Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 653254

Summary:	kernel: restrict unprivileged access to kernel syslog [mrg-2.1]
Product:	Red Hat Enterprise MRG	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	realtime-kernel	Assignee:	John Kacur <jkacur>
Status:	CLOSED CURRENTRELEASE	QA Contact:	David Sommerseth <davids>
Severity:	high	Docs Contact:
Priority:	high
Version:	2.0	CC:	bhu, jkacur, lgoncalv, ovasik, williams
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	653245	Environment:
Last Closed:	2014-09-25 20:06:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	653245
Bug Blocks:	653250, 653252

Description Eugene Teo (Security Response) 2010-11-15 04:31:45 UTC

+++ This bug was initially created as a clone of Bug #653245 +++

Description of problem:
The kernel syslog contains debugging information that is often useful during exploitation of other vulnerabilities, such as kernel heap addresses.  Rather than futilely attempt to sanitize hundreds (or thousands) of printk statements and simultaneously cripple useful debugging functionality, it is far simpler to create an option that prevents unprivileged users from reading the syslog.
    
This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the dmesg_restrict sysctl.  When set to "0", the default, no restrictions are enforced.  When set to "1", only users with CAP_SYS_ADMIN can read the kernel syslog via dmesg(8) or other mechanisms.

Upstream commit:
http://git.kernel.org/linus/eaf06b241b091357e72b76863ba16e89610d31bd

Comment 1 Eugene Teo (Security Response) 2011-06-02 09:10:00 UTC

mv 1.3 to 2.0

Comment 2 Eugene Teo (Security Response) 2011-10-03 04:57:44 UTC

The patch is in rt-3.0.4-rt14 as far as I can see.

Comment 5 Beth Uptagrafft 2014-09-25 20:06:41 UTC

The patch was in rt-3.0.4-rt14