27 Jul
2018
27 Jul
'18
1:47 p.m.
On Fri, 27 Jul 2018 15:40:32 +0200 Jann Horn jannh@google.com wrote:
But the code doesn't go to dmesg. It's only available via /sys/kernel/debug/tracing/printk_formats which is only available via root. Nobody else has access to that directory.
-- Steve
I think the point was that when we take capabilities into account the root privileges aren't unequivocal anymore. The 'root' owned process with only 'CAP_SYSLOG' shouldn't have access to /sys/kernel/debug/tracing/printk_formats
Then they shouldn't have access to debugfs at all, right?
That's what I'm thinking.
-- Steve