linux-kernel - Re: [PATCH] sysctl: fix write access to dmesg_restrict/kptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 5 Apr 2012 15:11:26 +1000 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Kees Cook <keescook@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	"Serge E. Hallyn" <serge@...lyn.com>, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Richard Weinberger <richard@....at>,
	Greg Kroah-Hartman <greg@...ah.com>,
	Dan Rosenberg <drosenberg@...curity.com>,
	Eugene Teo <eteo@...hat.com>, Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH] sysctl: fix write access to
 dmesg_restrict/kptr_restrict

Here it is in git pullable form for Linus:

The following changes since commit 6c216ec636f75d834461be15f83ec41a6759bd2b:
  Linus Torvalds (1):
        Merge tag 'for_linus-3.4-rc2' of git://git.kernel.org/.../jwessel/kgdb

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Kees Cook (1):
      sysctl: fix write access to dmesg_restrict/kptr_restrict

 kernel/sysctl.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

commit 620f6e8e855d6d447688a5f67a4e176944a084e8
Author: Kees Cook <keescook@...omium.org>
Date:   Wed Apr 4 11:40:19 2012 -0700

    sysctl: fix write access to dmesg_restrict/kptr_restrict
    
    Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
    however, it incorrectly alters kptr_restrict rather than
    dmesg_restrict.
    
    The original patch from Richard Weinberger
    (https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
    expected, and so the patch seems to have been misapplied.
    
    This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
    kptr_restrict, since both are sensitive.
    
    Reported-by: Phillip Lougher <plougher@...hat.com>
    Signed-off-by: Kees Cook <keescook@...omium.org>
    Acked-by: Serge Hallyn <serge.hallyn@...onical.com>
    Acked-by: Richard Weinberger <richard@....at>
    Cc: stable@...r.kernel.org
    Signed-off-by: James Morris <james.l.morris@...cle.com>

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 52b3a06..4ab1187 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -170,7 +170,7 @@ static int proc_taint(struct ctl_table *table, int write,
 #endif
 
 #ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
 				void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
 
@@ -703,7 +703,7 @@ static struct ctl_table kern_table[] = {
 		.data		= &dmesg_restrict,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec_minmax,
+		.proc_handler	= proc_dointvec_minmax_sysadmin,
 		.extra1		= &zero,
 		.extra2		= &one,
 	},
@@ -712,7 +712,7 @@ static struct ctl_table kern_table[] = {
 		.data		= &kptr_restrict,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dmesg_restrict,
+		.proc_handler	= proc_dointvec_minmax_sysadmin,
 		.extra1		= &zero,
 		.extra2		= &two,
 	},
@@ -1943,7 +1943,7 @@ static int proc_taint(struct ctl_table *table, int write,
 }
 
 #ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
 				void __user *buffer, size_t *lenp, loff_t *ppos)
 {
 	if (write && !capable(CAP_SYS_ADMIN))
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/