| 
									
										
										
										
											2010-02-03 15:36:43 -08:00
										 |  |  | /*  Syslog internals
 | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  *  Copyright 2010 Canonical, Ltd. | 
					
						
							|  |  |  |  *  Author: Kees Cook <kees.cook@canonical.com> | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  *  This program is free software; you can redistribute it and/or modify | 
					
						
							|  |  |  |  *  it under the terms of the GNU General Public License as published by | 
					
						
							|  |  |  |  *  the Free Software Foundation; either version 2, or (at your option) | 
					
						
							|  |  |  |  *  any later version. | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  *  This program is distributed in the hope that it will be useful, | 
					
						
							|  |  |  |  *  but WITHOUT ANY WARRANTY; without even the implied warranty of | 
					
						
							|  |  |  |  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the | 
					
						
							|  |  |  |  *  GNU General Public License for more details. | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  *  You should have received a copy of the GNU General Public License | 
					
						
							|  |  |  |  *  along with this program; see the file COPYING.  If not, write to | 
					
						
							|  |  |  |  *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | 
					
						
							|  |  |  |  */ | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | #ifndef _LINUX_SYSLOG_H
 | 
					
						
							|  |  |  | #define _LINUX_SYSLOG_H
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2010-02-03 15:37:13 -08:00
										 |  |  | /* Close the log.  Currently a NOP. */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_CLOSE          0
 | 
					
						
							|  |  |  | /* Open the log. Currently a NOP. */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_OPEN           1
 | 
					
						
							|  |  |  | /* Read from the log. */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_READ           2
 | 
					
						
							|  |  |  | /* Read all messages remaining in the ring buffer. */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_READ_ALL       3
 | 
					
						
							|  |  |  | /* Read and clear all messages remaining in the ring buffer */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_READ_CLEAR     4
 | 
					
						
							|  |  |  | /* Clear ring buffer. */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_CLEAR          5
 | 
					
						
							|  |  |  | /* Disable printk's to console */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_CONSOLE_OFF    6
 | 
					
						
							|  |  |  | /* Enable printk's to console */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_CONSOLE_ON     7
 | 
					
						
							|  |  |  | /* Set level of messages printed to console */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_CONSOLE_LEVEL  8
 | 
					
						
							|  |  |  | /* Return number of unread characters in the log buffer */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_SIZE_UNREAD    9
 | 
					
						
							|  |  |  | /* Return size of the log buffer */ | 
					
						
							|  |  |  | #define SYSLOG_ACTION_SIZE_BUFFER   10
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
											  
											
												kmsg: honor dmesg_restrict sysctl on /dev/kmsg
The dmesg_restrict sysctl currently covers the syslog method for access
dmesg, however /dev/kmsg isn't covered by the same protections.  Most
people haven't noticed because util-linux dmesg(1) defaults to using the
syslog method for access in older versions.  With util-linux dmesg(1)
defaults to reading directly from /dev/kmsg.
To fix /dev/kmsg, let's compare the existing interfaces and what they
allow:
 - /proc/kmsg allows:
  - open (SYSLOG_ACTION_OPEN) if CAP_SYSLOG since it uses a destructive
    single-reader interface (SYSLOG_ACTION_READ).
  - everything, after an open.
 - syslog syscall allows:
  - anything, if CAP_SYSLOG.
  - SYSLOG_ACTION_READ_ALL and SYSLOG_ACTION_SIZE_BUFFER, if
    dmesg_restrict==0.
  - nothing else (EPERM).
The use-cases were:
 - dmesg(1) needs to do non-destructive SYSLOG_ACTION_READ_ALLs.
 - sysklog(1) needs to open /proc/kmsg, drop privs, and still issue the
   destructive SYSLOG_ACTION_READs.
AIUI, dmesg(1) is moving to /dev/kmsg, and systemd-journald doesn't
clear the ring buffer.
Based on the comments in devkmsg_llseek, it sounds like actions besides
reading aren't going to be supported by /dev/kmsg (i.e.
SYSLOG_ACTION_CLEAR), so we have a strict subset of the non-destructive
syslog syscall actions.
To this end, move the check as Josh had done, but also rename the
constants to reflect their new uses (SYSLOG_FROM_CALL becomes
SYSLOG_FROM_READER, and SYSLOG_FROM_FILE becomes SYSLOG_FROM_PROC).
SYSLOG_FROM_READER allows non-destructive actions, and SYSLOG_FROM_PROC
allows destructive actions after a capabilities-constrained
SYSLOG_ACTION_OPEN check.
 - /dev/kmsg allows:
  - open if CAP_SYSLOG or dmesg_restrict==0
  - reading/polling, after open
Addresses https://bugzilla.redhat.com/show_bug.cgi?id=903192
[akpm@linux-foundation.org: use pr_warn_once()]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Christian Kujau <lists@nerdbynature.de>
Tested-by: Josh Boyer <jwboyer@redhat.com>
Cc: Kay Sievers <kay@vrfy.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
											
										 
											2013-06-12 14:04:39 -07:00
										 |  |  | #define SYSLOG_FROM_READER           0
 | 
					
						
							|  |  |  | #define SYSLOG_FROM_PROC             1
 | 
					
						
							| 
									
										
										
										
											2010-02-03 15:36:43 -08:00
										 |  |  | 
 | 
					
						
							|  |  |  | int do_syslog(int type, char __user *buf, int count, bool from_file); | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | #endif /* _LINUX_SYSLOG_H */
 |