Messages in this thread | ![/](/images/icornerl.gif) | | Date | Tue, 9 Nov 2010 15:20:44 +0100 | From | Ingo Molnar <> | Subject | Re: [PATCH] Restrict unprivileged access to kernel syslog |
| |
* Arjan van de Ven <arjan@infradead.org> wrote:
> On Tue, 09 Nov 2010 07:11:12 -0500 > Dan Rosenberg <drosenberg@vsecurity.com> wrote: > > > > > > > > > The initialization to zero is implicit, no need to write it out. > > > > > > > I'll resend after the first round of comments. > > > > > Also, it would also be useful to have a > > > CONFIG_SECURITY_RESTRICT_DMESG=y option introduced by your patch as > > > well, which flag allows a distro or user to disable unprivileged > > > syslog reading via the kernel config. > > > > Are you suggesting having the existence of the sysctl depend on > > CONFIG_SECURITY_RESTRICT_DMESG, or having a choice between a sysctl (when config > > is disabled) and having restrictions always on (when config is enabled)? > > and/or have the sysctl default value depend on the config option
Yeah. I think we should have the sysctl unconditionally as in Dan's current patch - and make the default depend on the Kconfig setting (defaulting to off).
I.e. essentially the same as the current patch, just a bit more configurability via the Kconfig setting.
Thanks,
Ingo
| ![\](/images/icornerr.gif) |