Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753041Ab0KZC7B (ORCPT ); Thu, 25 Nov 2010 21:59:01 -0500 Received: from xenotime.net ([72.52.115.56]:41869 "HELO xenotime.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1752488Ab0KZC66 (ORCPT ); Thu, 25 Nov 2010 21:58:58 -0500 Date: Thu, 25 Nov 2010 18:58:57 -0800 From: Randy Dunlap To: "Serge E. Hallyn" Cc: kernel list , Eric Paris , LSM , James Morris , Kees Cook , Michael Kerrisk , Stephen Smalley , "Christopher J. PeBenito" Subject: Re: [PATCH 1/1] Define CAP_SYSLOG Message-Id: <20101125185857.fa237ddf.rdunlap@xenotime.net> In-Reply-To: <20101125171132.GA25703@mail.hallyn.com> References: <20101125171132.GA25703@mail.hallyn.com> Organization: YPO4 X-Mailer: Sylpheed 2.7.1 (GTK+ 2.16.6; x86_64-unknown-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3795 Lines: 100 On Thu, 25 Nov 2010 17:11:32 +0000 Serge E. Hallyn wrote: > Privileged syslog operations currently require CAP_SYS_ADMIN. Split > this off into a new CAP_SYSLOG privilege which we can sanely take away > from a container through the capability bounding set. > > With this patch, an lxc container can be prevented from messing with > the host's syslog (i.e. dmesg -c). > > Changelog: mar 12 2010: add selinux capability2:cap_syslog perm > Changelog: nov 22 2010: > . port to new kernel > . add a WARN_ONCE if userspace isn't using CAP_SYSLOG > > Signed-off-by: Serge Hallyn > Acked-by: Andrew G. Morgan > Acked-By: Kees Cook > Cc: James Morris > Cc: Michael Kerrisk > Cc: Stephen Smalley > Cc: "Christopher J. PeBenito" > Cc: Eric Paris > --- > include/linux/capability.h | 7 +++++-- > kernel/printk.c | 8 +++++++- > security/selinux/include/classmap.h | 2 +- > 3 files changed, 13 insertions(+), 4 deletions(-) > > diff --git a/include/linux/capability.h b/include/linux/capability.h > index 90012b9..fb16a36 100644 > --- a/include/linux/capability.h > +++ b/include/linux/capability.h > @@ -246,7 +246,6 @@ struct cpu_vfs_cap_data { > /* Allow configuration of the secure attention key */ > /* Allow administration of the random device */ > /* Allow examination and configuration of disk quotas */ > -/* Allow configuring the kernel's syslog (printk behaviour) */ > /* Allow setting the domainname */ > /* Allow setting the hostname */ > /* Allow calling bdflush() */ > @@ -352,7 +351,11 @@ struct cpu_vfs_cap_data { > > #define CAP_MAC_ADMIN 33 > > -#define CAP_LAST_CAP CAP_MAC_ADMIN > +/* Allow configuring the kernel's syslog (printk behaviour) */ > + > +#define CAP_SYSLOG 34 > + > +#define CAP_LAST_CAP CAP_SYSLOG > > #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) > > diff --git a/kernel/printk.c b/kernel/printk.c > index 9a2264f..111cdc2 100644 > --- a/kernel/printk.c > +++ b/kernel/printk.c > @@ -283,8 +283,14 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) > return -EPERM; > if ((type != SYSLOG_ACTION_READ_ALL && > type != SYSLOG_ACTION_SIZE_BUFFER) && > - !capable(CAP_SYS_ADMIN)) > + !capable(CAP_SYSLOG)) { > + /* remove after 2.6.28 */ Is this supposed to say: after 2.6.38 ?? > + if (capable(CAP_SYS_ADMIN)) > + WARN_ONCE(1, "Attempt to access syslog with " > + "CAP_SYS_ADMIN but no CAP_SYSLOG " > + "(deprecated and denied).\n"); > return -EPERM; > + } > } > > error = security_syslog(type); > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h > index 8858d2b..7ed3663 100644 > --- a/security/selinux/include/classmap.h > +++ b/security/selinux/include/classmap.h > @@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = { > "node_bind", "name_connect", NULL } }, > { "memprotect", { "mmap_zero", NULL } }, > { "peer", { "recv", NULL } }, > - { "capability2", { "mac_override", "mac_admin", NULL } }, > + { "capability2", { "mac_override", "mac_admin", "syslog", NULL } }, > { "kernel_service", { "use_as_override", "create_files_as", NULL } }, > { "tun_socket", > { COMMON_SOCK_PERMS, NULL } }, > -- --- ~Randy *** Remember to use Documentation/SubmitChecklist when testing your code *** -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/