GNU bug report logs - #36701
[PATCH] gnu: linux-libre: Restrict ‘dmesg’ to privileged users.

Previous Next

Package: guix-patches;

Reported by: Tobias Geerinckx-Rice <me <at> tobias.gr>

Date: Wed, 17 Jul 2019 07:27:02 UTC

Severity: normal

Tags: patch

Done: Tobias Geerinckx-Rice <me <at> tobias.gr>

Bug is archived. No further changes may be made.

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 36701 in the body.
You can then email your comments to 36701 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to guix-patches <at> gnu.org:
bug#36701; Package guix-patches. (Wed, 17 Jul 2019 07:27:02 GMT) Full text and rfc822 format available.
Acknowledgement sent to Tobias Geerinckx-Rice <me <at> tobias.gr>:
New bug report received and forwarded. Copy sent to guix-patches <at> gnu.org. (Wed, 17 Jul 2019 07:27:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: guix-devel <at> gnu.org,
	guix-patches <at> gnu.org
Subject: [PATCH] gnu: linux-libre: Restrict ‘dmesg’ to privileged users.
Date: Wed, 17 Jul 2019 09:26:08 +0200

* gnu/packages/linux.scm (%default-extra-linux-options):
Set CONFIG_SECURITY_DMESG_RESTRICT.
---

Re: https://lists.gnu.org/archive/html/guix-devel/2019-07/msg00258.html

Patchy patch.

 gnu/packages/linux.scm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 30192f195d..73c7083e7c 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -273,7 +273,9 @@ for ARCH and optionally VARIANT, or #f if there is no such configuration."
     (search-auxiliary-file file)))
 
 (define %default-extra-linux-options
-  `(;; Modules required for initrd:
+  `(;; Some very mild hardening.
+    ("CONFIG_SECURITY_DMESG_RESTRICT" . #t)
+    ;; Modules required for initrd:
     ("CONFIG_NET_9P" . m)
     ("CONFIG_NET_9P_VIRTIO" . m)
     ("CONFIG_VIRTIO_BLK" . m)
-- 
2.22.0
Information forwarded to guix-patches <at> gnu.org:
bug#36701; Package guix-patches. (Fri, 26 Jul 2019 22:43:02 GMT) Full text and rfc822 format available.

Message #8 received at 36701 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Tobias Geerinckx-Rice <me <at> tobias.gr>
Cc: guix-devel <at> gnu.org, 36701 <at> debbugs.gnu.org
Subject: Re: [bug#36701] [PATCH] gnu: linux-libre: Restrict ‘dmesg’ to privileged users.
Date: Sat, 27 Jul 2019 00:41:47 +0200

Tobias Geerinckx-Rice <me <at> tobias.gr> skribis:

> * gnu/packages/linux.scm (%default-extra-linux-options):
> Set CONFIG_SECURITY_DMESG_RESTRICT.

Go for it!

Ludo’.
Reply sent to Tobias Geerinckx-Rice <me <at> tobias.gr>:
You have taken responsibility. (Fri, 26 Jul 2019 23:20:04 GMT) Full text and rfc822 format available.
Notification sent to Tobias Geerinckx-Rice <me <at> tobias.gr>:
bug acknowledged by developer. (Fri, 26 Jul 2019 23:20:04 GMT) Full text and rfc822 format available.

Message #13 received at 36701-done <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 36701-done <at> debbugs.gnu.org
Subject: Re: [bug#36701] [PATCH] gnu: linux-libre: Restrict ‘dmesg’ to privileged users.
Date: Sat, 27 Jul 2019 01:19:29 +0200

[Message part 1 (text/plain, inline)]
Ludo',

Ludovic Courtès 写道：
> Tobias Geerinckx-Rice <me <at> tobias.gr> skribis:
>
>> * gnu/packages/linux.scm (%default-extra-linux-options):
>> Set CONFIG_SECURITY_DMESG_RESTRICT.
>
> Go for it!

Pushed as 24446ce299943efe3dfded6c9dd0cf9421d8da04.

Thanks!

T G-R

[signature.asc (application/pgp-signature, inline)]
bug archived. Request was from Debbugs Internal Request <help-debbugs <at> gnu.org> to internal_control <at> debbugs.gnu.org. (Sat, 24 Aug 2019 11:24:03 GMT) Full text and rfc822 format available.
This bug report was last modified 4 years and 246 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.