Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    c9630dc6
    shell.te: revoke syslog(2) access to shell user · c9630dc6
    Nick Kralevich authored
    external/toybox commit a583afc812cf7be74ebab72294c8df485908ff04 started
    having dmesg use /dev/kmsg, which is unreadable to the unprivileged
    shell user. Revoke syslog(2) to the shell user for consistency.
    
    The kernel dmesg log is a source of kernel pointers, which can leak
    kASLR information from the kernel. Restricting access to kernel
    information will make attacks against Android more difficult. Having
    said that, dmesg information is still available from "adb bugreport", so
    this change doesn't completely shutdown kernel info leaks.
    
    This change essentially reverts us to the state we were in between Nov 8
    2011 and May 27 2014. During that almost 3 year period, the unprivileged
    shell user was unable to access dmesg, and there was only one complaint
    during that time.
    
    References:
    * https://android.googlesource.com/platform/system/core/+/f9557fb
    * https://android.googlesource.com/platform/system/sepolicy/+/f821b5a
    
    TODO: Further unify /dev/kmsg permissions with syslog_read permissions.
    
    Test: policy compiles, no dmesg output
    Change-Id: Icfff6f765055bdbbe85f302b781aed2568ef532f
    c9630dc6
    History
    shell.te: revoke syslog(2) access to shell user
    Nick Kralevich authored
    external/toybox commit a583afc812cf7be74ebab72294c8df485908ff04 started
    having dmesg use /dev/kmsg, which is unreadable to the unprivileged
    shell user. Revoke syslog(2) to the shell user for consistency.
    
    The kernel dmesg log is a source of kernel pointers, which can leak
    kASLR information from the kernel. Restricting access to kernel
    information will make attacks against Android more difficult. Having
    said that, dmesg information is still available from "adb bugreport", so
    this change doesn't completely shutdown kernel info leaks.
    
    This change essentially reverts us to the state we were in between Nov 8
    2011 and May 27 2014. During that almost 3 year period, the unprivileged
    shell user was unable to access dmesg, and there was only one complaint
    during that time.
    
    References:
    * https://android.googlesource.com/platform/system/core/+/f9557fb
    * https://android.googlesource.com/platform/system/sepolicy/+/f821b5a
    
    TODO: Further unify /dev/kmsg permissions with syslog_read permissions.
    
    Test: policy compiles, no dmesg output
    Change-Id: Icfff6f765055bdbbe85f302b781aed2568ef532f