Messages in this thread | | | Date | 29 Sep 2013 19:41:46 -0400 | From | "George Spelvin" <> | Subject | Re: [PATCH] printk: Check real user/group id for %pK |
| |
> Right, so the pppd application is actually doing the correct thing.
And a CAP_SYSLOG setuid binary that *doesn't* DTRT seems like a more immediate security hole than leaking kernel addresses. After all kptr_restrict is optional precisely because the benefit is marginal.
The interesting question is what credentials make sense for %pK outside of a seq_printf(). Does it even make sense in a generic printk? In that case, it's the permission of the syslogd that matters rather than the process generating the message.
> Will wait and see what others have to say.
Me, too. Dan in particular.
| |