A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

Restrict unprivileged access to kernel syslog

Browse source 
The kernel syslog contains debugging information that is often useful
during exploitation of other vulnerabilities, such as kernel heap
addresses.  Rather than futilely attempt to sanitize hundreds (or
thousands) of printk statements and simultaneously cripple useful
debugging functionality, it is far simpler to create an option that
prevents unprivileged users from reading the syslog.

This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the
dmesg_restrict sysctl.  When set to "0", the default, no restrictions are
enforced.  When set to "1", only users with CAP_SYS_ADMIN can read the
kernel syslog via dmesg(8) or other mechanisms.

[[email protected]: explain the config option in kernel.txt]
Signed-off-by: Dan Rosenberg <[email protected]>
Acked-by: Ingo Molnar <[email protected]>
Acked-by: Eugene Teo <[email protected]>
Acked-by: Kees Cook <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Dan Rosenberg 2010-11-11 14:05:18 -08:00 • committed by Linus Torvalds
commit eaf06b241b
6 changed files with 44 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
kernel/printk.c
View file

@ -261,6 +261,12 @@ static inline void boot_delay_msec(void)
}
#endif
#ifdef CONFIG_SECURITY_DMESG_RESTRICT
int dmesg_restrict = 1;
#else
int dmesg_restrict;
#endif
int do_syslog(int type, char __user *buf, int len, bool from_file)
{
unsigned i, j, limit, count;