diff options
-rw-r--r-- | include/linux/capability.h | 7 | ||||
-rw-r--r-- | kernel/printk.c | 8 | ||||
-rw-r--r-- | security/selinux/include/classmap.h | 2 |
3 files changed, 13 insertions, 4 deletions
diff --git a/include/linux/capability.h b/include/linux/capability.h index 90012b9ddbf3..fb16a3699b99 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h | |||
@@ -246,7 +246,6 @@ struct cpu_vfs_cap_data { | |||
246 | /* Allow configuration of the secure attention key */ | 246 | /* Allow configuration of the secure attention key */ |
247 | /* Allow administration of the random device */ | 247 | /* Allow administration of the random device */ |
248 | /* Allow examination and configuration of disk quotas */ | 248 | /* Allow examination and configuration of disk quotas */ |
249 | /* Allow configuring the kernel's syslog (printk behaviour) */ | ||
250 | /* Allow setting the domainname */ | 249 | /* Allow setting the domainname */ |
251 | /* Allow setting the hostname */ | 250 | /* Allow setting the hostname */ |
252 | /* Allow calling bdflush() */ | 251 | /* Allow calling bdflush() */ |
@@ -352,7 +351,11 @@ struct cpu_vfs_cap_data { | |||
352 | 351 | ||
353 | #define CAP_MAC_ADMIN 33 | 352 | #define CAP_MAC_ADMIN 33 |
354 | 353 | ||
355 | #define CAP_LAST_CAP CAP_MAC_ADMIN | 354 | /* Allow configuring the kernel's syslog (printk behaviour) */ |
355 | |||
356 | #define CAP_SYSLOG 34 | ||
357 | |||
358 | #define CAP_LAST_CAP CAP_SYSLOG | ||
356 | 359 | ||
357 | #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) | 360 | #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) |
358 | 361 | ||
diff --git a/kernel/printk.c b/kernel/printk.c index 9a2264fc42ca..0712380737b3 100644 --- a/kernel/printk.c +++ b/kernel/printk.c | |||
@@ -283,8 +283,14 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) | |||
283 | return -EPERM; | 283 | return -EPERM; |
284 | if ((type != SYSLOG_ACTION_READ_ALL && | 284 | if ((type != SYSLOG_ACTION_READ_ALL && |
285 | type != SYSLOG_ACTION_SIZE_BUFFER) && | 285 | type != SYSLOG_ACTION_SIZE_BUFFER) && |
286 | !capable(CAP_SYS_ADMIN)) | 286 | !capable(CAP_SYSLOG)) { |
287 | /* remove after 2.6.38 */ | ||
288 | if (capable(CAP_SYS_ADMIN)) | ||
289 | WARN_ONCE(1, "Attempt to access syslog with " | ||
290 | "CAP_SYS_ADMIN but no CAP_SYSLOG " | ||
291 | "(deprecated and denied).\n"); | ||
287 | return -EPERM; | 292 | return -EPERM; |
293 | } | ||
288 | } | 294 | } |
289 | 295 | ||
290 | error = security_syslog(type); | 296 | error = security_syslog(type); |
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 8858d2b2d4b6..7ed3663332ec 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h | |||
@@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = { | |||
142 | "node_bind", "name_connect", NULL } }, | 142 | "node_bind", "name_connect", NULL } }, |
143 | { "memprotect", { "mmap_zero", NULL } }, | 143 | { "memprotect", { "mmap_zero", NULL } }, |
144 | { "peer", { "recv", NULL } }, | 144 | { "peer", { "recv", NULL } }, |
145 | { "capability2", { "mac_override", "mac_admin", NULL } }, | 145 | { "capability2", { "mac_override", "mac_admin", "syslog", NULL } }, |
146 | { "kernel_service", { "use_as_override", "create_files_as", NULL } }, | 146 | { "kernel_service", { "use_as_override", "create_files_as", NULL } }, |
147 | { "tun_socket", | 147 | { "tun_socket", |
148 | { COMMON_SOCK_PERMS, NULL } }, | 148 | { COMMON_SOCK_PERMS, NULL } }, |