diff options
| author |   Kees Cook <keescook@chromium.org> | 2017-08-09 21:11:00 -0700 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2017-08-17 16:29:19 -0700 |
| commit | c71b02e4d207cbcf097f9746d5f7967b22905e70 (patch) | |
| tree | f3eaa286c2a932e1f348ae3b322eedd9fea9cefa /include/linux/syslog.h | |
| parent | pstore: Make default pstorefs root dir perms 0750 (diff) | |
| download | linux-dev-c71b02e4d207cbcf097f9746d5f7967b22905e70.tar.xz linux-dev-c71b02e4d207cbcf097f9746d5f7967b22905e70.zip | |
Revert "pstore: Honor dmesg_restrict sysctl on dmesg dumps"
This reverts commit 68c4a4f8abc60c9440ede9cd123d48b78325f7a3, with
various conflict clean-ups.
The capability check required too much privilege compared to simple DAC
controls. A system builder was forced to have crash handler processes
run with CAP_SYSLOG which would give it the ability to read (and wipe)
the _current_ dmesg, which is much more access than being given access
only to the historical log stored in pstorefs.
With the prior commit to make the root directory 0750, the files are
protected by default but a system builder can now opt to give access
to a specific group (via chgrp on the pstorefs root directory) without
being forced to also give away CAP_SYSLOG.
Suggested-by: Nick Kralevich <nnk@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Petr Mladek <pmladek@suse.cz>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Diffstat (limited to 'include/linux/syslog.h')
| -rw-r--r-- | include/linux/syslog.h | 9 |
1 files changed, 0 insertions, 9 deletions
diff --git a/include/linux/syslog.h b/include/linux/syslog.h index c3a7f0cc3a27..e1c3632f4e81 100644 --- a/include/linux/syslog.h +++ b/include/linux/syslog.h @@ -49,13 +49,4 @@ int do_syslog(int type, char __user *buf, int count, int source); -#ifdef CONFIG_PRINTK -int check_syslog_permissions(int type, int source); -#else -static inline int check_syslog_permissions(int type, int source) -{ - return 0; -} -#endif - #endif /* _LINUX_SYSLOG_H */ |