cap_syslog: don't refuse cap_sys_admin for now (v3)

Please apply.

Quoted 2 lines · Serge E. Hallyn

Please apply.

Hmm. So I detest the duplication and the ugly resulting code. It was a bit hard to follow before, now it's just nasty.

Why not make this all into some nicer helper functions instead - something simple like the attached?

UNTESTED! I'm not going to apply it unless I get acks/tested-by's.

Linus

 kernel/printk.c |   54 +++++++++++++++++++++++++++++++++++-------------------
 1 files changed, 35 insertions(+), 19 deletions(-)

kernel/printk.c +35 -19

index 2ddbdc7..f51214c 100644
@@ -262,25 +262,47 @@ int dmesg_restrict = 1;
 int dmesg_restrict;
 #endif
 
+static int syslog_action_restricted(int type)
+{
+	if (dmesg_restrict)
+		return 1;
+	/* Unless restricted, we allow "read all" and "get buffer size" for everybody */
+	return type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER;
+}
+
+static int check_syslog_permissions(int type, bool from_file)
+{
+	/*
+	 * If this is from /proc/kmsg and we've already opened it, then we've
+	 * already the capabilities checks at open time.
+	 */
+	if (from_file && type != SYSLOG_ACTION_OPEN)
+		return 0;
+
+	if (syslog_action_restricted(type)) {
+		if (capable(CAP_SYSLOG))
+			return 0;
+		/* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
+		if (capable(CAP_SYS_ADMIN)) {
+			WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
+				 "but no CAP_SYSLOG (deprecated).\n");
+			return 0;
+		}
+		return -EPERM;
+	}
+	return 0;
+}
+
 int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
 	unsigned i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error;
 
-	/*
-	 * If this is from /proc/kmsg we only do the capabilities checks
-	 * at open time.
-	 */
-	if (type == SYSLOG_ACTION_OPEN || !from_file) {
-		if (dmesg_restrict && !capable(CAP_SYSLOG))
-			goto warn; /* switch to return -EPERM after 2.6.39 */
-		if ((type != SYSLOG_ACTION_READ_ALL &&
-		     type != SYSLOG_ACTION_SIZE_BUFFER) &&
-		    !capable(CAP_SYSLOG))
-			goto warn; /* switch to return -EPERM after 2.6.39 */
-	}
+	error = check_syslog_permissions(type, from_file);
+	if (error)
+		goto out;
 
 	error = security_syslog(type);
 	if (error)

@@ -423,12 +445,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 	}
 out:
 	return error;
-warn:
-	/* remove after 2.6.39 */
-	if (capable(CAP_SYS_ADMIN))
-		WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
-		  "but no CAP_SYSLOG (deprecated and denied).\n");
-	return -EPERM;
 }
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)

Quoted 2 lines · Serge E. Hallyn

Please apply.

Hmm. So I detest the duplication and the ugly resulting code. It was a bit hard to follow before, now it's just nasty.

Why not make this all into some nicer helper functions instead - something simple like the attached?

UNTESTED! I'm not going to apply it unless I get acks/tested-by's.

Quoted 2 lines · Serge E. Hallyn

Please apply.

Hmm. So I detest the duplication and the ugly resulting code. It was a bit hard to follow before, now it's just nasty.

Why not make this all into some nicer helper functions instead - something simple like the attached?

UNTESTED! I'm not going to apply it unless I get acks/tested-by's.

Linus

 kernel/printk.c |   54 +++++++++++++++++++++++++++++++++++-------------------
 1 files changed, 35 insertions(+), 19 deletions(-)

kernel/printk.c +35 -19

index 2ddbdc7..f51214c 100644
@@ -262,25 +262,47 @@ int dmesg_restrict = 1;
 int dmesg_restrict;
 #endif
 
+static int syslog_action_restricted(int type)
+{
+	if (dmesg_restrict)
+		return 1;
+	/* Unless restricted, we allow "read all" and "get buffer size" for everybody */
+	return type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER;
+}
+
+static int check_syslog_permissions(int type, bool from_file)
+{
+	/*
+	 * If this is from /proc/kmsg and we've already opened it, then we've
+	 * already the capabilities checks at open time.
+	 */
+	if (from_file && type != SYSLOG_ACTION_OPEN)
+		return 0;
+
+	if (syslog_action_restricted(type)) {
+		if (capable(CAP_SYSLOG))
+			return 0;
+		/* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
+		if (capable(CAP_SYS_ADMIN)) {
+			WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
+				 "but no CAP_SYSLOG (deprecated).\n");
+			return 0;
+		}
+		return -EPERM;
+	}
+	return 0;
+}
+
 int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
 	unsigned i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error;
 
-	/*
-	 * If this is from /proc/kmsg we only do the capabilities checks
-	 * at open time.
-	 */
-	if (type == SYSLOG_ACTION_OPEN || !from_file) {
-		if (dmesg_restrict && !capable(CAP_SYSLOG))
-			goto warn; /* switch to return -EPERM after 2.6.39 */
-		if ((type != SYSLOG_ACTION_READ_ALL &&
-		     type != SYSLOG_ACTION_SIZE_BUFFER) &&
-		    !capable(CAP_SYSLOG))
-			goto warn; /* switch to return -EPERM after 2.6.39 */
-	}
+	error = check_syslog_permissions(type, from_file);
+	if (error)
+		goto out;
 
 	error = security_syslog(type);
 	if (error)

@@ -423,12 +445,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 	}
 out:
 	return error;
-warn:
-	/* remove after 2.6.39 */
-	if (capable(CAP_SYS_ADMIN))
-		WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
-		  "but no CAP_SYSLOG (deprecated and denied).\n");
-	return -EPERM;
 }
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)

Convert the WARN_ONCE to a printk_once to avoid this while continuing to give userspace developers a hint that this is an unwanted backward-compatibility feature and won't be around forever.

syslog-ng versions in active use assume that CAP_SYS_ADMIN is sufficent to access syslog. As a result, ever since CAP_SYSLOG was introduce in v2.6.38-rc1~429^2~18 (security: Define CAP_SYSLOG, 2010-11-25), they have triggered a warning, complete with kernel backtrace.

v2.6.38-rc5~46 (cap_syslog: accept CAP_SYS_ADMIN for now, 2011-02-10) made things a little better by removing the regression in behavior, just keeping the WARN_ONCE. But still, this is a warning that adds many lines to syslog, sets a taint flag, and alarms sysadmins when

nothing worse has happened than use of an old userspace with a recent kernel.

Convert the WARN_ONCE to a printk_once to avoid this while continuing to give userspace developers a hint that this is an unwanted backward-compatibility feature and won't be around forever.

Reported-by Ralf Hildebrandt <[email protected]>

Reported-by Niels <[email protected]>

Reported-by Paweł Sikora <[email protected]>

Liked-by Gergely Nagy <[email protected]>

Signed-off-by Jonathan Nieder <[email protected]>

---
Hi,

Nothing urgent about this, but it seems to be a frequently[1] reported[2] source of unnecessary worry. Thoughts?

[1] http://thread.gmane.org/gmane.linux.kernel/1145040
[2] http://thread.gmane.org/gmane.linux.kernel/1153808

Context: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=32;bug=636501

 kernel/printk.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

kernel/printk.c +2 -1

index 37dff342..db64c951 100644
@@ -318,7 +318,8 @@ static int check_syslog_permissions(int type, bool from_file)
 			return 0;
 		/* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
 		if (capable(CAP_SYS_ADMIN)) {
-			WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
+			printk_once(KERN_WARNING
+				 "Attempt to access syslog with CAP_SYS_ADMIN "
 				 "but no CAP_SYSLOG (deprecated).\n");
 			return 0;
 		}

Signature · 1 line

1.7.6

Convert the WARN_ONCE to a printk_once to avoid this while continuing to give userspace developers a hint that this is an unwanted backward-compatibility feature and won't be around forever.

Convert the WARN_ONCE to a printk_once to avoid this while continuing to give userspace developers a hint that this is an unwanted backward-compatibility feature and won't be around forever.

The problem with this one is that converting away from a warning doesn't just get rid of all the ugliness, it gets rid of some of the *useful* information in the warning too.

In particular, when you have a warning like "Attempting to access syslog", you'd better tell people *who* is attempting to access syslog, so that they can fix it or complain to the right person.