Messages in this thread | | | Subject | Re: [PATCH] Restrict unprivileged access to kernel syslog | From | "Dan Rosenberg" <> | Date | Tue, 9 Nov 2010 14:25:21 +0000 |
| |
I agree with this. Unless anyone else has any suggestions, I'll get this ready tonight.
-Dan
------Original Message------ From: Ingo Molnar To: Arjan van de Ven Cc: Dan Rosenberg Cc: linux-kernel@vger.kernel.org Cc: security@kernel.org Cc: stable@kernel.org Cc: Andrew Morton Subject: Re: [PATCH] Restrict unprivileged access to kernel syslog Sent: Nov 9, 2010 9:20 AM
* Arjan van de Ven <arjan@infradead.org> wrote:
> On Tue, 09 Nov 2010 07:11:12 -0500 > Dan Rosenberg <drosenberg@vsecurity.com> wrote: > > > > > > > > > The initialization to zero is implicit, no need to write it out. > > > > > > > I'll resend after the first round of comments. > > > > > Also, it would also be useful to have a > > > CONFIG_SECURITY_RESTRICT_DMESG=y option introduced by your patch as > > > well, which flag allows a distro or user to disable unprivileged > > > syslog reading via the kernel config. > > > > Are you suggesting having the existence of the sysctl depend on > > CONFIG_SECURITY_RESTRICT_DMESG, or having a choice between a sysctl (when config > > is disabled) and having restrictions always on (when config is enabled)? > > and/or have the sysctl default value depend on the config option
Yeah. I think we should have the sysctl unconditionally as in Dan's current patch - and make the default depend on the Kconfig setting (defaulting to off).
I.e. essentially the same as the current patch, just a bit more configurability via the Kconfig setting.
Thanks,
Ingo
| |