aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/sysctl.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2012-04-04 14:40:19 -0400
committerJames Morris <james.l.morris@oracle.com>2012-04-05 00:51:43 -0400
commit620f6e8e855d6d447688a5f67a4e176944a084e8 (patch)
tree2be8f032eefc0d3bdaf9a045bd9263da4a2c6823 /kernel/sysctl.c
parent6c216ec636f75d834461be15f83ec41a6759bd2b (diff)
sysctl: fix write access to dmesg_restrict/kptr_restrict
Commit bfdc0b4 adds code to restrict access to dmesg_restrict, however, it incorrectly alters kptr_restrict rather than dmesg_restrict. The original patch from Richard Weinberger (https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as expected, and so the patch seems to have been misapplied. This adds the CAP_SYS_ADMIN check to both dmesg_restrict and kptr_restrict, since both are sensitive. Reported-by: Phillip Lougher <plougher@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Acked-by: Richard Weinberger <richard@nod.at> Cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'kernel/sysctl.c')
-rw-r--r--kernel/sysctl.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 52b3a06a02f8..4ab11879aeb4 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -170,7 +170,7 @@ static int proc_taint(struct ctl_table *table, int write,
170#endif 170#endif
171 171
172#ifdef CONFIG_PRINTK 172#ifdef CONFIG_PRINTK
173static int proc_dmesg_restrict(struct ctl_table *table, int write, 173static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
174 void __user *buffer, size_t *lenp, loff_t *ppos); 174 void __user *buffer, size_t *lenp, loff_t *ppos);
175#endif 175#endif
176 176
@@ -703,7 +703,7 @@ static struct ctl_table kern_table[] = {
703 .data = &dmesg_restrict, 703 .data = &dmesg_restrict,
704 .maxlen = sizeof(int), 704 .maxlen = sizeof(int),
705 .mode = 0644, 705 .mode = 0644,
706 .proc_handler = proc_dointvec_minmax, 706 .proc_handler = proc_dointvec_minmax_sysadmin,
707 .extra1 = &zero, 707 .extra1 = &zero,
708 .extra2 = &one, 708 .extra2 = &one,
709 }, 709 },
@@ -712,7 +712,7 @@ static struct ctl_table kern_table[] = {
712 .data = &kptr_restrict, 712 .data = &kptr_restrict,
713 .maxlen = sizeof(int), 713 .maxlen = sizeof(int),
714 .mode = 0644, 714 .mode = 0644,
715 .proc_handler = proc_dmesg_restrict, 715 .proc_handler = proc_dointvec_minmax_sysadmin,
716 .extra1 = &zero, 716 .extra1 = &zero,
717 .extra2 = &two, 717 .extra2 = &two,
718 }, 718 },
@@ -1943,7 +1943,7 @@ static int proc_taint(struct ctl_table *table, int write,
1943} 1943}
1944 1944
1945#ifdef CONFIG_PRINTK 1945#ifdef CONFIG_PRINTK
1946static int proc_dmesg_restrict(struct ctl_table *table, int write, 1946static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
1947 void __user *buffer, size_t *lenp, loff_t *ppos) 1947 void __user *buffer, size_t *lenp, loff_t *ppos)
1948{ 1948{
1949 if (write && !capable(CAP_SYS_ADMIN)) 1949 if (write && !capable(CAP_SYS_ADMIN))