From: Vasily Averin <vvs@odin.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, Kees Cook <keescook@chromium.org>,
Josh Boyer <jwboyer@redhat.com>, Eric Paris <eparis@redhat.com>
Subject: Re: [PATCH] kernel/printk/printk.c: check_syslog_permissions() cleanup
Date: Fri, 15 May 2015 12:22:06 +0300 [thread overview]
Message-ID: <5555BABE.2090705@odin.com> (raw)
In-Reply-To: <5555A33E.5070403@odin.com>
On 15.05.2015 10:41, Vasily Averin wrote:
> On 15.05.2015 01:01, Andrew Morton wrote:
>> On Sun, 10 May 2015 09:35:53 +0300 Vasily Averin <vvs@odin.com> wrote:
>>
>>> Fixes: 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg")
>>>
>>> Final version of patch 637241a900cb ("kmsg: honor dmesg_restrict sysctl
>>> on /dev/kmsg") lost few hooks. As result security_syslog() is not checked
>>> inside check_syslog_permissions() if dmesg_restrict is set,
>>> or it can be called twice in do_syslog().
>>
>> I'm not seeing how security_syslog() is called twice from do_syslog().
>> Put more details in the changelog, please.
>
> For example, if dmesg_restrict is not set and SYSLOG_ACTION_OPEN is requested.
no, SYSLOG_ACTION_OPEN does not fit.
syslog_action_restricted() should return 0,
so it should be SYSLOG_ACTION_READ_ALL or SYSLOG_ACTION_SIZE_BUFFER commands
and from_file should be set to SYSLOG_FROM_READER.
> In this case do_syslog() calls check_syslog_permissions()
> where security_syslog() is called first time and approves the operation,
> then do_syslog() itself calls security_syslog() 2nd time.
>
next prev parent reply other threads:[~2015-05-15 9:23 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-10 6:35 [PATCH] kernel/printk/printk.c: check_syslog_permissions() cleanup Vasily Averin
2015-05-14 22:01 ` Andrew Morton
2015-05-15 7:41 ` Vasily Averin
2015-05-15 9:22 ` Vasily Averin [this message]
2015-05-24 16:09 ` Vasily Averin
2015-05-24 16:18 ` [PATCH v2] security_syslog() should be called once only Vasily Averin
2015-05-27 23:43 ` Andrew Morton
2015-05-30 13:51 ` Vasily Averin
2015-06-01 21:23 ` Andrew Morton
2015-06-02 7:57 ` Vasily Averin
2015-05-30 13:51 ` [PATCH] check_syslog_permissions() cleanup Vasily Averin
2015-06-04 17:00 ` [PATCH v2] security_syslog() should be called once only Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5555BABE.2090705@odin.com \
--to=vvs@odin.com \
--cc=akpm@linux-foundation.org \
--cc=eparis@redhat.com \
--cc=jwboyer@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.