cdrecord is installed setuid-root and world-executable. Why not make default permissions "-rws--x--- root cdrw" as I think the the group cdrw exists exactly for this? I might be wrong of course. Reproducible: Always
Newer versions of cdrtools eg. cdrtools-3.01_alpha17 which I am about to stabilise use posix file system capabilities. Is this sufficient as a solution.
Yes, ping back when you've stabilized new and removed the old versions (or you can use this bug for the stable)
I have already opened a bug for stabilization. It is on the depend list now.
Actually USE filecaps does not change anything now: all suid bins are still installed with suid, see bug #490272
Although bug #486318 is closed there is still /usr/sbin/rscsi left which is world executable. Maybe it is best to open a new bug about it and this one depend on the new one.
fixed and any additional issues moved to other bugs