From: "Serge E. Hallyn" <serue@us.ibm.com> To: James Morris <jmorris@namei.org> Cc: lkml <linux-kernel@vger.kernel.org>, SELinux <selinux@tycho.nsa.gov>, linux-security-module@vger.kernel.org, Stephen Smalley <sds@epoch.ncsc.mil>, Kees Cook <kees.cook@canonical.com>, Andrew Morgan <morgan@kernel.org>, Michael Kerrisk <mtk.manpages@gmail.com>, "Christopher J. PeBenito" <cpebenito@tresys.com>, Eric Paris <eparis@parisplace.org> Subject: [PATCH] Define CAP_SYSLOG Date: Fri, 12 Mar 2010 14:55:37 -0600 [thread overview] Message-ID: <20100312205537.GA1091@us.ibm.com> (raw) Privileged syslog operations currently require CAP_SYS_ADMIN. Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set. With this patch, an lxc container can be prevented from messing with the host's syslog (i.e. dmesg -c). There is one downside to this patch: If some site or distro currently has syslogd/whatever running as a non-root user with cap_sys_admin+pe, then it will need to be changed to run with cap_syslog+pe. I don't know if there are such sites, or if that concern means we should take a different approach to introducing this change, or simply refuse this change. I'm also sending out corresponding patches for libcap and refpolicy, and will whip up a man-pages patch next week. Changelog: mar 12 2010: add selinux capability2:cap_syslog perm Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Acked-By: Kees Cook <kees.cook@canonical.com> Cc: James Morris <jmorris@namei.org> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Cc: "Christopher J. PeBenito" <cpebenito@tresys.com> Cc: Eric Paris <eparis@parisplace.org> --- include/linux/capability.h | 7 +++++-- security/commoncap.c | 2 +- security/selinux/include/classmap.h | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/include/linux/capability.h b/include/linux/capability.h index 39e5ff5..837a55c 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -249,7 +249,6 @@ struct cpu_vfs_cap_data { /* Allow configuration of the secure attention key */ /* Allow administration of the random device */ /* Allow examination and configuration of disk quotas */ -/* Allow configuring the kernel's syslog (printk behaviour) */ /* Allow setting the domainname */ /* Allow setting the hostname */ /* Allow calling bdflush() */ @@ -355,7 +354,11 @@ struct cpu_vfs_cap_data { #define CAP_MAC_ADMIN 33 -#define CAP_LAST_CAP CAP_MAC_ADMIN +/* Allow configuring the kernel's syslog (printk behaviour) */ + +#define CAP_SYSLOG 34 + +#define CAP_LAST_CAP CAP_SYSLOG #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff --git a/security/commoncap.c b/security/commoncap.c index 6166973..018985e 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -899,7 +899,7 @@ int cap_syslog(int type, bool from_file) if (type != SYSLOG_ACTION_OPEN && from_file) return 0; if ((type != SYSLOG_ACTION_READ_ALL && - type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN)) + type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYSLOG)) return -EPERM; return 0; } diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 8b32e95..f03cf56 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = { "node_bind", "name_connect", NULL } }, { "memprotect", { "mmap_zero", NULL } }, { "peer", { "recv", NULL } }, - { "capability2", { "mac_override", "mac_admin", NULL } }, + { "capability2", { "mac_override", "mac_admin", "syslog", NULL } }, { "kernel_service", { "use_as_override", "create_files_as", NULL } }, { "tun_socket", { COMMON_SOCK_PERMS, NULL } }, -- 1.6.1
WARNING: multiple messages have this Message-ID (diff)
From: "Serge E. Hallyn" <serue@us.ibm.com> To: James Morris <jmorris@namei.org> Cc: lkml <linux-kernel@vger.kernel.org>, SELinux <selinux@tycho.nsa.gov>, linux-security-module@vger.kernel.org, Stephen Smalley <sds@epoch.ncsc.mil>, Kees Cook <kees.cook@canonical.com>, Andrew Morgan <morgan@kernel.org>, Michael Kerrisk <mtk.manpages@gmail.com>, "Christopher J. PeBenito" <cpebenito@tresys.com>, Eric Paris <eparis@parisplace.org> Subject: [PATCH] Define CAP_SYSLOG Date: Fri, 12 Mar 2010 14:55:37 -0600 [thread overview] Message-ID: <20100312205537.GA1091@us.ibm.com> (raw) Privileged syslog operations currently require CAP_SYS_ADMIN. Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set. With this patch, an lxc container can be prevented from messing with the host's syslog (i.e. dmesg -c). There is one downside to this patch: If some site or distro currently has syslogd/whatever running as a non-root user with cap_sys_admin+pe, then it will need to be changed to run with cap_syslog+pe. I don't know if there are such sites, or if that concern means we should take a different approach to introducing this change, or simply refuse this change. I'm also sending out corresponding patches for libcap and refpolicy, and will whip up a man-pages patch next week. Changelog: mar 12 2010: add selinux capability2:cap_syslog perm Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Acked-By: Kees Cook <kees.cook@canonical.com> Cc: James Morris <jmorris@namei.org> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Cc: "Christopher J. PeBenito" <cpebenito@tresys.com> Cc: Eric Paris <eparis@parisplace.org> --- include/linux/capability.h | 7 +++++-- security/commoncap.c | 2 +- security/selinux/include/classmap.h | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/include/linux/capability.h b/include/linux/capability.h index 39e5ff5..837a55c 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -249,7 +249,6 @@ struct cpu_vfs_cap_data { /* Allow configuration of the secure attention key */ /* Allow administration of the random device */ /* Allow examination and configuration of disk quotas */ -/* Allow configuring the kernel's syslog (printk behaviour) */ /* Allow setting the domainname */ /* Allow setting the hostname */ /* Allow calling bdflush() */ @@ -355,7 +354,11 @@ struct cpu_vfs_cap_data { #define CAP_MAC_ADMIN 33 -#define CAP_LAST_CAP CAP_MAC_ADMIN +/* Allow configuring the kernel's syslog (printk behaviour) */ + +#define CAP_SYSLOG 34 + +#define CAP_LAST_CAP CAP_SYSLOG #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff --git a/security/commoncap.c b/security/commoncap.c index 6166973..018985e 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -899,7 +899,7 @@ int cap_syslog(int type, bool from_file) if (type != SYSLOG_ACTION_OPEN && from_file) return 0; if ((type != SYSLOG_ACTION_READ_ALL && - type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN)) + type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYSLOG)) return -EPERM; return 0; } diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 8b32e95..f03cf56 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -142,7 +142,7 @@ struct security_class_mapping secclass_map[] = { "node_bind", "name_connect", NULL } }, { "memprotect", { "mmap_zero", NULL } }, { "peer", { "recv", NULL } }, - { "capability2", { "mac_override", "mac_admin", NULL } }, + { "capability2", { "mac_override", "mac_admin", "syslog", NULL } }, { "kernel_service", { "use_as_override", "create_files_as", NULL } }, { "tun_socket", { COMMON_SOCK_PERMS, NULL } }, -- 1.6.1 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
next reply other threads:[~2010-03-12 20:56 UTC|newest] Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top 2010-03-12 20:55 Serge E. Hallyn [this message] 2010-03-12 20:55 ` [PATCH] Define CAP_SYSLOG Serge E. Hallyn 2010-03-12 20:58 ` [refpolicy] [PATCH refpolicy] add capability2:syslog perm Serge E. Hallyn 2010-03-14 5:18 ` [PATCH] Define CAP_SYSLOG Michael Kerrisk 2010-03-14 5:35 ` Serge E. Hallyn 2010-03-14 5:35 ` Serge E. Hallyn 2010-03-15 1:16 ` Matthew Helsley 2010-03-15 4:24 ` Serge E. Hallyn 2010-03-15 4:24 ` Serge E. Hallyn 2010-10-31 22:36 ` Console Login and SSH Login Security Contexts Hasan Rezaul-CHR010 2010-11-01 15:59 ` Christopher J. PeBenito 2010-11-01 21:11 ` Hasan Rezaul-CHR010 2010-11-02 7:48 ` HarryCiao 2010-11-02 13:36 ` Christopher J. PeBenito 2010-11-02 18:12 ` Hasan Rezaul-CHR010 2010-11-01 5:27 ` Format of file_contexts file Hasan Rezaul-CHR010 2010-11-01 16:02 ` Christopher J. PeBenito
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20100312205537.GA1091@us.ibm.com \ --to=serue@us.ibm.com \ --cc=cpebenito@tresys.com \ --cc=eparis@parisplace.org \ --cc=jmorris@namei.org \ --cc=kees.cook@canonical.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=morgan@kernel.org \ --cc=mtk.manpages@gmail.com \ --cc=sds@epoch.ncsc.mil \ --cc=selinux@tycho.nsa.gov \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.