Privileged syslog operations currently require CAP_SYS_ADMIN. Split
this off into a new CAP_SYSLOG privilege which we can sanely take away
from a container through the capability bounding set.
With this patch, an lxc container can be prevented from messing with
the host's syslog (i.e. dmesg -c).
Changelog: mar 12 2010: add selinux capability2:cap_syslog perm
Changelog: nov 22 2010:
. port to new kernel
. add a WARN_ONCE if userspace isn't using CAP_SYSLOG
Signed-off-by: Serge Hallyn <[email protected]>
Acked-by: Andrew G. Morgan <[email protected]>
Acked-By: Kees Cook <[email protected]>
Cc: James Morris <[email protected]>
Cc: Michael Kerrisk <[email protected]>
Cc: Stephen Smalley <[email protected]>
Cc: "Christopher J. PeBenito" <[email protected]>
Cc: Eric Paris <[email protected]>
---
include/linux/capability.h | 7 +++++--
kernel/printk.c | 8 +++++++-
security/selinux/include/classmap.h | 2 +-
3 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 90012b9..fb16a36 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -246,7 +246,6 @@ struct cpu_vfs_cap_data {
/* Allow configuration of the secure attention key */
/* Allow administration of the random device */
/* Allow examination and configuration of disk quotas */
-/* Allow configuring the kernel's syslog (printk behaviour) */
/* Allow setting the domainname */
/* Allow setting the hostname */
/* Allow calling bdflush() */
@@ -352,7 +351,11 @@ struct cpu_vfs_cap_data {
#define CAP_MAC_ADMIN 33
-#define CAP_LAST_CAP CAP_MAC_ADMIN
+/* Allow configuring the kernel's syslog (printk behaviour) */
+
+#define CAP_SYSLOG 34
+
+#define CAP_LAST_CAP CAP_SYSLOG
#define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
diff --git a/kernel/printk.c b/kernel/printk.c
index 9a2264f..111cdc2 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -283,8 +283,14 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
return -EPERM;
if ((type != SYSLOG_ACTION_READ_ALL &&
type != SYSLOG_ACTION_SIZE_BUFFER) &&
- !capable(CAP_SYS_ADMIN))
+ !capable(CAP_SYSLOG)) {
+ /* remove after 2.6.28 */
+ if (capable(CAP_SYS_ADMIN))
+ WARN_ONCE(1, "Attempt to access syslog with "
+ "CAP_SYS_ADMIN but no CAP_SYSLOG "
+ "(deprecated and denied).\n");
return -EPERM;
+ }
}
error = security_syslog(type);
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 8858d2b..7ed3663 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = {
"node_bind", "name_connect", NULL } },
{ "memprotect", { "mmap_zero", NULL } },
{ "peer", { "recv", NULL } },
- { "capability2", { "mac_override", "mac_admin", NULL } },
+ { "capability2", { "mac_override", "mac_admin", "syslog", NULL } },
{ "kernel_service", { "use_as_override", "create_files_as", NULL } },
{ "tun_socket",
{ COMMON_SOCK_PERMS, NULL } },
--
1.7.0.4
On Thu, 25 Nov 2010 17:11:32 +0000 Serge E. Hallyn wrote:
> Privileged syslog operations currently require CAP_SYS_ADMIN. Split
> this off into a new CAP_SYSLOG privilege which we can sanely take away
> from a container through the capability bounding set.
>
> With this patch, an lxc container can be prevented from messing with
> the host's syslog (i.e. dmesg -c).
>
> Changelog: mar 12 2010: add selinux capability2:cap_syslog perm
> Changelog: nov 22 2010:
> . port to new kernel
> . add a WARN_ONCE if userspace isn't using CAP_SYSLOG
>
> Signed-off-by: Serge Hallyn <[email protected]>
> Acked-by: Andrew G. Morgan <[email protected]>
> Acked-By: Kees Cook <[email protected]>
> Cc: James Morris <[email protected]>
> Cc: Michael Kerrisk <[email protected]>
> Cc: Stephen Smalley <[email protected]>
> Cc: "Christopher J. PeBenito" <[email protected]>
> Cc: Eric Paris <[email protected]>
> ---
> include/linux/capability.h | 7 +++++--
> kernel/printk.c | 8 +++++++-
> security/selinux/include/classmap.h | 2 +-
> 3 files changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index 90012b9..fb16a36 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -246,7 +246,6 @@ struct cpu_vfs_cap_data {
> /* Allow configuration of the secure attention key */
> /* Allow administration of the random device */
> /* Allow examination and configuration of disk quotas */
> -/* Allow configuring the kernel's syslog (printk behaviour) */
> /* Allow setting the domainname */
> /* Allow setting the hostname */
> /* Allow calling bdflush() */
> @@ -352,7 +351,11 @@ struct cpu_vfs_cap_data {
>
> #define CAP_MAC_ADMIN 33
>
> -#define CAP_LAST_CAP CAP_MAC_ADMIN
> +/* Allow configuring the kernel's syslog (printk behaviour) */
> +
> +#define CAP_SYSLOG 34
> +
> +#define CAP_LAST_CAP CAP_SYSLOG
>
> #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
>
> diff --git a/kernel/printk.c b/kernel/printk.c
> index 9a2264f..111cdc2 100644
> --- a/kernel/printk.c
> +++ b/kernel/printk.c
> @@ -283,8 +283,14 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
> return -EPERM;
> if ((type != SYSLOG_ACTION_READ_ALL &&
> type != SYSLOG_ACTION_SIZE_BUFFER) &&
> - !capable(CAP_SYS_ADMIN))
> + !capable(CAP_SYSLOG)) {
> + /* remove after 2.6.28 */
Is this supposed to say: after 2.6.38 ??
> + if (capable(CAP_SYS_ADMIN))
> + WARN_ONCE(1, "Attempt to access syslog with "
> + "CAP_SYS_ADMIN but no CAP_SYSLOG "
> + "(deprecated and denied).\n");
> return -EPERM;
> + }
> }
>
> error = security_syslog(type);
> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index 8858d2b..7ed3663 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = {
> "node_bind", "name_connect", NULL } },
> { "memprotect", { "mmap_zero", NULL } },
> { "peer", { "recv", NULL } },
> - { "capability2", { "mac_override", "mac_admin", NULL } },
> + { "capability2", { "mac_override", "mac_admin", "syslog", NULL } },
> { "kernel_service", { "use_as_override", "create_files_as", NULL } },
> { "tun_socket",
> { COMMON_SOCK_PERMS, NULL } },
> --
---
~Randy
*** Remember to use Documentation/SubmitChecklist when testing your code ***
Quoting Randy Dunlap ([email protected]):
> On Thu, 25 Nov 2010 17:11:32 +0000 Serge E. Hallyn wrote:
> > + /* remove after 2.6.28 */
>
> Is this supposed to say: after 2.6.38 ??
:) yup - i only noticed this after sending it, looking at
lkml.org, but didn't have a way of getting to my mail
server to reply to myself.
thanks,
-serge
On Thu, 25 Nov 2010, Serge E. Hallyn wrote:
> Privileged syslog operations currently require CAP_SYS_ADMIN. Split
> this off into a new CAP_SYSLOG privilege which we can sanely take away
> from a container through the capability bounding set.
>
> With this patch, an lxc container can be prevented from messing with
> the host's syslog (i.e. dmesg -c).
>
> Changelog: mar 12 2010: add selinux capability2:cap_syslog perm
> Changelog: nov 22 2010:
> . port to new kernel
> . add a WARN_ONCE if userspace isn't using CAP_SYSLOG
Applied with kernel version fix to:
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
--
James Morris
<[email protected]>