Bug#31864: Should programs that access /dev/* be SGID?

[Hwei Sheng TEOH <hsteoh@cs.toronto.edu>]

Package: general
Severity: wishlist

I noticed that a lot of packages that access devices, such as CD players,
audio players, etc., are denied permission to access the relevant devices in
/dev/ when not run as root.

Perhaps such programs should be SGID to whatever group that device is
assigned? For example, since /dev/cdrom is read-writable by group 'disk', a
program, say cdplay, can be SGID to 'disk' so that it can be executed by
normal users. (This is what I've done on my system so that I don't have to su
to root all the time, or make binaries SUID root unnecessarily).

Of course, there might be security/administrative concerns that this might
give undue device access to normal users, but since many Linux boxes (such as
mine) are used only by one person, this should at least be an option during
installation? Or at the very least documented, so that beginners who don't
know about this can find out how to do it.


T