I have a computer, with multiple operating systems.
On one of them (OpenSuse 10.3 + KDE 3.5), I want to block the CD-ROM access to some or all the users.
No problem if even root is not allowed.
The other OS on the computer must see the CD-ROM.

I have root access.
The other users do not have it.

When I enter a CD/DVD the KDE automounts it, so the CD becomes visible.

I searched the internet, and I found some threads, but no one could solve my problem.

1.
Is there a way to get the users out of the cdrom group?
I looked into it, and it seems that the cdrom group is empty.

2.
Or there is any command to put in a startup script.

3.
To stop the automounting of cdroms.

autofs is off, yet no results:
# /sbin/chkconfig --list | grep autofs
autofs 0ff 1ff 2ff 3ff 4ff 5ff 6ff

4.
To stop the KDE automounting, for all users.
As in: KDE Control Center > KDE Components > Service Manager > Startup Services box
But for all the users, without the possibility to re-activate it.

5.
Modifications in udev configuration files:
/etc/udev/rules.d/*

6.
Anything else?


I know it sounds paranoic, but the environment I have to install this security feature is very strict.

Thank you very much.

I suggest check your /etc/fstab file to find out what options that your distribution is using. If it is using any automounter listed for your drives, I suggest read about the automounter configuration.

Learn the outdated, unknown, and not trust worthy pam. Also learn SELinux. You may want to look into grsecurity. IMHO, it is best to take out pam to minimize any security problems. Yes, programs can do with out pam with some minor modifications.

If you are that paranoid, I suggest Gentoo because you will have a lot more control what is it doing, how it does it, when it should do it, and why is it doing that way.

Recompile your kernel without UDF and ISO9660 support, and that should stop anyone from mounting cds and any other ISO images. Remove automount capabilities while you are at it.

Maybe remove all automount utilities on your system.

Be innovative. There is loads of ways to do this with ease.

http://reactivated.net/writing_udev_rules.html

This is how I did it:

- I moved to kubuntu 8.04 (for other reasons than this one)
- I cut sudo access to the current user
- I cut root access to the current user
- I stopped the service "hal" (the one that is responsible for automount devices in KDE) - this is the key

When I enter a CD/DVD, it is no longer auto mounted.
When I boot with a CD/CVD in tray, this one is not available either.

Same for USB devices.

If user tries
# mount /dev/scd0 /media/cdrom0
it gets: "mount: only root can do that"

I also commented out these 2 lines in /etc/fstab
#/dev/scd0 /media/cdrom0 udf,iso9660 user,noauto,exec,utf8 0 0
#/dev/fd0 /media/floppy0 auto rw,user,noauto,exec,utf8 0 0

Emil