From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Phillip Lougher <plougher@redhat.com>,
Kees Cook <keescook@chromium.org>,
Serge Hallyn <serge.hallyn@canonical.com>,
Richard Weinberger <richard@nod.at>,
James Morris <james.l.morris@oracle.com>
Subject: [ 28/42] sysctl: fix write access to dmesg_restrict/kptr_restrict
Date: Wed, 11 Apr 2012 16:13:35 -0700 [thread overview]
Message-ID: <20120411231312.198081129@linuxfoundation.org> (raw)
In-Reply-To: <20120411231443.GA808@kroah.com>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 620f6e8e855d6d447688a5f67a4e176944a084e8 upstream.
Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
however, it incorrectly alters kptr_restrict rather than
dmesg_restrict.
The original patch from Richard Weinberger
(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
expected, and so the patch seems to have been misapplied.
This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
kptr_restrict, since both are sensitive.
Reported-by: Phillip Lougher <plougher@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sysctl.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -172,7 +172,7 @@ static int proc_taint(struct ctl_table *
#endif
#ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);
#endif
@@ -709,7 +709,7 @@ static struct ctl_table kern_table[] = {
.data = &dmesg_restrict,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec_minmax,
+ .proc_handler = proc_dointvec_minmax_sysadmin,
.extra1 = &zero,
.extra2 = &one,
},
@@ -718,7 +718,7 @@ static struct ctl_table kern_table[] = {
.data = &kptr_restrict,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dmesg_restrict,
+ .proc_handler = proc_dointvec_minmax_sysadmin,
.extra1 = &zero,
.extra2 = &two,
},
@@ -2416,7 +2416,7 @@ static int proc_taint(struct ctl_table *
}
#ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
if (write && !capable(CAP_SYS_ADMIN))
next prev parent reply other threads:[~2012-04-11 23:13 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-11 23:14 [ 00/42] 3.0.28-stable review Greg KH
2012-04-11 23:13 ` [ 01/42] x86 bpf_jit: fix a bug in emitting the 16-bit immediate operand of AND Greg KH
2012-04-11 23:13 ` [ 02/42] rose_dev: fix memcpy-bug in rose_set_mac_address Greg KH
2012-04-11 23:13 ` [ 03/42] net: usb: cdc_eem: fix mtu Greg KH
2012-04-11 23:13 ` [ 04/42] mtd: sst25l: initialize writebufsize Greg KH
2012-04-11 23:13 ` [ 05/42] mtd: block2mtd: " Greg KH
2012-04-11 23:13 ` [ 06/42] mtd: lart: " Greg KH
2012-04-11 23:13 ` [ 07/42] mtd: m25p80: set writebufsize Greg KH
2012-04-11 23:13 ` [ 08/42] ACPI: Do cpufreq clamping for throttling per package v2 Greg KH
2012-04-11 23:13 ` [ 09/42] PNPACPI: Fix device ref leaking in acpi_pnp_match Greg KH
2012-04-11 23:13 ` [ 10/42] ACPICA: Fix regression in FADT revision checks Greg KH
2012-04-11 23:13 ` [ 11/42] modpost: fix ALL_INIT_DATA_SECTIONS Greg KH
2012-04-11 23:13 ` [ 12/42] genirq: Adjust irq thread affinity on IRQ_SET_MASK_OK_NOCOPY return value Greg KH
2012-04-11 23:13 ` [ 13/42] tracing: Fix ftrace stack trace entries Greg KH
2012-04-11 23:13 ` [ 14/42] m68k/mac: Add missing platform check before registering platform devices Greg KH
2012-04-11 23:13 ` [ 15/42] mac80211: fix possible tid_rx->reorder_timer use after free Greg KH
2012-04-11 23:13 ` [ 16/42] drm: Validate requested virtual size against allocated fb size Greg KH
2012-04-11 23:13 ` [ 17/42] drm/radeon/kms: fix fans after resume Greg KH
2012-04-11 23:13 ` [ 18/42] drm/i915: no-lvds quirk on MSI DC500 Greg KH
2012-04-11 23:13 ` [ 19/42] drm/i915: Sanitize BIOS debugging bits from PIPECONF Greg KH
2012-04-11 23:13 ` [ 20/42] drm/i915: Add lock on drm_helper_resume_force_mode Greg KH
2012-04-11 23:13 ` [ 21/42] drm/i915: quirk away broken OpRegion VBT Greg KH
2012-04-11 23:13 ` [ 22/42] kgdb,debug_core: pass the breakpoint struct instead of address and memory Greg KH
2012-04-11 23:13 ` [ 23/42] kgdbts: Fix kernel oops with CONFIG_DEBUG_RODATA Greg KH
2012-04-11 23:13 ` [ 24/42] kgdbts: (1 of 2) fix single step awareness to work correctly with SMP Greg KH
2012-04-11 23:13 ` [ 25/42] kgdbts: (2 " Greg KH
2012-04-11 23:13 ` [ 26/42] x86,kgdb: Fix DEBUG_RODATA limitation using text_poke() Greg KH
2012-04-11 23:13 ` [ 27/42] mmc: atmel-mci: correct data timeout computation Greg KH
2012-04-11 23:13 ` Greg KH [this message]
2012-04-11 23:13 ` [ 29/42] modpost: Fix modposts license checking V3 Greg KH
2012-04-11 23:13 ` [ 30/42] modpost: Fix modpost license checking of vmlinux.o Greg KH
2012-04-11 23:13 ` [ 31/42] x86/PCI: use host bridge _CRS info on MSI MS-7253 Greg KH
2012-04-11 23:13 ` [ 32/42] x86/PCI: do not tie MSI MS-7253 use_crs quirk to BIOS version Greg KH
2012-04-11 23:13 ` [ 33/42] Revert "x86/ioapic: Add register level checks to detect bogus io-apic entries" Greg KH
2012-04-11 23:13 ` [ 34/42] acer-wmi: No wifi rfkill on Sony machines Greg KH
2012-04-11 23:13 ` [ 35/42] sched/x86: Fix overflow in cyc2ns_offset Greg KH
2012-04-11 23:13 ` [ 36/42] mfd: Clear twl6030 IRQ status register only once Greg KH
2012-04-11 23:13 ` [ 37/42] USB: Add Motorola Rokr E6 Id to the USBNet driver "zaurus" Greg KH
2012-04-11 23:13 ` [ 38/42] ASoC: ak4642: fixup: mute needs +1 step Greg KH
2012-04-11 23:13 ` [ 39/42] cred: copy_process() should clear child->replacement_session_keyring Greg KH
2012-04-11 23:13 ` [ 40/42] iommu/amd: Make sure IOMMU interrupts are re-enabled on resume Greg KH
2012-04-11 23:13 ` [ 41/42] TOMOYO: Fix mount flags checking order Greg KH
2012-04-11 23:13 ` [ 42/42] Bluetooth: Fix l2cap conn failures for ssp devices Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120411231312.198081129@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=james.l.morris@oracle.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=plougher@redhat.com \
--cc=richard@nod.at \
--cc=serge.hallyn@canonical.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).