diff options
author | Kees Cook <keescook@chromium.org> | 2012-04-04 14:40:19 -0400 |
---|---|---|
committer | James Morris <james.l.morris@oracle.com> | 2012-04-05 00:51:43 -0400 |
commit | 620f6e8e855d6d447688a5f67a4e176944a084e8 (patch) | |
tree | 2be8f032eefc0d3bdaf9a045bd9263da4a2c6823 /kernel/sysctl.c | |
parent | 6c216ec636f75d834461be15f83ec41a6759bd2b (diff) |
sysctl: fix write access to dmesg_restrict/kptr_restrict
Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
however, it incorrectly alters kptr_restrict rather than
dmesg_restrict.
The original patch from Richard Weinberger
(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
expected, and so the patch seems to have been misapplied.
This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
kptr_restrict, since both are sensitive.
Reported-by: Phillip Lougher <plougher@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Richard Weinberger <richard@nod.at>
Cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'kernel/sysctl.c')
-rw-r--r-- | kernel/sysctl.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 52b3a06a02f8..4ab11879aeb4 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c | |||
@@ -170,7 +170,7 @@ static int proc_taint(struct ctl_table *table, int write, | |||
170 | #endif | 170 | #endif |
171 | 171 | ||
172 | #ifdef CONFIG_PRINTK | 172 | #ifdef CONFIG_PRINTK |
173 | static int proc_dmesg_restrict(struct ctl_table *table, int write, | 173 | static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, |
174 | void __user *buffer, size_t *lenp, loff_t *ppos); | 174 | void __user *buffer, size_t *lenp, loff_t *ppos); |
175 | #endif | 175 | #endif |
176 | 176 | ||
@@ -703,7 +703,7 @@ static struct ctl_table kern_table[] = { | |||
703 | .data = &dmesg_restrict, | 703 | .data = &dmesg_restrict, |
704 | .maxlen = sizeof(int), | 704 | .maxlen = sizeof(int), |
705 | .mode = 0644, | 705 | .mode = 0644, |
706 | .proc_handler = proc_dointvec_minmax, | 706 | .proc_handler = proc_dointvec_minmax_sysadmin, |
707 | .extra1 = &zero, | 707 | .extra1 = &zero, |
708 | .extra2 = &one, | 708 | .extra2 = &one, |
709 | }, | 709 | }, |
@@ -712,7 +712,7 @@ static struct ctl_table kern_table[] = { | |||
712 | .data = &kptr_restrict, | 712 | .data = &kptr_restrict, |
713 | .maxlen = sizeof(int), | 713 | .maxlen = sizeof(int), |
714 | .mode = 0644, | 714 | .mode = 0644, |
715 | .proc_handler = proc_dmesg_restrict, | 715 | .proc_handler = proc_dointvec_minmax_sysadmin, |
716 | .extra1 = &zero, | 716 | .extra1 = &zero, |
717 | .extra2 = &two, | 717 | .extra2 = &two, |
718 | }, | 718 | }, |
@@ -1943,7 +1943,7 @@ static int proc_taint(struct ctl_table *table, int write, | |||
1943 | } | 1943 | } |
1944 | 1944 | ||
1945 | #ifdef CONFIG_PRINTK | 1945 | #ifdef CONFIG_PRINTK |
1946 | static int proc_dmesg_restrict(struct ctl_table *table, int write, | 1946 | static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, |
1947 | void __user *buffer, size_t *lenp, loff_t *ppos) | 1947 | void __user *buffer, size_t *lenp, loff_t *ppos) |
1948 | { | 1948 | { |
1949 | if (write && !capable(CAP_SYS_ADMIN)) | 1949 | if (write && !capable(CAP_SYS_ADMIN)) |