Kees Cook 637241a900
kmsg: honor dmesg_restrict sysctl on /dev/kmsg ...
The dmesg_restrict sysctl currently covers the syslog method for access
dmesg, however /dev/kmsg isn't covered by the same protections. Most
people haven't noticed because util-linux dmesg(1) defaults to using the
syslog method for access in older versions. With util-linux dmesg(1)
defaults to reading directly from /dev/kmsg.
To fix /dev/kmsg, let's compare the existing interfaces and what they
allow:
- /proc/kmsg allows:
- open (SYSLOG_ACTION_OPEN) if CAP_SYSLOG since it uses a destructive
single-reader interface (SYSLOG_ACTION_READ).
- everything, after an open.
- syslog syscall allows:
- anything, if CAP_SYSLOG.
- SYSLOG_ACTION_READ_ALL and SYSLOG_ACTION_SIZE_BUFFER, if
dmesg_restrict==0.
- nothing else (EPERM).
The use-cases were:
- dmesg(1) needs to do non-destructive SYSLOG_ACTION_READ_ALLs.
- sysklog(1) needs to open /proc/kmsg, drop privs, and still issue the
destructive SYSLOG_ACTION_READs.
AIUI, dmesg(1) is moving to /dev/kmsg, and systemd-journald doesn't
clear the ring buffer.
Based on the comments in devkmsg_llseek, it sounds like actions besides
reading aren't going to be supported by /dev/kmsg (i.e.
SYSLOG_ACTION_CLEAR), so we have a strict subset of the non-destructive
syslog syscall actions.
To this end, move the check as Josh had done, but also rename the
constants to reflect their new uses (SYSLOG_FROM_CALL becomes
SYSLOG_FROM_READER, and SYSLOG_FROM_FILE becomes SYSLOG_FROM_PROC).
SYSLOG_FROM_READER allows non-destructive actions, and SYSLOG_FROM_PROC
allows destructive actions after a capabilities-constrained
SYSLOG_ACTION_OPEN check.
- /dev/kmsg allows:
- open if CAP_SYSLOG or dmesg_restrict==0
- reading/polling, after open
Addresses https://bugzilla.redhat.com/show_bug.cgi?id=903192
[akpm@linux-foundation.org: use pr_warn_once()]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Christian Kujau <lists@nerdbynature.de>
Tested-by: Josh Boyer <jwboyer@redhat.com>
Cc: Kay Sievers <kay@vrfy.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-06-12 16:29:44 -07:00
2013-03-29 09:20:05 -07:00
2013-05-17 14:31:05 -04:00
2013-01-28 18:17:25 -05:00
2013-05-02 11:58:41 -05:00
2013-05-04 12:31:18 -07:00
2013-01-30 07:54:34 -06:00
2013-02-13 08:35:43 -08:00
2013-01-03 15:41:20 +01:00
2013-03-01 13:39:00 -08:00
2013-04-08 16:36:23 +02:00
2013-04-30 09:36:50 -07:00
2013-05-05 17:36:20 -07:00
2013-04-11 03:39:00 -07:00
2013-02-28 18:02:55 -08:00
2013-05-17 00:42:33 +02:00
2013-05-11 16:12:44 -07:00
2013-05-06 15:41:42 -07:00
2013-05-09 10:15:46 -07:00
2013-04-29 20:09:03 +02:00
2012-11-30 12:01:30 -05:00
2013-02-13 06:16:08 -08:00
2013-05-14 13:40:45 +02:00
2013-05-25 20:30:31 -07:00
2013-04-16 17:38:10 -07:00
2013-01-02 17:36:10 -08:00
2013-04-28 02:13:43 +01:00
2013-02-22 09:20:11 -08:00
2013-05-13 18:27:18 +04:00
2013-04-23 14:09:39 -04:00
2013-04-29 16:23:34 -04:00
2013-05-16 17:32:21 -07:00
2013-05-14 10:23:57 +05:30
2013-04-12 00:31:18 +02:00
2013-04-30 15:21:02 -07:00
2013-05-30 10:51:20 -07:00
2013-05-07 19:46:02 -07:00
2012-12-14 13:06:41 +10:30
2013-03-12 13:59:14 -07:00
2013-01-03 15:57:16 -08:00
2013-04-03 19:33:40 -04:00
2012-12-10 15:49:57 -05:00
2012-12-02 00:05:12 +00:00
2013-05-07 22:27:15 -04:00
2013-04-01 19:08:06 -07:00
2012-12-17 17:15:16 -08:00
2012-12-11 17:22:26 -08:00
2013-04-10 23:41:16 +02:00
2013-03-01 12:47:16 +01:00
2013-04-29 15:40:23 -04:00
2013-03-23 14:26:34 -07:00
2013-05-08 10:13:35 -07:00
2013-05-08 10:13:35 -07:00
2013-04-18 09:00:26 -07:00
2013-02-15 18:52:45 -08:00
2013-04-29 15:54:39 -07:00
2013-05-15 14:42:15 -07:00
2012-12-06 14:33:02 +01:00
2013-02-20 09:37:28 -05:00
2013-05-01 08:04:12 -07:00
2013-02-21 17:22:16 -08:00
2013-04-14 10:06:31 -07:00
2013-03-23 16:11:31 -07:00
2013-05-24 10:50:24 +09:00
2013-04-30 17:04:01 -07:00
2013-03-22 15:18:18 -07:00
2013-04-12 11:22:35 -07:00
2013-04-10 16:33:53 -07:00
2013-04-30 15:21:02 -07:00
2013-05-02 09:03:55 -07:00
2013-03-20 13:23:21 -04:00
2013-02-13 06:00:53 -08:00
2013-02-23 17:50:10 -08:00
2013-05-09 13:46:38 -04:00
2013-02-21 17:22:15 -08:00
2013-04-29 18:28:13 -07:00
2013-02-21 17:22:15 -08:00
2012-12-06 01:22:31 +00:00
2013-04-08 17:28:34 +02:00
2013-02-15 16:45:06 +01:00
2013-04-29 18:28:13 -07:00
2013-03-07 17:10:11 +01:00
2012-11-29 00:01:25 -05:00
2013-04-27 09:25:59 +08:00
2013-01-11 14:54:54 -08:00
2013-06-12 16:29:44 -07:00
2013-04-02 15:24:00 +02:00
2013-05-11 15:23:17 -07:00
2013-03-12 11:30:04 -07:00
2013-05-01 17:51:54 -07:00
2013-01-09 08:26:53 -08:00
2013-04-29 18:28:19 -07:00
2013-02-26 02:46:09 -05:00
2013-04-29 15:54:27 -07:00
2013-01-18 15:25:53 -08:00
2013-04-02 01:28:41 +02:00
2013-05-10 14:37:17 +01:00
2013-05-01 13:20:04 -07:00
2013-03-01 22:45:49 +00:00
2012-11-29 03:30:34 -08:00
2013-05-01 16:36:22 +05:30
2012-12-11 09:28:09 +01:00
2013-05-02 21:52:26 +05:30
2013-04-30 17:04:02 -07:00
2013-03-22 22:18:09 -06:00
2013-03-28 10:10:25 -06:00
2012-12-24 09:36:38 -07:00
2013-02-28 09:53:21 +05:30
2013-01-17 12:19:09 -08:00
2013-03-03 23:59:59 -08:00
2013-03-16 06:32:30 +01:00
2013-04-30 16:03:10 +01:00
2013-02-28 12:52:24 -08:00
2013-02-26 02:46:08 -05:00
2013-05-07 18:38:27 -07:00
2013-01-21 14:07:44 -05:00
2013-02-27 19:10:23 -08:00
2013-03-27 13:48:25 +01:00
2013-03-15 15:09:43 +10:30
2013-04-29 18:28:40 -07:00
2012-11-22 13:43:27 +09:00
2013-03-18 21:00:35 +09:00
2013-02-20 01:33:41 +01:00
2013-05-01 17:31:42 -04:00
2013-05-01 16:28:48 -04:00
2013-02-23 17:50:12 -08:00
2013-03-31 11:38:33 -07:00
2013-04-30 17:04:00 -07:00
2013-03-27 07:49:29 -07:00
2013-05-07 02:16:31 -04:00
2012-12-20 22:34:00 +00:00
2012-12-20 22:04:07 +00:00
2012-11-26 13:41:19 -06:00
2013-04-29 18:28:41 -07:00
2013-02-22 23:31:31 -05:00
2013-05-09 20:14:25 -04:00
2013-05-09 20:10:22 -04:00
2013-04-29 18:28:13 -07:00
2013-02-26 03:10:52 +11:00
2012-12-18 15:02:12 -08:00
2013-04-11 10:00:05 +08:00
2013-04-16 18:47:14 +09:00
2013-02-22 00:05:07 +01:00
2013-03-18 10:21:23 +01:00
2013-02-27 19:10:24 -08:00
2013-02-22 08:20:05 +01:00
2013-04-30 10:09:06 +02:00
2013-01-06 11:48:11 +00:00
2013-01-06 11:41:12 +00:00
2013-05-06 13:07:33 +02:00
2013-02-23 17:50:16 -08:00
2013-03-22 16:19:59 -07:00
2013-04-29 15:54:38 -07:00
2012-12-18 15:02:15 -08:00
2013-05-07 18:38:27 -07:00
2013-01-25 21:03:54 -08:00
2013-04-29 15:54:26 -07:00
2013-04-02 07:07:32 +02:00
2012-11-28 11:36:32 +01:00
2013-04-02 07:06:17 +02:00
2013-04-29 13:54:36 -04:00
2013-05-08 11:51:05 -07:00
2013-04-16 15:29:45 +02:00
2013-03-26 12:32:13 -04:00
2013-02-06 15:59:47 -05:00
2013-03-06 14:55:20 -05:00
2013-04-21 15:56:59 -04:00
2013-03-27 13:48:25 +01:00
2013-02-11 14:16:26 -05:00
2013-01-29 13:59:57 -05:00
2013-02-19 08:06:01 +01:00
2013-01-23 09:31:01 -08:00
2013-03-27 13:48:25 +01:00
2013-01-11 14:54:54 -08:00
2013-05-02 12:10:19 +02:00
2013-04-29 15:54:37 -07:00
2012-12-09 00:20:28 -05:00
2013-03-15 12:23:09 -07:00
2013-05-01 08:12:58 -07:00
2013-02-27 19:10:21 -08:00
2013-01-30 22:41:13 -05:00
2013-03-22 16:41:19 -07:00
2013-01-28 12:17:25 +01:00
2013-01-10 11:44:38 -06:00
2013-04-19 17:49:23 -04:00
2013-04-25 15:25:23 +02:00
2013-03-22 16:20:00 -07:00
2013-05-13 09:45:01 -04:00
2013-04-29 15:42:02 -04:00
2013-01-27 19:23:27 +01:00
2013-05-24 16:22:51 -07:00
2013-04-17 12:35:33 -07:00
2012-12-16 15:40:50 -08:00
2013-02-04 15:35:26 -08:00
2013-04-30 17:04:06 -07:00
2012-11-28 10:33:03 -08:00
2013-04-08 17:28:34 +02:00
2013-05-16 07:55:07 -07:00
2013-02-23 17:50:19 -08:00
2013-04-30 17:04:02 -07:00
2013-04-19 16:39:13 -04:00
2013-05-05 14:47:31 -07:00
2013-04-07 13:05:35 +03:00
2013-02-01 17:47:04 -08:00
2013-04-01 11:04:50 -07:00
2013-04-03 19:33:43 -04:00
2013-01-06 01:11:25 -08:00
2013-05-05 10:58:06 -07:00
2013-03-12 14:07:41 -07:00
2013-05-31 17:31:52 -07:00
2013-02-19 15:17:08 -05:00
2013-02-22 19:25:09 -08:00
2012-11-30 11:48:05 +01:00
2013-03-22 22:17:36 -06:00
2013-02-20 19:36:01 +01:00
2013-02-02 00:01:15 +01:00
2013-04-30 19:13:05 +02:00
2013-04-15 14:06:39 +00:00
2013-04-08 16:57:15 -07:00
2013-03-02 09:34:39 -08:00
2013-02-23 17:50:20 -08:00
2013-04-29 15:54:37 -07:00
2013-04-30 17:04:00 -07:00
2013-01-02 17:32:13 -08:00
2013-03-12 06:50:58 -04:00
2013-02-23 17:50:19 -08:00
2012-12-01 10:07:54 +00:00
2013-02-23 17:50:17 -08:00
2013-05-07 18:38:26 -07:00
2013-03-28 17:45:51 -07:00
2013-02-05 20:38:48 +11:00
2013-04-30 09:36:50 -07:00
2013-03-29 08:35:47 -07:00
2013-03-15 15:09:43 +10:30
2012-12-14 13:06:40 +10:30
2013-03-27 07:50:04 -07:00
2013-01-21 13:55:14 -05:00
2013-01-21 13:55:14 -05:00
2013-01-04 16:11:45 -08:00
2013-04-23 09:50:30 -06:00
2013-04-19 09:33:36 +02:00
2013-03-22 10:25:15 -04:00
2012-12-25 18:45:06 -05:00
2013-04-29 18:28:44 -07:00
2013-05-02 07:34:58 -07:00
2013-05-16 15:02:01 -07:00
2013-05-23 11:58:55 +02:00
2013-04-05 21:08:11 +02:00
2013-04-19 14:57:58 -04:00
2013-05-01 15:00:24 -04:00
2013-02-13 06:16:06 -08:00
2013-04-14 12:59:28 -04:00
2013-04-08 22:12:33 -04:00
2013-02-13 06:15:29 -08:00
2013-05-06 17:24:22 -04:00
2012-12-11 17:22:27 -08:00
2012-12-12 17:38:34 -08:00
2013-04-29 15:54:36 -07:00
2013-01-17 19:11:14 -08:00
2013-05-04 14:47:26 -04:00
2013-05-08 09:55:05 -04:00
2012-11-23 22:01:15 +00:00
2013-05-02 21:50:38 +05:30
2013-02-13 10:11:53 +00:00
2012-12-11 17:30:16 +00:00
2013-04-02 16:43:09 -04:00
2013-04-09 14:58:32 -05:00
2013-05-07 11:22:14 -07:00
2012-11-30 08:41:50 -08:00
2012-12-11 17:22:27 -08:00
2013-03-29 17:54:33 -07:00
2013-02-23 00:30:08 +01:00
2013-02-23 17:50:17 -08:00
2013-02-14 15:55:23 +01:00
2013-02-23 17:50:15 -08:00
2013-04-29 15:54:28 -07:00
2013-04-19 22:25:51 +02:00
2013-03-01 23:51:07 -05:00
2013-04-17 10:21:17 -06:00
2013-05-02 07:32:24 -07:00
2013-05-17 14:12:06 -06:00
2013-04-17 10:21:17 -06:00
2013-04-17 10:21:17 -06:00
2013-05-01 14:08:52 -07:00
2013-04-17 10:21:17 -06:00
2013-02-05 11:54:06 +01:00
2012-12-17 17:15:18 -08:00
2013-05-02 17:54:19 +02:00
2013-03-12 11:40:53 -04:00
2013-05-07 20:16:25 -07:00
2013-02-27 19:10:24 -08:00
2013-04-09 14:13:02 -04:00
2013-03-29 09:14:16 -07:00
2013-03-07 12:35:51 +08:00
2013-02-23 17:50:16 -08:00
2013-03-19 09:47:30 +01:00
2013-05-05 13:23:27 -07:00
2013-04-16 18:51:16 -07:00
2013-02-13 09:40:35 -08:00
2013-04-09 10:48:33 -07:00
2013-05-22 01:34:24 +02:00
2013-05-01 17:29:47 -04:00
2013-05-01 17:29:39 -04:00
2013-04-09 14:13:35 -04:00
2013-04-03 21:50:00 -07:00
2013-01-11 10:20:50 -08:00
2013-01-20 12:26:05 -08:00
2012-11-27 23:29:12 -02:00
2013-02-26 09:34:29 -08:00
2013-02-08 13:14:40 +00:00
2013-01-24 23:24:56 -05:00
2013-04-29 15:54:28 -07:00
2013-05-07 18:38:27 -07:00
2013-01-11 14:54:56 -08:00
2013-03-12 14:07:41 -07:00
2013-06-02 20:53:59 -07:00
2013-05-28 22:47:13 -04:00
2013-05-28 22:47:13 -04:00
2013-03-27 13:03:39 +00:00
2013-04-30 17:04:09 -07:00
2013-04-07 14:06:17 +03:00
2013-04-29 19:14:20 -07:00
2013-04-12 10:26:23 +02:00
2013-04-12 10:26:23 +02:00
2013-03-15 00:34:50 -04:00
2013-05-24 16:22:50 -07:00
2013-05-24 16:22:50 -07:00
2013-02-23 17:50:17 -08:00
2013-04-29 18:28:22 -07:00
2013-03-07 15:29:45 -05:00
2013-03-23 15:53:52 -07:00
2013-05-02 19:40:34 -07:00
2013-05-11 14:29:11 -07:00
2013-04-09 13:19:39 -04:00
2013-04-30 16:27:51 -07:00
2013-04-09 14:13:29 -04:00
2013-02-19 08:43:34 +01:00
2013-01-15 23:03:00 -08:00
2013-02-13 10:13:58 -08:00
2013-04-11 13:14:36 -07:00
2013-03-29 15:31:30 -04:00
2012-12-11 17:22:25 -08:00
2013-05-01 17:51:54 -07:00
2013-05-31 17:06:07 -07:00
2013-05-06 09:24:16 +03:00
2013-02-06 20:32:13 +02:00
2013-02-01 12:32:09 +02:00
2013-04-30 17:04:03 -07:00
2013-02-26 22:25:17 +01:00
2012-12-07 12:48:00 -05:00
2013-04-29 13:21:30 -04:00
2013-06-06 11:52:14 -07:00
2013-04-09 10:48:33 -07:00
2013-02-07 15:15:00 -08:00
2013-03-25 10:39:40 -07:00
2012-12-13 12:00:02 -08:00
2013-03-01 12:40:36 +01:00
2013-04-30 17:04:03 -07:00
2012-12-17 17:15:17 -08:00
2013-04-30 15:50:12 +05:30
2013-02-13 12:15:50 -08:00
2013-02-09 22:30:44 +01:00
2013-04-29 15:54:38 -07:00
2013-04-17 12:35:32 -07:00
2013-03-05 15:36:40 -05:00
2013-01-25 21:51:13 +01:00
2013-06-12 16:29:44 -07:00
2013-03-21 11:47:51 -04:00
2013-03-29 18:10:22 -06:00
2013-01-28 11:19:06 -07:00
2013-05-09 09:40:49 -07:00
2012-12-18 15:02:13 -08:00
2013-04-22 20:29:07 +02:00
2013-05-14 20:54:06 +02:00
2013-04-04 13:18:31 -07:00
2013-04-25 21:01:45 +08:00
2013-04-04 13:18:14 -07:00
2013-03-15 00:36:09 -04:00
2013-01-27 19:23:31 +01:00
2013-02-04 15:40:28 -08:00
2013-01-15 22:43:15 -08:00
2013-03-18 16:14:55 -07:00
2013-05-11 14:29:11 -07:00
2012-12-11 17:22:27 -08:00
2013-04-19 00:40:07 +02:00
2013-04-15 21:23:03 +01:00
2013-03-20 12:10:38 -04:00
2013-05-20 10:24:22 +09:30
2013-04-13 15:31:58 +02:00
2013-03-28 11:10:22 -07:00
2013-03-27 07:50:08 -07:00
2013-03-21 15:17:40 +00:00
2013-03-11 09:28:44 -06:00
2013-03-20 14:06:06 +10:30
2013-03-20 14:00:41 +10:30
2013-05-02 14:14:04 -07:00
2013-02-23 17:50:15 -08:00
2013-03-08 12:24:48 -05:00
2013-04-29 15:54:34 -07:00
2013-04-29 15:54:38 -07:00
2013-04-29 15:54:37 -07:00
2013-01-08 16:15:57 -08:00
2013-01-08 16:15:57 -08:00
2013-03-20 14:06:05 +10:30
2013-05-20 12:15:59 -07:00
2013-01-27 20:35:47 +01:00
2013-05-24 16:22:50 -07:00
2013-01-31 19:56:35 -05:00
2013-03-01 12:48:36 +01:00
2013-02-08 10:05:02 +02:00
2013-04-30 17:04:02 -07:00
2013-05-07 20:16:25 -07:00
637241a900