Commit 620f6e8e855d6d447688a5f67a4e176944a084e8

Authored by Kees Cook
Committed by James Morris
1 parent 6c216ec636

sysctl: fix write access to dmesg_restrict/kptr_restrict

Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
however, it incorrectly alters kptr_restrict rather than
dmesg_restrict.

The original patch from Richard Weinberger
(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
expected, and so the patch seems to have been misapplied.

This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
kptr_restrict, since both are sensitive.

Reported-by: Phillip Lougher <plougher@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Richard Weinberger <richard@nod.at>
Cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>

Showing 1 changed file with 4 additions and 4 deletions Side-by-side Diff

... ... @@ -170,7 +170,7 @@
170 170 #endif
171 171  
172 172 #ifdef CONFIG_PRINTK
173   -static int proc_dmesg_restrict(struct ctl_table *table, int write,
  173 +static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
174 174 void __user *buffer, size_t *lenp, loff_t *ppos);
175 175 #endif
176 176  
... ... @@ -703,7 +703,7 @@
703 703 .data = &dmesg_restrict,
704 704 .maxlen = sizeof(int),
705 705 .mode = 0644,
706   - .proc_handler = proc_dointvec_minmax,
  706 + .proc_handler = proc_dointvec_minmax_sysadmin,
707 707 .extra1 = &zero,
708 708 .extra2 = &one,
709 709 },
... ... @@ -712,7 +712,7 @@
712 712 .data = &kptr_restrict,
713 713 .maxlen = sizeof(int),
714 714 .mode = 0644,
715   - .proc_handler = proc_dmesg_restrict,
  715 + .proc_handler = proc_dointvec_minmax_sysadmin,
716 716 .extra1 = &zero,
717 717 .extra2 = &two,
718 718 },
... ... @@ -1943,7 +1943,7 @@
1943 1943 }
1944 1944  
1945 1945 #ifdef CONFIG_PRINTK
1946   -static int proc_dmesg_restrict(struct ctl_table *table, int write,
  1946 +static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
1947 1947 void __user *buffer, size_t *lenp, loff_t *ppos)
1948 1948 {
1949 1949 if (write && !capable(CAP_SYS_ADMIN))