Messages in this thread | ![/](/images/icornerl.gif) | | Date | Sat, 13 Nov 2010 18:44:44 -0800 | From | Kees Cook <> | Subject | Re: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n |
| |
On Sat, Nov 13, 2010 at 09:50:22AM -0800, Linus Torvalds wrote: > So I would suggest guarding the whole thing, and just returning 0 if > CONFIG_PRINTK isn't set. Or preferably just move the dmesg_restrict > test into do_syslog, and stop playing stupid games with > "security_syslog()", which actually goes away if you disable the you > disable CONFIG_SECURITY. > > SECURITY_DMESG_RESTRICT is totally independent of CONFIG_SECURITY, so > doing it in security_syslog() was a bug to begin with. > > Or we should make SECURITY_DMESG_RESTRICT _depend_ on CONFIG_SECURITY, > and move it entirely into security/commoncap.c, and not pollute > kernel/printk.c at all with it.
It seems saner to put it in commoncaps to me, but either way, it must happen after the from_file and OPEN test or it will break /proc/kmesg readers who open and drop privs (as done with sysklogd, etc).
> + if (dmesg_restrict && !capable(CAP_SYS_ADMIN)) > + return -EPERM; > + >... > { > if (type != SYSLOG_ACTION_OPEN && from_file) > return 0; > - if (dmesg_restrict && !capable(CAP_SYS_ADMIN)) > - return -EPERM;
i.e.
if (dmesg_restrict && (!from_file || type == SYSLOG_ACTION_OPEN) && !capable(CAP_SYS_ADMIN))
-Kees
-- Kees Cook Ubuntu Security Team
| ![\](/images/icornerr.gif) |