Re: klog under linux 2.6.0-test11

On Mon, Dec 08, 2003 at 10:34:42AM +0100, Gerrit Pape wrote:
>On Sat, Dec 06, 2003 at 02:11:53AM -0500, George Georgalis wrote:
>> I've not been able to get socklog-1.0.0 (socklog-klog)
>> to work correctly on Athlon 2.6.0-test11 kernels:
>
>> @400000003fd17d812b9e6b84 socklog: fatal: read(): permission denied
>> 
>> I modified my /etc/socklog/klog/run file as such:
>> #!/bin/sh
>> exec </proc/kmsg
>> exec 2>&1
>> exec softlimit -m 2000000 setuidgid log strace socklog ucspi
>
>The script opens /proc/kmsg as root and redirects standard input to read
>from that file-descriptor, drops permissions to user 'log', and then
>execs socklog to read from standard input.  Even though 'log' doesn't
>have permissions to read the file /proc/kmsg, it's allowed to read from
>the open file-descriptor (stdin).  This should work under normal unixes.

thanks for the clarification, Gerrit.

>Do you have any ``security-patches'' applied to the kernel source that
>need to be configured properly?

Nothing. And I tried many kernel security options (and none).

I sent the command line from your other post (using stdout), and some
additional comments to the Linux lists I'm on. It does sound as if "root
0400" is being enforced, somehow, regardless of perms or that it's
being sent stdout.

/proc/kcore seems another example. On a test box I changed permissions
to 444 but still have no access.

gnats@run:~$ ls /proc/k* -l     
-r--r--r--    1 root     root            0 Dec  8 12:16 /proc/kallsyms
-r--r--r--    1 root     root     939462656 Dec  8 12:16 /proc/kcore
-r--------    1 root     root            0 Dec  8 12:16 /proc/kmsg
gnats@run:~$ cp /proc/kcore zz
cp: cannot open `/proc/kcore' for reading: Operation not permitted

Will follow up when I hear anything.

// George


-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 646-331-2027    <IXOYE><
Security Services, Web, Mail,            mailto:[email protected] 
Multimedia, DB, DNS and Metrics.       http://www.galis.org/george