According to this bug https://bugs.archlinux.org/task/67265 you can set up file capabilities on cdrecord binary during package creation or later I set as root setcap cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep /usr/bin/cdrecord and it seems to work # getcap /usr/bin/cdrecord /usr/bin/cdrecord cap_dac_override,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio,cap_sys_admin,cap_sys_nice,cap_sys_resource=ep === guest@slax:~$ cdrecord --scanbus Cdrecord-ProDVD-ProBD-Clone 3.02a09 (i686-pc-linux-gnu) Copyright (C) 1995-2016 Joerg Schilling Linux sg driver version: 3.5.36 Using libscg version 'schily-0.9'. scsibus0: 0,0,0 0) 'ATA ' 'WDC WD10EZEX-00B' '1A01' Disk 0,1,0 1) * 0,2,0 2) * 0,3,0 3) * 0,4,0 4) * 0,5,0 5) * 0,6,0 6) * 0,7,0 7) * scsibus4: 4,0,0 400) * 4,1,0 401) 'PIONEER ' 'DVD-RW DVR-S21 ' 'PA01' Removable CD-ROM 4,2,0 402) * 4,3,0 403) * 4,4,0 404) * 4,5,0 405) * 4,6,0 406) * 4,7,0 407) * ====