[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <170681071324.3763781.3300487641248807302.b4-ty@chromium.org>
Date: Thu, 1 Feb 2024 10:05:15 -0800
From: Kees Cook <keescook@...omium.org>
To: gregkh@...uxfoundation.org,
Jingzi Meng <mengjingzi@....ac.cn>
Cc: Kees Cook <keescook@...omium.org>,
gpiccoli@...lia.com,
john.ogness@...utronix.de,
linux-hardening@...r.kernel.org,
linux-kernel@...r.kernel.org,
pmladek@...e.com,
rostedt@...dmis.org,
senozhatsky@...omium.org,
tony.luck@...el.com
Subject: Re: [PATCH] cap_syslog: remove CAP_SYS_ADMIN when dmesg_restrict
On Fri, 05 Jan 2024 14:20:07 +0800, Jingzi Meng wrote:
> CAP_SYSLOG was separated from CAP_SYS_ADMIN and introduced in Linux
> 2.6.37 (2010-11). For a long time, certain syslog actions required
> CAP_SYS_ADMIN or CAP_SYSLOG. Maybe it’s time to officially remove
> CAP_SYS_ADMIN for more fine-grained control.
>
> CAP_SYS_ADMIN was once removed but added back for backwards
> compatibility reasons. In commit 38ef4c2e437d ("syslog: check cap_syslog
> when dmesg_restrict") (2010-12), CAP_SYS_ADMIN was no longer needed. And
> in commit ee24aebffb75 ("cap_syslog: accept CAP_SYS_ADMIN for now")
> (2011-02), it was accepted again. Since then, CAP_SYS_ADMIN has been
> preserved.
>
> [...]
Applied to for-next/hardening, thanks!
[1/1] cap_syslog: remove CAP_SYS_ADMIN when dmesg_restrict
https://git.kernel.org/kees/c/09ce61e27db8
Take care,
--
Kees Cook
Powered by blists - more mailing lists