Eric Lee / smarc-fsl-linux-kernel

26 Jun, 2015

1 commit

  • 3ea4331c6   check_syslog_permissions() cleanup ... Browse Code »

    Patch fixes drawbacks in heck_syslog_permissions() noticed by AKPM:
    "from_file handling makes me cry.

    That's not a boolean - it's an enumerated value with two values
    currently defined.

    But the code in check_syslog_permissions() treats it as a boolean and
    also hardwires the knowledge that SYSLOG_FROM_PROC == 1 (or == `true`).

    And the name is wrong: it should be called from_proc to match
    SYSLOG_FROM_PROC."

    Signed-off-by: Vasily Averin
    Cc: Kees Cook
    Cc: Josh Boyer
    Cc: Eric Paris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vasily Averin
     

18 Nov, 2014

1 commit

  • 069fb0b63   syslog: Provide stub check_syslog_permissions ... Browse Code »

    When building without CONFIG_PRINTK, we need to provide a stub
    check_syslog_permissions. As there is no way to turn on the
    dmesg_restrict sysctl without CONFIG_PRINTK, return success.

    Reported-by: Jim Davis
    Signed-off-by: Sebastian Schmidt
    Acked-by: Kees Cook
    Signed-off-by: Tony Luck

    Sebastian Schmidt
     

06 Nov, 2014

1 commit

  • 68c4a4f8a   pstore: Honor dmesg_restrict sysctl on dmesg dumps ... Browse Code »

    When the kernel.dmesg_restrict restriction is in place, only users with
    CAP_SYSLOG should be able to access crash dumps (like: attacker is
    trying to exploit a bug, watchdog reboots, attacker can happily read
    crash dumps and logs).

    This puts the restriction on console-* types as well as sensitive
    information could have been leaked there.

    Other log types are unaffected.

    Signed-off-by: Sebastian Schmidt
    Acked-by: Kees Cook
    Signed-off-by: Tony Luck

    Sebastian Schmidt
     

13 Jun, 2013

1 commit

  • 637241a90   kmsg: honor dmesg_restrict sysctl on /dev/kmsg ... Browse Code »

    The dmesg_restrict sysctl currently covers the syslog method for access
    dmesg, however /dev/kmsg isn't covered by the same protections. Most
    people haven't noticed because util-linux dmesg(1) defaults to using the
    syslog method for access in older versions. With util-linux dmesg(1)
    defaults to reading directly from /dev/kmsg.

    To fix /dev/kmsg, let's compare the existing interfaces and what they
    allow:

    - /proc/kmsg allows:
    - open (SYSLOG_ACTION_OPEN) if CAP_SYSLOG since it uses a destructive
    single-reader interface (SYSLOG_ACTION_READ).
    - everything, after an open.

    - syslog syscall allows:
    - anything, if CAP_SYSLOG.
    - SYSLOG_ACTION_READ_ALL and SYSLOG_ACTION_SIZE_BUFFER, if
    dmesg_restrict==0.
    - nothing else (EPERM).

    The use-cases were:
    - dmesg(1) needs to do non-destructive SYSLOG_ACTION_READ_ALLs.
    - sysklog(1) needs to open /proc/kmsg, drop privs, and still issue the
    destructive SYSLOG_ACTION_READs.

    AIUI, dmesg(1) is moving to /dev/kmsg, and systemd-journald doesn't
    clear the ring buffer.

    Based on the comments in devkmsg_llseek, it sounds like actions besides
    reading aren't going to be supported by /dev/kmsg (i.e.
    SYSLOG_ACTION_CLEAR), so we have a strict subset of the non-destructive
    syslog syscall actions.

    To this end, move the check as Josh had done, but also rename the
    constants to reflect their new uses (SYSLOG_FROM_CALL becomes
    SYSLOG_FROM_READER, and SYSLOG_FROM_FILE becomes SYSLOG_FROM_PROC).
    SYSLOG_FROM_READER allows non-destructive actions, and SYSLOG_FROM_PROC
    allows destructive actions after a capabilities-constrained
    SYSLOG_ACTION_OPEN check.

    - /dev/kmsg allows:
    - open if CAP_SYSLOG or dmesg_restrict==0
    - reading/polling, after open

    Addresses https://bugzilla.redhat.com/show_bug.cgi?id=903192

    [akpm@linux-foundation.org: use pr_warn_once()]
    Signed-off-by: Kees Cook
    Reported-by: Christian Kujau
    Tested-by: Josh Boyer
    Cc: Kay Sievers
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kees Cook
     

04 Feb, 2010

2 commits

  • d78ca3cd7   syslog: use defined constants instead of raw numbers ... Browse Code »

    Right now the syslog "type" action are just raw numbers which makes
    the source difficult to follow. This patch replaces the raw numbers
    with defined constants for some level of sanity.

    Signed-off-by: Kees Cook
    Acked-by: John Johansen
    Acked-by: Serge Hallyn
    Signed-off-by: James Morris

    Kees Cook
     
  • 002345925   syslog: distinguish between /proc/kmsg and syscalls ... Browse Code »

    This allows the LSM to distinguish between syslog functions originating
    from /proc/kmsg access and direct syscalls. By default, the commoncaps
    will now no longer require CAP_SYS_ADMIN to read an opened /proc/kmsg
    file descriptor. For example the kernel syslog reader can now drop
    privileges after opening /proc/kmsg, instead of staying privileged with
    CAP_SYS_ADMIN. MAC systems that implement security_syslog have unchanged
    behavior.

    Signed-off-by: Kees Cook
    Acked-by: Serge Hallyn
    Acked-by: John Johansen
    Signed-off-by: James Morris

    Kees Cook