Date: Wed, 26 Oct 2011 13:43:16 -0400 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict On Wed, Oct 26, 2011 at 11:16 AM, Petr Matousek <pmatouse@...hat.com> wrote: > When dmesg_restrict is set to 1 CAP_SYS_ADMIN is needed to read the > kernel ring buffer. But a root user without CAP_SYS_ADMIN is able > to reset dmesg_restrict to 0. > Minor correction: CAP_SYSLOG is needed to read the kernel ring buffer, with CAP_SYS_ADMIN being a fallback for legacy reasons. But it's correct that CAP_SYS_ADMIN is now required to modify the sysctl. I also agree with Vasiliy's point that LXC security boundaries in the mainline kernel are not well defined at this point, so the whole thing is a bit silly. -Dan
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.