On Sun, Aug 06, 2006 at 01:54:49PM +0300, Aleksey Cheusov wrote:
> 2)
> I would like to give a user to give ability to grab CDs
> but not to read /dev/[ws]d* devices.
> For this, I've changed group of /dev/[r]cd* files.
> Is this the only way (I don't want to set suid bit to cdparanoia)?

Do you want that user to always be able to grab CDs, no matter where
they're logged in from (on the console, or remotely)? Or do you want
whichever user is logged in to the console to have full CD access?
If the latter is really what you want, see the ttyaction(5) manpage.
You can set it up so that when a user logs in to the console, ownership
of the [r]cd* devices gets assigned to them, and when they log out,
ownership gets assigned back to root.
-- 
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: khym@azeotrope.org |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 30 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++