control: tags -1 +moreinfo control: user [email protected] control: usertags -1 objections
[2019-02-04 07:58] Pierre Ynard <[email protected]> > > Why are you skeptical? I do not see, how syncing /var/log/dmesg > > permissions with kernel.dmesg_restrict could break things. Or am I > > missing something? > > Well, /var/log/dmesg only covers bootup kernel logs, so maybe some admin > set it up for unprivileged use of bootup logs, but still wants kernel > logs in general and after bootup to be restricted, to help deter local > exploits for example. > > /var/log/kern.log permissions don't depend on kernel.dmesg_restrict. > Also rsyslog seems to capture to kern.log just as many early logs as > /var/log/dmesg? While this is defintely interesting question, let us focus on what we can control -- initscripts. > /var/log/dmesg isn't the only log file whose permissions are set in that > brittle way in postinst. Others are /var/log/fsck/{checkroot,checkfs} > (the two logsave ones), and /var/log/boot (bootlogd). The same logic > applies so it could make sense to change these too. Or any others making > use of logsave like was suggested in #901289. Except that there isn't a > relevant sysctl variable for those. > > The way I look at it is as a whole, how initscripts provides logging > functionality outside of syslog while it may not be available or suited, > and how to manage that and log permissions. I agree that looking > at kernel.dmesg_restrict can be a cool tradeoff, but that's very > specialized. Thank you for your explanation. Let me sum it up. We have following options: * sync permissions of `kernel.dmesg_restrict' and /var/log/dmesg, leave other log files (/var/log/boot, ...) as-is * enforce permissions of all log files (dmsg, boot, ...) to specific value 640 root:adm. * sync permissions of all log files (dmsg, boot, ...) to `kernel.dmesg_restrict' * status-quo, when permissions are set in postinst, but are not enforced by initscripts. As I understand situation, I favor second option. So question is would anybody be unhappy, if initscripts will override manual `chown/chmod' on logs, created by initscripts. -- Note, that I send and fetch email in batch, once every 24 hours. If matter is urgent, try https://t.me/kaction --
