Jingzi Meng 09ce61e27d cap_syslog: remove CAP_SYS_ADMIN when dmesg_restrict ...

CAP_SYSLOG was separated from CAP_SYS_ADMIN and introduced in Linux
2.6.37 (2010-11). For a long time, certain syslog actions required
CAP_SYS_ADMIN or CAP_SYSLOG. Maybe it’s time to officially remove
CAP_SYS_ADMIN for more fine-grained control.

CAP_SYS_ADMIN was once removed but added back for backwards
compatibility reasons. In commit 38ef4c2e43 ("syslog: check cap_syslog
when dmesg_restrict") (2010-12), CAP_SYS_ADMIN was no longer needed. And
in commit ee24aebffb ("cap_syslog: accept CAP_SYS_ADMIN for now")
(2011-02), it was accepted again. Since then, CAP_SYS_ADMIN has been
preserved.

Now that almost 13 years have passed, the legacy application may have
had enough time to be updated.

Signed-off-by: Jingzi Meng <mengjingzi@iie.ac.cn>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240105062007.26965-1-mengjingzi@iie.ac.cn
Signed-off-by: Kees Cook <keescook@chromium.org>

2024-02-01 10:04:58 -08:00

..

braille.c

…

braille.h

…

console_cmdline.h

…

index.c

kernel/printk/index.c: fix memory leak with using debugfs_lookup()

2023-02-03 10:42:02 +01:00

internal.h

printk: nbcon: Add emit function and callback function for atomic printing

2023-09-18 17:03:45 +02:00

Makefile

printk: Add non-BKL (nbcon) console basic infrastructure

2023-09-18 17:03:45 +02:00

nbcon.c

printk: nbcon: Allow drivers to mark unsafe regions and check state

2023-09-18 17:03:46 +02:00

printk_ringbuffer.c

printk: ringbuffer: Fix truncating buffer size min_t cast

2023-08-14 13:05:22 +02:00

printk_ringbuffer.h

…

printk_safe.c

printk: Consolidate console deferred printing

2023-07-20 13:06:22 +02:00

printk.c

cap_syslog: remove CAP_SYS_ADMIN when dmesg_restrict

2024-02-01 10:04:58 -08:00

sysctl.c

…