Skip to content

Commit 12b3052

Browse files
eparistorvalds
eparis
authored and
torvalds
committed
capabilities/syslog: open code cap_syslog logic to fix build failure
The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build failure when CONFIG_PRINTK=n. This is because the capabilities code which used the new option was built even though the variable in question didn't exist. The patch here fixes this by moving the capabilities checks out of the LSM and into the caller. All (known) LSMs should have been calling the capabilities hook already so it actually makes the code organization better to eliminate the hook altogether. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 6800e4c commit 12b3052

File tree

7 files changed

+28
-40
lines changed

7 files changed

+28
-40
lines changed

‎include/linux/security.h

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
7777
extern int cap_task_setscheduler(struct task_struct *p);
7878
extern int cap_task_setioprio(struct task_struct *p, int ioprio);
7979
extern int cap_task_setnice(struct task_struct *p, int nice);
80-
extern int cap_syslog(int type, bool from_file);
8180
extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
8281

8382
struct msghdr;
@@ -1388,7 +1387,7 @@ struct security_operations {
13881387
int (*sysctl) (struct ctl_table *table, int op);
13891388
int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
13901389
int (*quota_on) (struct dentry *dentry);
1391-
int (*syslog) (int type, bool from_file);
1390+
int (*syslog) (int type);
13921391
int (*settime) (struct timespec *ts, struct timezone *tz);
13931392
int (*vm_enough_memory) (struct mm_struct *mm, long pages);
13941393

@@ -1671,7 +1670,7 @@ int security_real_capable_noaudit(struct task_struct *tsk, int cap);
16711670
int security_sysctl(struct ctl_table *table, int op);
16721671
int security_quotactl(int cmds, int type, int id, struct super_block *sb);
16731672
int security_quota_on(struct dentry *dentry);
1674-
int security_syslog(int type, bool from_file);
1673+
int security_syslog(int type);
16751674
int security_settime(struct timespec *ts, struct timezone *tz);
16761675
int security_vm_enough_memory(long pages);
16771676
int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
@@ -1901,9 +1900,9 @@ static inline int security_quota_on(struct dentry *dentry)
19011900
return 0;
19021901
}
19031902

1904-
static inline int security_syslog(int type, bool from_file)
1903+
static inline int security_syslog(int type)
19051904
{
1906-
return cap_syslog(type, from_file);
1905+
return 0;
19071906
}
19081907

19091908
static inline int security_settime(struct timespec *ts, struct timezone *tz)

‎kernel/printk.c

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
274274
char c;
275275
int error = 0;
276276

277-
error = security_syslog(type, from_file);
277+
/*
278+
* If this is from /proc/kmsg we only do the capabilities checks
279+
* at open time.
280+
*/
281+
if (type == SYSLOG_ACTION_OPEN || !from_file) {
282+
if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
283+
return -EPERM;
284+
if ((type != SYSLOG_ACTION_READ_ALL &&
285+
type != SYSLOG_ACTION_SIZE_BUFFER) &&
286+
!capable(CAP_SYS_ADMIN))
287+
return -EPERM;
288+
}
289+
290+
error = security_syslog(type);
278291
if (error)
279292
return error;
280293

‎security/capability.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ static int cap_sysctl(ctl_table *table, int op)
1717
return 0;
1818
}
1919

20+
static int cap_syslog(int type)
21+
{
22+
return 0;
23+
}
24+
2025
static int cap_quotactl(int cmds, int type, int id, struct super_block *sb)
2126
{
2227
return 0;

‎security/commoncap.c

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
#include <linux/sched.h>
2828
#include <linux/prctl.h>
2929
#include <linux/securebits.h>
30-
#include <linux/syslog.h>
3130

3231
/*
3332
* If a non-root user executes a setuid-root binary in
@@ -883,26 +882,6 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
883882
return error;
884883
}
885884

886-
/**
887-
* cap_syslog - Determine whether syslog function is permitted
888-
* @type: Function requested
889-
* @from_file: Whether this request came from an open file (i.e. /proc)
890-
*
891-
* Determine whether the current process is permitted to use a particular
892-
* syslog function, returning 0 if permission is granted, -ve if not.
893-
*/
894-
int cap_syslog(int type, bool from_file)
895-
{
896-
if (type != SYSLOG_ACTION_OPEN && from_file)
897-
return 0;
898-
if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
899-
return -EPERM;
900-
if ((type != SYSLOG_ACTION_READ_ALL &&
901-
type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
902-
return -EPERM;
903-
return 0;
904-
}
905-
906885
/**
907886
* cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
908887
* @mm: The VM space in which the new mapping is to be made

‎security/security.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,9 +197,9 @@ int security_quota_on(struct dentry *dentry)
197197
return security_ops->quota_on(dentry);
198198
}
199199

200-
int security_syslog(int type, bool from_file)
200+
int security_syslog(int type)
201201
{
202-
return security_ops->syslog(type, from_file);
202+
return security_ops->syslog(type);
203203
}
204204

205205
int security_settime(struct timespec *ts, struct timezone *tz)

‎security/selinux/hooks.c

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1973,14 +1973,10 @@ static int selinux_quota_on(struct dentry *dentry)
19731973
return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
19741974
}
19751975

1976-
static int selinux_syslog(int type, bool from_file)
1976+
static int selinux_syslog(int type)
19771977
{
19781978
int rc;
19791979

1980-
rc = cap_syslog(type, from_file);
1981-
if (rc)
1982-
return rc;
1983-
19841980
switch (type) {
19851981
case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
19861982
case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */

‎security/smack/smack_lsm.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -157,15 +157,11 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
157157
*
158158
* Returns 0 on success, error code otherwise.
159159
*/
160-
static int smack_syslog(int type, bool from_file)
160+
static int smack_syslog(int typefrom_file)
161161
{
162-
int rc;
162+
int rc = 0;
163163
char *sp = current_security();
164164

165-
rc = cap_syslog(type, from_file);
166-
if (rc != 0)
167-
return rc;
168-
169165
if (capable(CAP_MAC_OVERRIDE))
170166
return 0;
171167

0 commit comments

Comments
 (0)