Skip to content
This repository has been archived by the owner on Oct 13, 2023. It is now read-only.

[18.09 backport] move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG #64

Merged
merged 1 commit into from
Oct 22, 2018
Merged

[18.09 backport] move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG #64

merged 1 commit into from
Oct 22, 2018

Commits on Oct 2, 2018

  1. Move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG 

    This call is what is used to implement `dmesg` to get kernel messages
about the host. This can leak substantial information about the host.
It is normally available to unprivileged users on the host, unless
the sysctl `kernel.dmesg_restrict = 1` is set, but this is not set
by standard on the majority of distributions. Blocking this to restrict
leaks about the configuration seems correct.

Fix moby#37897

See also https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit ccd22ff)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @justincormack @thaJeztah
    justincormack authored and thaJeztah committed Oct 2, 2018
    Configuration menu
    Copy the full SHA
    16836e6 View commit details
    Browse the repository at this point in the history