Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 13 Mar 2015 09:55:18 -0500
From: Grandma Eubanks <tborland1@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Disabling reading of kernel log buffer reading for user

Yeah, now comes the fun part. How to abuse services to bypass it?
Also, have you checked what happens with KASLR? Where it writes where the
new segments are?

I have a bug ticket open with redhat for a while now on abusing a
particular service that ends up dumping dmesg and chmod's it to any user
privilege to navigate around dmesg_restrict.

On Fri, Mar 13, 2015 at 7:44 AM, Jann Horn <jann@...jh.net> wrote:

> On Fri, Mar 13, 2015 at 09:56:58AM +0000, halfdog wrote:
> > * What would be the side effects of making /dev/kmesg only root
> accessible? Maybe syslog not able to write kmessages to log?
> > * Would it be safe to disable the syslog syscall for action
> SYSLOG_ACTION_READ_* and all users except root and syslog? Does someone
> have tested selinux config for that?
>
> /proc/sys/kernel/dmesg_restrict can be used to restrict access to the log
> buffer.
> It looks like at least rsyslogd uses /proc/kmsg to read messages from the
> log
> buffer, and that file is only accessible for root anyway.
>

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ