Messages in this thread | | | Date | Thu, 18 Nov 2010 12:08:38 -0800 | From | Kees Cook <> | Subject | Re: [PATCH] capabilities/syslog: open code cap_syslog logic to fix build failure |
| |
Hi Serge,
On Thu, Nov 18, 2010 at 08:26:24AM -0600, Serge E. Hallyn wrote: > Quoting Eric Paris (eparis@redhat.com): > > @@ -274,7 +274,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) > > char c; > > int error = 0; > > > > - error = security_syslog(type, from_file); > > + /* > > + * If this is from /proc/kmsg we only do the capabilities checks > > + * at open time. > > + */ > > + if (type == SYSLOG_ACTION_OPEN || !from_file) { > > + if (dmesg_restrict && !capable(CAP_SYS_ADMIN)) > > Any chance we could introduce a new capability for this?
Wasn't there talk of creating CAP_SYSLOG or something? Right now most sysklogd implementations are just starting life as root, so making this change now shouldn't break anyone.
-Kees
-- Kees Cook Ubuntu Security Team
| |