Skip to contentSkip to conversation

Define CAP_SYSLOG

RFC PATCH In review Serge E. Hallyn 4 participants 4 messages Mar 5, 2010 – Mar 12, 2010 1 message not in the archive

Subsystems (2)
Security (LSM) Capabilities
lore
Share & tools
lore

Serge E. Hallyn

author
#0 lore raw

RFC PATCH 1/1 Define CAP_SYSLOG

Privileged syslog operations currently require CAP_SYS_ADMIN. Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set.

With this patch, an lxc container can be prevented from messing with the host's syslog.

There is one downside to this patch: If some site or distro currently has syslogd/whatever running as a non-root user with cap_sys_admin+pe, then it will need to be changed to run with cap_syslog+pe. I don't know if there are such sites, or if that concern means we should take a different approach to introducing this change, or simply refuse this change.

Signed-off-by Serge E. Hallyn <[email protected]>
---
 include/linux/capability.h |    7 +++++--
 security/commoncap.c       |    2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)
include/linux/capability.h +5 -2
index 39e5ff5..837a55c 100644
@@ -249,7 +249,6 @@ struct cpu_vfs_cap_data {
 /* Allow configuration of the secure attention key */
 /* Allow administration of the random device */
 /* Allow examination and configuration of disk quotas */
-/* Allow configuring the kernel's syslog (printk behaviour) */
 /* Allow setting the domainname */
 /* Allow setting the hostname */
 /* Allow calling bdflush() */

@@ -355,7 +354,11 @@ struct cpu_vfs_cap_data {
 
 #define CAP_MAC_ADMIN        33
 
-#define CAP_LAST_CAP         CAP_MAC_ADMIN
+/* Allow configuring the kernel's syslog (printk behaviour) */
+
+#define CAP_SYSLOG           34
+
+#define CAP_LAST_CAP         CAP_SYSLOG
 
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
security/commoncap.c +1 -1
index 6166973..018985e 100644
@@ -899,7 +899,7 @@ int cap_syslog(int type, bool from_file)
 	if (type != SYSLOG_ACTION_OPEN && from_file)
 		return 0;
 	if ((type != SYSLOG_ACTION_READ_ALL &&
-	     type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
+	     type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYSLOG))
 		return -EPERM;
 	return 0;
 }
Signature · 1 line
1.6.1
Acked-by on v1 1/1
#1 lore raw

Hi Serge,

Quoted 3 lines · Serge E. Hallyn

Privileged syslog operations currently require CAP_SYS_ADMIN. Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set.

Seems like a good idea, but it'll require code changes in libcap2, libcap-ng, as well as manpages.

I support the idea -- more stuff needs to be extracted from CAP_SYS_ADMIN, but this is a nice distinct subsystem to do now.

Acked-by Kees Cook <[email protected]>
Signature · 2 lines
Kees Cook
Ubuntu Security Team
Acked-by
#2 lore raw
Acked-by Andrew G. Morgan <[email protected]>

I concur with Kees.

Cheers

Andrew

Quoted 15 lines · Kees Cook

Hi Serge,

Quoted 3 lines · Serge E. Hallyn

Privileged syslog operations currently require CAP_SYS_ADMIN.  Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set.

Seems like a good idea, but it'll require code changes in libcap2, libcap-ng, as well as manpages.

I support the idea -- more stuff needs to be extracted from CAP_SYS_ADMIN, but this is a nice distinct subsystem to do now.

Acked-by Kees Cook <[email protected]>
Quoted 8 lines

--
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 551280e51003101719t3c61da42ja5796b3d86b0126a-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org

#4 lore raw

Thanks, guys - I also need to update the selinux classmap in both kernel and policy. Hoping to get around to that this afternoon, but not sure.

-serge

Quoted 32 lines · Andrew G. Morgan
Acked-by Andrew G. Morgan <[email protected]>

I concur with Kees.

Cheers

Andrew

Quoted 23 lines · Kees Cook

Hi Serge,

Quoted 3 lines · Serge E. Hallyn

Privileged syslog operations currently require CAP_SYS_ADMIN.  Split this off into a new CAP_SYSLOG privilege which we can sanely take away from a container through the capability bounding set.

Seems like a good idea, but it'll require code changes in libcap2, libcap-ng, as well as manpages.

I support the idea -- more stuff needs to be extracted from CAP_SYS_ADMIN, but this is a nice distinct subsystem to do now.

Acked-by Kees Cook <[email protected]>

--
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected] More majordomo info at  http://vger.kernel.org/majordomo-info.html