the group and permissions 4711 and 666 instead of 4710 and 660 in the following steps.

3. Change the permissions of cdrecord and cdrdao to 4710 root.cdrom (substitute cdrom with the group from 2).
   This way both will run suid root which allows them to increase their scheduling priority resulting in a more
   stable burning process.

4. Change the permissions of all your cdrom device to 660 root.cdrom (substitute cdrom with the group from 2).
   With devfs you may do this with lines like this (the first changes all ide cd devices while the second takes

This file has been truncated. show original

I do not know if any of that doc applies to current Linux.

Sorry you are having a problem. Tracking down the source of the permission problem will be difficult unless one of the system logs, /var/log/syslog or /var/log/auth.log, have something useful. The next step would be doing simulated burns with wodim or cdrdao and looking through the debug output. Honestly, that is probably not worth doing unless you start to have permission problems with other devices and programs.

Good luck

djb

merlinus · 25 January 2019 21:03

Thanks very much for the info and assistance, Dave. Greatly appreciated!

    But the same exact problem also occurs with Brasero, so it is most likely not a PAM problem.  And in 18.04 there is no /etc/security/console.perm

    So unless some weird things start happening, I will leave the permissions changed for wodim and cdrdao.