From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Phillip Lougher <plougher@redhat.com>,
Kees Cook <keescook@chromium.org>,
Serge Hallyn <serge.hallyn@canonical.com>,
Richard Weinberger <richard@nod.at>,
James Morris <james.l.morris@oracle.com>
Subject: [ 44/59] sysctl: fix write access to dmesg_restrict/kptr_restrict
Date: Wed, 11 Apr 2012 16:11:19 -0700 [thread overview]
Message-ID: <20120411231042.946594604@linuxfoundation.org> (raw)
In-Reply-To: <20120411231213.GA13124@kroah.com>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 620f6e8e855d6d447688a5f67a4e176944a084e8 upstream.
Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
however, it incorrectly alters kptr_restrict rather than
dmesg_restrict.
The original patch from Richard Weinberger
(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
expected, and so the patch seems to have been misapplied.
This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
kptr_restrict, since both are sensitive.
Reported-by: Phillip Lougher <plougher@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sysctl.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -166,7 +166,7 @@ static int proc_taint(struct ctl_table *
#endif
#ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);
#endif
@@ -713,7 +713,7 @@ static struct ctl_table kern_table[] = {
.data = &dmesg_restrict,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec_minmax,
+ .proc_handler = proc_dointvec_minmax_sysadmin,
.extra1 = &zero,
.extra2 = &one,
},
@@ -722,7 +722,7 @@ static struct ctl_table kern_table[] = {
.data = &kptr_restrict,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dmesg_restrict,
+ .proc_handler = proc_dointvec_minmax_sysadmin,
.extra1 = &zero,
.extra2 = &two,
},
@@ -2422,7 +2422,7 @@ static int proc_taint(struct ctl_table *
}
#ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
if (write && !capable(CAP_SYS_ADMIN))
next prev parent reply other threads:[~2012-04-11 23:11 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-11 23:12 [ 00/59] 3.2.15-stable review Greg KH
2012-04-11 23:10 ` [ 01/59] x86 bpf_jit: fix a bug in emitting the 16-bit immediate operand of AND Greg KH
2012-04-11 23:10 ` [ 02/59] tg3: Fix 5717 serdes powerdown problem Greg KH
2012-04-11 23:10 ` [ 03/59] sky2: dont overwrite settings for PHY Quick link Greg KH
2012-04-11 23:10 ` [ 04/59] rose_dev: fix memcpy-bug in rose_set_mac_address Greg KH
2012-04-11 23:10 ` [ 05/59] net: usb: cdc_eem: fix mtu Greg KH
2012-04-11 23:10 ` [ 06/59] Fix non TBI PHY access; a bad merge undid bug fix in a previous commit Greg KH
2012-04-12 4:55 ` Ben Hutchings
[not found] ` <OFFBE17A27.42E05B7A-ONC12579DE.00262282-C12579DE.0026AD98@transmode.se>
2012-04-12 15:02 ` Ben Hutchings
2012-04-16 0:16 ` Paul Gortmaker
2012-04-16 0:32 ` Ben Hutchings
2012-04-11 23:10 ` [ 07/59] ASoC: wm8994: Update WM8994 DCS calibration Greg KH
2012-04-11 23:10 ` [ 08/59] mtd: ixp4xx: oops in ixp4xx_flash_probe Greg KH
2012-04-11 23:10 ` [ 09/59] mtd: mips: lantiq: reintroduce support for cmdline partitions Greg KH
2012-04-11 23:10 ` [ 10/59] mtd: nand: gpmi: use correct member for checking NAND_BBT_USE_FLASH Greg KH
2012-04-11 23:10 ` [ 11/59] mtd: sst25l: initialize writebufsize Greg KH
2012-04-11 23:10 ` [ 12/59] mtd: block2mtd: " Greg KH
2012-04-11 23:10 ` [ 13/59] mtd: lart: " Greg KH
2012-04-11 23:10 ` [ 14/59] mtd: m25p80: set writebufsize Greg KH
2012-04-11 23:10 ` [ 15/59] ACPI: Do cpufreq clamping for throttling per package v2 Greg KH
2012-04-11 23:10 ` [ 16/59] PNPACPI: Fix device ref leaking in acpi_pnp_match Greg KH
2012-04-11 23:10 ` [ 17/59] ACPICA: Fix regression in FADT revision checks Greg KH
2012-04-11 23:10 ` [ 18/59] modpost: fix ALL_INIT_DATA_SECTIONS Greg KH
2012-04-11 23:10 ` [ 19/59] genirq: Adjust irq thread affinity on IRQ_SET_MASK_OK_NOCOPY return value Greg KH
2012-04-11 23:10 ` [ 20/59] tracing: Fix ftrace stack trace entries Greg KH
2012-04-11 23:10 ` [ 21/59] tracing: Fix ent_size in trace output Greg KH
2012-04-11 23:10 ` [ 22/59] m68k/mac: Add missing platform check before registering platform devices Greg KH
2012-04-11 23:10 ` [ 23/59] mac80211: fix possible tid_rx->reorder_timer use after free Greg KH
2012-04-11 23:10 ` [ 24/59] rtlwifi: rtl8192ce: rtl8192cu: rtl8192de: Fix low-gain setting when scanning Greg KH
2012-04-11 23:11 ` [ 25/59] drm: Validate requested virtual size against allocated fb size Greg KH
2012-04-11 23:11 ` [ 26/59] drm/radeon/kms: fix fans after resume Greg KH
2012-04-11 23:11 ` [ 27/59] drm/i915: no-lvds quirk on MSI DC500 Greg KH
2012-04-11 23:11 ` [ 28/59] drm/i915: Sanitize BIOS debugging bits from PIPECONF Greg KH
2012-04-11 23:11 ` [ 29/59] drm/i915: Add lock on drm_helper_resume_force_mode Greg KH
2012-04-11 23:11 ` [ 30/59] drm/i915: quirk away broken OpRegion VBT Greg KH
2012-04-11 23:11 ` [ 31/59] r8169: runtime resume before shutdown Greg KH
2012-04-11 23:11 ` [ 32/59] target: Fix unsupported WRITE_SAME sense payload Greg KH
2012-04-11 23:11 ` [ 33/59] kgdb,debug_core: pass the breakpoint struct instead of address and memory Greg KH
2012-04-11 23:11 ` [ 34/59] kgdbts: Fix kernel oops with CONFIG_DEBUG_RODATA Greg KH
2012-04-11 23:11 ` [ 35/59] kgdbts: (1 of 2) fix single step awareness to work correctly with SMP Greg KH
2012-04-11 23:11 ` [ 36/59] kgdbts: (2 " Greg KH
2012-04-11 23:11 ` [ 37/59] x86,kgdb: Fix DEBUG_RODATA limitation using text_poke() Greg KH
2012-04-11 23:11 ` [ 38/59] CIFS: Fix VFS lock usage for oplocked files Greg KH
2012-04-11 23:11 ` [ 39/59] [PATCH] ARM: tegra: remove Tegra30 errata from MACH_TEGRA_DT Greg KH
2012-04-11 23:11 ` [ 40/59] mmc: sdhci-dove: Fix compile error by including module.h Greg KH
2012-04-11 23:11 ` [ 41/59] mmc: atmel-mci: correct data timeout computation Greg KH
2012-04-11 23:11 ` [ 42/59] tcm_fc: Add abort flag for gracefully handling exchange timeout Greg KH
2012-04-11 23:11 ` [ 43/59] tcm_fc: Do not free tpg structure during wq allocation failure Greg KH
2012-04-11 23:11 ` Greg KH [this message]
2012-04-11 23:11 ` [ 45/59] modpost: Fix modpost license checking of vmlinux.o Greg KH
2012-04-11 23:11 ` [ 46/59] x86/PCI: use host bridge _CRS info on MSI MS-7253 Greg KH
2012-04-11 23:11 ` [ 47/59] x86/PCI: do not tie MSI MS-7253 use_crs quirk to BIOS version Greg KH
2012-04-11 23:11 ` [ 48/59] TOMOYO: Fix mount flags checking order Greg KH
2012-04-11 23:11 ` [ 49/59] Revert "x86/ioapic: Add register level checks to detect bogus io-apic entries" Greg KH
2012-04-11 23:11 ` [ 50/59] acer-wmi: No wifi rfkill on Sony machines Greg KH
2012-04-11 23:11 ` [ 51/59] Fix length of buffer copied in __nfs4_get_acl_uncached Greg KH
2012-04-11 23:11 ` [ 52/59] sched/x86: Fix overflow in cyc2ns_offset Greg KH
2012-04-11 23:11 ` [ 53/59] mfd: Clear twl6030 IRQ status register only once Greg KH
2012-04-11 23:11 ` [ 54/59] USB: Add Motorola Rokr E6 Id to the USBNet driver "zaurus" Greg KH
2012-04-11 23:11 ` [ 55/59] ioat: fix size of completion for Xen Greg KH
2012-04-11 23:11 ` [ 56/59] ASoC: ak4642: fixup: mute needs +1 step Greg KH
2012-04-11 23:11 ` [ 57/59] cred: copy_process() should clear child->replacement_session_keyring Greg KH
2012-04-11 23:11 ` [ 58/59] iommu/amd: Make sure IOMMU interrupts are re-enabled on resume Greg KH
2012-04-11 23:11 ` [ 59/59] Bluetooth: Fix l2cap conn failures for ssp devices Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120411231042.946594604@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=james.l.morris@oracle.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=plougher@redhat.com \
--cc=richard@nod.at \
--cc=serge.hallyn@canonical.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).