From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.FoxValley.net (mail.FoxValley.net [64.135.192.34]) by sourceware.org (Postfix) with SMTP id 620D93858C27 for ; Thu, 1 Apr 2021 01:23:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 620D93858C27 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=foxvalley.net Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=draymond@foxvalley.net Received: (qmail 2669 invoked from network) for libc-alpha@sourceware.org; 31 Mar 2021 20:23:15 -0500 Received: from unknown (HELO ?192.168.1.3?) (draymond@161.97.241.227) by mail.foxvalley.net with SMTP; 31 Mar 2021 20:23:15 -0500 Subject: Re: ***SPAM***Re: [libc-coord] syslog and LOG_KERN - Re: [PATCH] Bug 3604: fix calls to openlog() with LOG_KERN facility To: Alan Coopersmith , libc-coord@lists.openwall.com, Adhemerval Zanella , libc-alpha@sourceware.org, Rich Felker References: <1395b5b8-0fc7-ae01-c8e1-5e13f3a4394c@foxvalley.net> <86d18b12-c12b-9837-de7a-9dcb377ed6c4@linaro.org> <9b021a51-2d91-8fc8-c13d-0cc0315ccca9@oracle.com> From: Dan Raymond Message-ID: <25ea2c0c-7ead-dfaf-392c-d9061dd54e9d@foxvalley.net> Date: Wed, 31 Mar 2021 19:21:44 -0600 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 In-Reply-To: <9b021a51-2d91-8fc8-c13d-0cc0315ccca9@oracle.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Spam-Status: No, score=-3.4 required=5.0 tests=BAYES_00, BODY_8BITS, KAM_DMARC_STATUS, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2021 01:23:16 -0000 On 3/31/2021 1:44 PM, Alan Coopersmith wrote: > On 3/31/21 12:27 PM, Adhemerval Zanella wrote: >> Not allowing LOG_KERN by any user process seems to be de facto behavior >> on all systems I am aware of: >> >>    * FreeBSD and MUSL explicit set to previous log facility (they check >>      if the priority against a mask and since on both LOG_KERN is 0 is >>      set to the previous/default value). >> >>    * Solaris 11.4 man page explicit says: >> >>         LOG_KERN      Messages generated by the kernel. These cannot >> be  gener- >>                       ated by any user processes. > > The Solaris implementation is similar to FreeBSD & MUSL - LOG_KERN is 0, > so appears the same to syslog() as not specifying a facility and letting > the default value be used. It's a fair point that even with this patch the user can't explicitly specify LOG_KERN during a call to syslog().  To use LOG_KERN they must call openlog() first and set it as the default facility.  That's a little clumsy but it is good enough to fix the klogd implementation in busybox.  What is the alternative?  To rewrite klogd so it bypasses syslog() altogether and writes directly to the syslogd socket?  That seems inefficient and doesn't really achieve any security.  If klogd can do this any user process can do it too.