diff options
| author |   Jingzi Meng <mengjingzi@iie.ac.cn> | 2024-01-05 14:20:07 +0800 |
|---|---|---|
| committer |   Kees Cook <keescook@chromium.org> | 2024-02-01 10:04:58 -0800 |
| commit | 09ce61e27db83180993e8b1a7f511af62374383c (patch) | |
| tree | 9a1ebc61a49f7ce5876c33b4561c00bc22522a1b /include/linux/string_choices.h | |
| parent | lib/string: shrink lib/string.i via IWYU (diff) | |
| download | wireguard-linux-09ce61e27db83180993e8b1a7f511af62374383c.tar.xz wireguard-linux-09ce61e27db83180993e8b1a7f511af62374383c.zip | |
cap_syslog: remove CAP_SYS_ADMIN when dmesg_restrict
CAP_SYSLOG was separated from CAP_SYS_ADMIN and introduced in Linux
2.6.37 (2010-11). For a long time, certain syslog actions required
CAP_SYS_ADMIN or CAP_SYSLOG. Maybe it’s time to officially remove
CAP_SYS_ADMIN for more fine-grained control.
CAP_SYS_ADMIN was once removed but added back for backwards
compatibility reasons. In commit 38ef4c2e437d ("syslog: check cap_syslog
when dmesg_restrict") (2010-12), CAP_SYS_ADMIN was no longer needed. And
in commit ee24aebffb75 ("cap_syslog: accept CAP_SYS_ADMIN for now")
(2011-02), it was accepted again. Since then, CAP_SYS_ADMIN has been
preserved.
Now that almost 13 years have passed, the legacy application may have
had enough time to be updated.
Signed-off-by: Jingzi Meng <mengjingzi@iie.ac.cn>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240105062007.26965-1-mengjingzi@iie.ac.cn
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'include/linux/string_choices.h')
0 files changed, 0 insertions, 0 deletions