From: "Serge E. Hallyn" <serge@hallyn.com>
To: Kees Cook <keescook@chromium.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
linux-kernel@vger.kernel.org, PhillipLougherplougher@redhat.com,
Andrew Morton <akpm@linux-foundation.org>,
Richard Weinberger <richard@nod.at>,
Greg Kroah-Hartman <greg@kroah.com>,
Dan Rosenberg <drosenberg@vsecurity.com>,
Eugene Teo <eteo@redhat.com>, Eric Paris <eparis@redhat.com>,
James Morris <jmorris@namei.org>
Subject: Re: [PATCH] sysctl: fix write access to dmesg_restrict/kptr_restrict
Date: Wed, 4 Apr 2012 21:27:50 +0000 [thread overview]
Message-ID: <20120404212750.GA29394@mail.hallyn.com> (raw)
In-Reply-To: <20120404184019.GA32681@www.outflux.net>
Quoting Kees Cook (keescook@chromium.org):
> Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
> however, it incorrectly alters kptr_restrict rather than
> dmesg_restrict.
>
> The original patch from Richard Weinberger
> (https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
> expected, and so the patch seems to have been misapplied.
>
> This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
> kptr_restrict, since both are sensitive.
>
> Reported-by: Phillip Lougher <plougher@redhat.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
> Cc: stable@vger.kernel.org
> ---
> kernel/sysctl.c | 8 ++++----
> 1 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index 52b3a06..4ab1187 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -170,7 +170,7 @@ static int proc_taint(struct ctl_table *table, int write,
> #endif
>
> #ifdef CONFIG_PRINTK
> -static int proc_dmesg_restrict(struct ctl_table *table, int write,
> +static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
> void __user *buffer, size_t *lenp, loff_t *ppos);
> #endif
>
> @@ -703,7 +703,7 @@ static struct ctl_table kern_table[] = {
> .data = &dmesg_restrict,
> .maxlen = sizeof(int),
> .mode = 0644,
> - .proc_handler = proc_dointvec_minmax,
> + .proc_handler = proc_dointvec_minmax_sysadmin,
> .extra1 = &zero,
> .extra2 = &one,
> },
> @@ -712,7 +712,7 @@ static struct ctl_table kern_table[] = {
> .data = &kptr_restrict,
> .maxlen = sizeof(int),
> .mode = 0644,
> - .proc_handler = proc_dmesg_restrict,
> + .proc_handler = proc_dointvec_minmax_sysadmin,
> .extra1 = &zero,
> .extra2 = &two,
> },
> @@ -1943,7 +1943,7 @@ static int proc_taint(struct ctl_table *table, int write,
> }
>
> #ifdef CONFIG_PRINTK
> -static int proc_dmesg_restrict(struct ctl_table *table, int write,
> +static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
> void __user *buffer, size_t *lenp, loff_t *ppos)
> {
> if (write && !capable(CAP_SYS_ADMIN))
> --
> 1.7.0.4
>
> --
> Kees Cook
> Chrome OS Security
next prev parent reply other threads:[~2012-04-04 21:27 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-30 23:43 [PATCH] sysctl: fix restrict write access to dmesg_restrict Phillip Lougher
2012-03-30 23:50 ` Richard Weinberger
2012-03-31 0:55 ` Andrew Morton
2012-03-31 1:58 ` Phillip Lougher
2012-03-31 16:13 ` Greg Kroah-Hartman
2012-04-01 2:10 ` Kees Cook
2012-04-04 2:30 ` Serge E. Hallyn
2012-04-04 18:40 ` [PATCH] sysctl: fix write access to dmesg_restrict/kptr_restrict Kees Cook
2012-04-04 19:07 ` Richard Weinberger
2012-04-04 21:27 ` Serge E. Hallyn [this message]
2012-04-04 21:43 ` Kees Cook
2012-04-05 5:11 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120404212750.GA29394@mail.hallyn.com \
--to=serge@hallyn.com \
--cc=PhillipLougherplougher@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=drosenberg@vsecurity.com \
--cc=eparis@redhat.com \
--cc=eteo@redhat.com \
--cc=greg@kroah.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=richard@nod.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox