Re: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n

[Kees Cook <kees.cook@canonical.com>]

On Sat, Nov 13, 2010 at 09:50:22AM -0800, Linus Torvalds wrote:
> So I would suggest guarding the whole thing, and just returning 0 if
> CONFIG_PRINTK isn't set. Or preferably just move the dmesg_restrict
> test into do_syslog, and stop playing stupid games with
> "security_syslog()", which actually goes away if you disable the you
> disable CONFIG_SECURITY.
> 
> SECURITY_DMESG_RESTRICT is totally independent of CONFIG_SECURITY, so
> doing it in security_syslog() was a bug to begin with.
> 
> Or we should make SECURITY_DMESG_RESTRICT _depend_ on CONFIG_SECURITY,
> and move it entirely into security/commoncap.c, and not pollute
> kernel/printk.c at all with it.

It seems saner to put it in commoncaps to me, but either way, it must happen
after the from_file and OPEN test or it will break /proc/kmesg readers who
open and drop privs (as done with sysklogd, etc).

> +	if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
>...
>  {
>  	if (type != SYSLOG_ACTION_OPEN && from_file)
>  		return 0;
> -	if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
> -		return -EPERM;

i.e.

if (dmesg_restrict && (!from_file || type == SYSLOG_ACTION_OPEN) &&
    !capable(CAP_SYS_ADMIN))

-Kees

-- 
Kees Cook
Ubuntu Security Team