Messages in this thread | | | Date | Thu, 4 Feb 2010 14:52:05 +1100 (EST) | From | James Morris <> | Subject | Re: [PATCH v2 1/2] syslog: distinguish between /proc/kmsg and syscalls |
| |
On Wed, 3 Feb 2010, Kees Cook wrote:
> This allows the LSM to distinguish between syslog functions originating > from /proc/kmsg access and direct syscalls. By default, the commoncaps > will now no longer require CAP_SYS_ADMIN to read an opened /proc/kmsg > file descriptor. For example the kernel syslog reader can now drop > privileges after opening /proc/kmsg, instead of staying privileged with > CAP_SYS_ADMIN. MAC systems that implement security_syslog have unchanged > behavior. > > Signed-off-by: Kees Cook <kees.cook@canonical.com>
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
-- James Morris <jmorris@namei.org>
| |