DragonFly BSD
DragonFly submit List (threaded) for 2005-09
[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]

[PATCH] Prevent unpriv user from reading the message buffer


From: Matthias Schmidt <schmidtm@xxxxxxxxxxxxxxxxxxxxxxxxx>
Date: Thu, 29 Sep 2005 18:47:39 +0200

Moin,

I ported the security.bsd.unprivileged_read_msgbuf from FreeBSD. This sysctl prevents unprivileged users from reading the message buffer. A nice feature especially for machines with lot of shell users :)

With kern.unprivileged_read_msgbuf=1 (default)

% dmesg
Copyright (c) 2003, 2004, 2005 The DragonFly Project.
[...]

With kern.unprivileged_read_msgbuf=0

% dmesg
dmesg: sysctl kern.msgbuf: Operation not permitted

I added the sysctl now under kern, but I think a sysctl named security would be a good idea for such options?!


Greets


Matthias
diff -urN sys.orig/kern/subr_prf.c sys/kern/subr_prf.c
--- sys.orig/kern/subr_prf.c	2004-09-13 18:22:36.000000000 +0200
+++ sys/kern/subr_prf.c	2005-09-29 17:11:13.000000000 +0200
@@ -867,12 +867,23 @@
 	oldp = msgbufp;
 }
 
+static int unprivileged_read_msgbuf = 1;
+SYSCTL_INT(_kern, OID_AUTO, unprivileged_read_msgbuf,
+    CTLFLAG_RW, &unprivileged_read_msgbuf, 0,
+    "Unprivileged processes may read the kernel message buffer");
+
 /* Sysctls for accessing/clearing the msgbuf */
 static int
 sysctl_kern_msgbuf(SYSCTL_HANDLER_ARGS)
 {
 	int error;
 
+	if (!unprivileged_read_msgbuf) {
+		error = suser(req->td);
+		if (error)
+			return (error);
+	}
+
 	/*
 	 * Unwind the buffer, so that it's linear (possibly starting with
 	 * some initial nulls).


[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]