Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756905Ab3DXRo5 (ORCPT ); Wed, 24 Apr 2013 13:44:57 -0400 Received: from mail-wg0-f50.google.com ([74.125.82.50]:40712 "EHLO mail-wg0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756435Ab3DXRoz (ORCPT ); Wed, 24 Apr 2013 13:44:55 -0400 MIME-Version: 1.0 In-Reply-To: References: <1361998001.2110.22.camel@localhost> <20130227221954.GJ2071@hansolo.jdub.homelinux.org> <20130322145448.f44f9d10a36620c1c11535b7@linux-foundation.org> <20130322221444.GJ15821@hansolo.jdub.homelinux.org> <1256775981.281402.1364864751771.JavaMail.root@redhat.com> <20130409005050.GE18176@hansolo.jdub.homelinux.org> <20130409154820.GE32476@hansolo.jdub.homelinux.org> From: Kay Sievers Date: Wed, 24 Apr 2013 19:44:33 +0200 Message-ID: Subject: Re: [PATCH v2] kmsg: Honor dmesg_restrict sysctl on /dev/kmsg To: Kees Cook Cc: Josh Boyer , Andrew Morton , Eric Paris , Linus Torvalds , Christian Kujau , "# 3.4.x" , LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1590 Lines: 40 On Tue, Apr 9, 2013 at 6:33 PM, Kees Cook wrote: > On Tue, Apr 9, 2013 at 8:48 AM, Josh Boyer wrote: >> The dmesg_restrict sysctl currently covers the syslog method for access >> dmesg, however /dev/kmsg isn't covered by the same protections. Most >> people haven't noticed because util-linux dmesg(1) defaults to using the >> syslog method for access in older versions. With util-linux dmesg(1) >> defaults to reading directly from /dev/kmsg. >> >> Fix this by reworking all of the access methods to use the >> check_syslog_permissions function and adding checks to devkmsg_open and >> devkmsg_read. >> >> This fixes https://bugzilla.redhat.com/show_bug.cgi?id=903192 >> >> Reported-by: Christian Kujau >> CC: stable@vger.kernel.org >> Signed-off-by: Eric Paris >> Signed-off-by: Josh Boyer > > Thanks! > > Acked-by: Kees Cook If that's the version currently in Fedora, we just cannot do this. https://bugzilla.redhat.com/show_bug.cgi?id=952655 /dev/kmsg is supposed, and was added, to be a sane alternative to syslog(). It is already used in dmesg(1) which is now broken with this patch. The access rules for /dev/kmsg should follow the access rules of syslog(), and not be any stricter. Thanks, Kay -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/