* - make-reading-proc-sys-kernel-cap-bould-not-require.patch removed from -mm tree
@ 2007-02-11 22:46 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2007-02-11 22:46 UTC (permalink / raw)
To: eparis, chrisw, jmorris, sds, mm-commits
The patch titled
make reading /proc/sys/kernel/cap-bould not require CAP_SYS_MODULE
has been removed from the -mm tree. Its filename was
make-reading-proc-sys-kernel-cap-bould-not-require.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: make reading /proc/sys/kernel/cap-bould not require CAP_SYS_MODULE
From: Eric Paris <eparis@redhat.com>
Reading /proc/sys/kernel/cap-bound requires CAP_SYS_MODULE. (see
proc_dointvec_bset in kernel/sysctl.c)
sysctl appears to drive all over proc reading everything it can get it's
hands on and is complaining when it is being denied access to read
cap-bound. Clearly writing to cap-bound should be a sensitive operation
but requiring CAP_SYS_MODULE to read cap-bound seems a bit to strong. I
believe the information could with reasonable certainty be obtained by
looking at a bunch of the output of /proc/pid/status which has very low
security protection, so at best we are just getting a little obfuscation of
information.
Currently SELinux policy has to 'dontaudit' capability checks for
CAP_SYS_MODULE for things like sysctl which just want to read cap-bound.
In doing so we also as a byproduct have to hide warnings of potential
exploits such as if at some time that sysctl actually tried to load a
module. I wondered if anyone would have a problem opening cap-bound up to
read from anyone?
Acked-by: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
kernel/sysctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN kernel/sysctl.c~make-reading-proc-sys-kernel-cap-bould-not-require kernel/sysctl.c
--- a/kernel/sysctl.c~make-reading-proc-sys-kernel-cap-bould-not-require
+++ a/kernel/sysctl.c
@@ -1961,7 +1961,7 @@ int proc_dointvec_bset(ctl_table *table,
{
int op;
- if (!capable(CAP_SYS_MODULE)) {
+ if (write && !capable(CAP_SYS_MODULE)) {
return -EPERM;
}
_
Patches currently in -mm which might be from eparis@redhat.com are
origin.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-02-11 22:48 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-02-11 22:46 - make-reading-proc-sys-kernel-cap-bould-not-require.patch removed from -mm tree akpm
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.