Messages in this thread | | | Date | Tue, 9 Nov 2010 12:23:50 +0100 | From | Ingo Molnar <> | Subject | Re: [PATCH] Restrict unprivileged access to kernel syslog |
| |
* Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> The kernel syslog contains debugging information that is often useful > during exploitation of other vulnerabilities, such as kernel heap > addresses. Rather than futilely attempt to sanitize hundreds (or > thousands) of printk statements and simultaneously cripple useful > debugging functionality, it is far simpler to create an option that > prevents unprivileged users from reading the syslog. > > This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the > dmesg_restrict sysctl. When set to "0", the default, no restrictions > are enforced. When set to "1", only users with CAP_SYS_ADMIN can read > the kernel syslog via dmesg(8) or other mechanisms. > > Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> > --- > Documentation/sysctl/kernel.txt | 11 +++++++++++ > include/linux/kernel.h | 1 + > kernel/printk.c | 2 ++ > kernel/sysctl.c | 9 +++++++++ > security/commoncap.c | 2 ++ > 5 files changed, 25 insertions(+), 0 deletions(-)
> +int dmesg_restrict = 0;
The initialization to zero is implicit, no need to write it out.
Also, it would also be useful to have a CONFIG_SECURITY_RESTRICT_DMESG=y option introduced by your patch as well, which flag allows a distro or user to disable unprivileged syslog reading via the kernel config.
Thanks,
Ingo
| |