Disable & Enable CD-ROM

For security reasons (so no-one can copy data from computer to CD-ROM, or from CD-ROM to computer), I have to disable the CD-ROM drives on all of the Ubuntu systems I have.

I estimate I have near 400-500 Ubuntu machines.

How can I disable CD-ROM drives, and then enable them again.

If possible, I would like commands to both enable, and disable a CD-ROM drive.

2 Answers

Lock the drive:

eject -i 1

Unlock the drive:

eject -i 0

From man eject:

 -i on|1|off|0 This option controls locking of the hardware eject button. When enabled, the drive will not be ejected when the button is pressed. This is useful when you are carrying a laptop in a bag or case and don't want it to eject if the button is inadvertently pressed.

Mind that this command is available for users on the system so you might also want to create an alias to override the normal eject. And not all versions of eject support locking (the version in Ubuntu 15.04+ does; below that I am not sure).

What the command does is a ...

echo 1 | sudo tee /proc/sys/dev/cdrom/lock
echo 0 | sudo tee /proc/sys/dev/cdrom/lock

so you can also use that.

And these is also a 3rd party script you could use called cdctl.

15:04 (oldest Ubuntu I have):

$ eject --version
eject version 2.1.5 by Jeff Tranter ()
$ eject -i 1
CD-Drive may NOT be ejected with device button
$ eject -i 0
CD-Drive may be ejected with device button

First: I'm using Debian 10, but this might also work in Ubuntu.

The only way I was able to disable CD/DVD reading/writing was to create -- as root -- the following cron job:

@reboot mv /dev/sr0 /dev/sr0_block

Remember to check the device file name for your CD-ROM. You could use the lsblk command for that. In my case, it is sr0.

To re-enable functioning just comment or delete the cron job line and restart the computer.

Note that if you just rename the sr0 file, without adding a cron job, you'll find the change unmade after reboot.

I'm sorry this is an ugly trick, but I have tried: removing users from cdrom group, changing permissions of /media, blacklisting cdrom and sr_mod modules and even the eject -i 1 command. That is the only thing that worked for me.