[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111027194003.GI28067@dhcp-25-225.brq.redhat.com>
Date: Thu, 27 Oct 2011 21:40:04 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- kernel: sysctl: restrict write
access to dmesg_restrict
On Wed, Oct 26, 2011 at 01:43:16PM -0400, Dan Rosenberg wrote:
> On Wed, Oct 26, 2011 at 11:16 AM, Petr Matousek <pmatouse@...hat.com> wrote:
> > When dmesg_restrict is set to 1 CAP_SYS_ADMIN is needed to read the
> > kernel ring buffer. But a root user without CAP_SYS_ADMIN is able
> > to reset dmesg_restrict to 0.
> >
>
> Minor correction: CAP_SYSLOG is needed to read the kernel ring buffer,
> with CAP_SYS_ADMIN being a fallback for legacy reasons. But it's
> correct that CAP_SYS_ADMIN is now required to modify the sysctl.
RHEL uses only CAP_SYS_ADMIN. I haven't checked upstream for
correctness of the description.
>
> I also agree with Vasiliy's point that LXC security boundaries in the
> mainline kernel are not well defined at this point, so the whole thing
> is a bit silly.
Just wondering - do you usually ack patches that you consider silly?
Petr
>
> -Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
