Patch "security_syslog() should be called once only" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

security_syslog() should be called once only

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
security_syslog-should-be-called-once-only.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Vasily Averin <[email protected]>
Date: Thu, 25 Jun 2015 15:01:44 -0700
Subject: security_syslog() should be called once only

From: Vasily Averin <[email protected]>

commit d194e5d666225b04c7754471df0948f645b6ab3a upstream.

The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are processed incorrectly:

- open of /dev/kmsg checks syslog access permissions by using check_syslog_permissions() where security_syslog() is not called if dmesg_restrict is set.

- syslog syscall and /proc/kmsg calls do_syslog() where security_syslog can be executed twice (inside check_syslog_permissions() and then directly in do_syslog())

With this patch security_syslog() is called once only in all syslog-related operations regardless of dmesg_restrict value.

---
 kernel/printk/printk.c |   11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

@@ -383,11 +383,11 @@ static int check_syslog_permissions(int
 	 * already done the capabilities checks at open time.
 	 */
 	if (from_file && type != SYSLOG_ACTION_OPEN)
-		return 0;
+		goto ok;
 
 	if (syslog_action_restricted(type)) {
 		if (capable(CAP_SYSLOG))
-			return 0;
+			goto ok;
 		/*
 		 * For historical reasons, accept CAP_SYS_ADMIN too, with
 		 * a warning.

@@ -397,10 +397,11 @@ static int check_syslog_permissions(int
 				     "CAP_SYS_ADMIN but no CAP_SYSLOG "
 				     "(deprecated).\n",
 				 current->comm, task_pid_nr(current));
-			return 0;
+			goto ok;
 		}
 		return -EPERM;
 	}
+ok:
 	return security_syslog(type);
 }
 

@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf
 	if (error)
 		goto out;
 
-	error = security_syslog(type);
-	if (error)
-		return error;
-
 	switch (type) {
 	case SYSLOG_ACTION_CLOSE:	/* Close log */
 		break;

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/security_syslog-should-be-called-once-only.patch