2 files changed, 14 insertions, 0 deletions

diff --git a/security/Kconfig b/security/Kconfig
index bd72ae623494..e80da955e687 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -39,6 +39,18 @@ config KEYS_DEBUG_PROC_KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config SECURITY_DMESG_RESTRICT
+        bool "Restrict unprivileged access to the kernel syslog"
+        default n
+        help
+          This enforces restrictions on unprivileged users reading the kernel
+          syslog via dmesg(8).
+
+          If this option is not selected, no restrictions will be enforced
+          unless the dmesg_restrict sysctl is explicitly set to (1).
+
+          If you are unsure how to answer this question, answer N.
+
 config SECURITY
         bool "Enable different security models"
         depends on SYSFS
diff --git a/security/commoncap.c b/security/commoncap.c
index 5e632b4857e4..04b80f9912bf 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -895,6 +895,8 @@ int cap_syslog(int type, bool from_file)
 {
         if (type != SYSLOG_ACTION_OPEN && from_file)
                 return 0;
+        if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
+                return -EPERM;
         if ((type != SYSLOG_ACTION_READ_ALL &&
              type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
                 return -EPERM;