Document exact-release Linux hardware validation

[friidump.git] / README

diff --git a/README b/README
index a983057b0e4656e4747f66236c49ca462793b167..a9f2616dd34ee80e198716bea06ba66c1e40c79d 100644 (file)
--- a/README
+++ b/README
@@ -160,23 +160,27 @@ $ cmake ..
 $ make
 $ make install
 
 $ make
 $ make install
 

-Linux-specific note: You need root privileges to issue certain commands to the
-DVD-ROM drive. Hence you have the following possibilities:
-- Run FriiDump as root: discouraged.
-- Run it through sudo: better but nevertheless discouraged.
-- Set the setuid bit on the executable: this is the recommended way to run
-  FriiDump under Linux. This way, the code run with superuser privileges will
-  be reduced to a minimum, guaranteeing a certain level of security (note that
-  security-related bugs might exist anyway!!!). Also note that, even when the
-  setuid bit is set, the attempt to open the drive for reading will be done
-  after privileges have been dropped, so you will need explicit read access to
-  the DVD-ROM drive. Usually having the system administrator add you to the
-  "cdrom" group is enough. To set the setuid bit on the executable, run as
-  root:
-
-  $ chown root:root /usr/local/bin/friidump
-  $ chmod u+s /usr/local/bin/friidump
+Linux-specific note: Run FriiDump as a normal user. Do not run it with `sudo`,
+and do not install it setuid-root.

 
 

+Linux vendor-command paths need two separate permissions:
+
+- The normal user needs access to the selected `/dev/sr*` device and, when
+  applicable, its `/dev/sg*` device. On Ubuntu, membership in the `cdrom` group
+  normally provides this access.
+- GameCube/Wii memory-dump methods and Xbox vendor-unlock paths need effective
+  `CAP_SYS_RAWIO` on the exact validated FriiDump executable.
+
+After you verify the executable, use the maintained helper:
+
+  $ bash ./validation/friidump-linux-rawio-capability.sh install \
+      ./build/src/friidump
+  $ getcap ./build/src/friidump
+
+Rebuilding, relinking, copying, replacing, or re-extracting the executable can
+clear its file capability. Verify `cap_sys_rawio=ep` before each
+vendor-command hardware run. See `docs/LINUX.md` for the complete Linux
+permission and hardware procedure.

 
 ===============================================================================
 Usage
 
 ===============================================================================
 Usage