chmod o+r /dev/sda* is quite dangerous, as it allows any program to read your whole disk (including e.g. password hashes in
/etc/shadow, if your root partition is on
There are (at least) two ways to do this more safely:
- Add all users that need to read the disk to the
disk group and run
chmod g-w /dev/sda* to prevent write access for that group.
- Change the group of
/dev/sda* to a group that only contains the users that need to read the disk, e.g.
chgrp my-benchmarkers /dev/sda* and prevent write access for this group with
Please note that the group and permission changes on device nodes in
/dev are only temporary until the device in question is disconnected or the computer is rebooted.
One problem could be that
hdparm needs write access for most of its functionality. You must check if everything you want works with read-only access.
EDIT: It looks like
hdparm doesn't need write access. It rather needs the
CAP_SYS_RAWIO capability to perform most ioctls.
You can use
setcap cap_sys_rawio+ep /sbin/hdparm to give this capability to hdparm. Please note that this allows anyone who can execute
hdparm and has at least read access to a device file to do practically anything
hdparm can do on that device, including
--write-sector and all other hdparm commands the man page describes as "VERY DANGEROUS", "EXTREMELY DANGEROUS" or "EXCEPTIONALLY DANGEROUS". Wrapper scripts might be a better solution.
If not you either have to give write access or write wrapper scripts that can be executed by your users as root using sudo rules.