Per-system-call kernel-stack offset randomization

Posted Mar 30, 2020 17:14 UTC (Mon) by zdzichu (subscriber, #17118)
In reply to: Per-system-call kernel-stack offset randomization by jimi
Parent article: Per-system-call kernel-stack offset randomization

It's upstream kernel option:

config SECURITY_DMESG_RESTRICT
bool "Restrict unprivileged access to the kernel syslog"
default n
help
This enforces restrictions on unprivileged users reading the kernel
syslog via dmesg(8).

It's there for over 9 years.

Per-system-call kernel-stack offset randomization

Posted Mar 30, 2020 17:58 UTC (Mon) by jimi (guest, #6655) [Link] (2 responses)

Ah - thank you for enlightening me.

So I'm left wondering, why not set the default to y? At least one distro runs with this restricted with no ill effects. What are the reasons to not restrict?

Per-system-call kernel-stack offset randomization

Posted Mar 30, 2020 19:07 UTC (Mon) by madscientist (subscriber, #16861) [Link] (1 responses)

I expect there will be repercussions. For example, we have a daemon that runs on systems that can be asked to retrieve diagnostic information about a system, and dmesg output is often a critical aspect of that (for example, determining if processes were killed due to OOM, or hardware issues, etc.) Of course, we do not want such a daemon to have to run as root.

Restricting access to important system information to root will just provide incentive to give root access to more things, which seems like an anti-pattern to me.

If dmesg output is really a security issue then of course something needs to be done, but some careful thought is appropriate.

Per-system-call kernel-stack offset randomization

Posted Mar 30, 2020 21:32 UTC (Mon) by simcop2387 (subscriber, #101710) [Link]

You don't have to give it root, just give it CAP_SYSLOG which if it's a tool to gather diagnostic information would probably be needed anyway.

Per-system-call kernel-stack offset randomization

Posted Apr 6, 2020 16:42 UTC (Mon) by zdzichu (subscriber, #17118) [Link]

Actually there's even a sysctl file: /proc/sys/kernel/dmesg_restrict. It's can be toggled any time.