Messages in this thread | | | Date | Thu, 18 Nov 2010 08:26:24 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] capabilities/syslog: open code cap_syslog logic to fix build failure |
| |
Quoting Eric Paris (eparis@redhat.com): > @@ -274,7 +274,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) > char c; > int error = 0; > > - error = security_syslog(type, from_file); > + /* > + * If this is from /proc/kmsg we only do the capabilities checks > + * at open time. > + */ > + if (type == SYSLOG_ACTION_OPEN || !from_file) { > + if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
Any chance we could introduce a new capability for this?
thanks, -serge
| |