- name: k3b
- description: cd-writer
- snapcraft: https://invent.kde.org/multimedia/k3b/-/merge_requests/99
- upstream: https://invent.kde.org/multimedia/k3b/-/merge_requests/99
- upstream-relation: kde developer
- interfaces:
- block-devices:
- request-type: connection
- reasoning: https://bugs.kde.org/show_bug.cgi?id=521196
- block-devices:
This request has been added to the queue for review by the @reviewers team.
Reading the bug report it sounds more like we should fix the optical-drive interface to allow the necessary SCSI command TBH…
1 Like
While the justification provided makes sense, block-devices is overly broad. It grants access to all block devices on the system (/dev/sda, /dev/nvme*, USB storage, etc.), not just optical drives. K3b only needs access to optical drives, so this would violate the principle of least privilege.
As @ogra suggested, the preferred long-term fix would be to fix the optical-drive interface in snapd to allow the SCSI commands needed for burning.
As a shorter-term alternative, the scsi-generic interface (which provides access to /dev/sg* devices) may be a better fit, as it provides the raw SCSI command access K3b needs without exposing all block devices on the system. This is still super-privileged, but more targeted.
Could you give this a try?
1 Like