[Testers wanted] /dev/console cleanups

[Jeremy Chadwick]

On Wed, Nov 19, 2008 at 02:02:42AM -0800, Garrett Cooper wrote:
> On Tue, Nov 18, 2008 at 1:49 PM, David Wolfskill <david at catwhisker.org> wrote:
> > On Tue, Nov 18, 2008 at 10:34:10PM +0100, Ed Schouten wrote:
> >> ...
> >> One solution would be to let xconsole just display /var/log/messages.
> >
> > Errr... it may be rather a pathological case, but you might want to
> > check the content of /etc/syslog.conf on the local machine before
> > getting too carried away with that approach.
> >
> > For example, on my "firewall" box at home (where I really do not want to
> > log anything to local disk files, though I do have a serial console on it):
> >
> > janus(6.4-P)[1] grep -v '^#' /etc/syslog.conf
> > *.*                                             @bunrab.catwhisker.org
> > janus(6.4-P)[2]
> >
> > And then consider the fate of bunrab -- with stuff getting logged to
> > /var/log/messages from various machines....
> >
> >> ...
> >> I'll discuss this with others to decide if we should take such an
> >> approach.
> >
> > I'm not trying to be obstructionist, here.  If the above case is really
> > "too pathological to consider" -- or if it's a case of me bringing that
> > fate upon myself, I suppose -- that's actually something I can live
> > with.  It would be nice to be forwarned about it, though.  :-}
> >
> > Peace,
> > david
> 
> Uh, I second that. /var/log/messages shouldn't necessarily be
> accessible by non-root users. Also, OSX 10.5 protects against non-root
> access to dmesg. Not saying we should go that far, but it's already
> being implemented, so I don't see any harm in hiding the contents of
> `messages', as required by the sysadmin.

Footnote (not really applicable to the thread, but I want to point it
out to users/admins reading): inhibiting users viewing the kernel
message buffer (dmesg) can be accomplished by setting the
security.bsd.unprivileged_read_msgbuf sysctl to 0.

However, note that this can piss users off.  We have numerous users
on our system who rely on this information to see if anything "weird" is
going on with the box.  I set that sysctl one day (see below for why),
and I got flames in my mailbox within 48 hours.  Just something to keep
in mind if you have technically-savvy users.

There's a known "issue" with the kernel message buffer though: it's not
NULL'd out upon reboot.  Meaning, in some cases (depends on the BIOS or
system), the kernel message buffer from single-user mode is retained
even after a reboot!  A user can then do "dmesg" and see all the nifty
stuff you've done during single-user, which could include unencrypted
passwords if mergemaster was tinkering with passwd/master.passwd, etc..
I've brought this up before, and people said "Yeah, we know, moving on".
Rink Springer created a patch where the kernel message buffer will start
with NULL to keep this from happening, but it needs to be made into a
loader.conf tunable.

Also, /var/log/messages is explicitly set to 0644 in newsyslog.conf.  If
people want to debate that, be my guest.  I'm not sure what "security
hole" we'd be plugging if it was set to 0600, especially given that many
userland programs use the LOG_NOTICE facility in syslog.  If people want
to debate those default perms, be my guest.  I would rather people
debate the default syslog.conf layout altogether; I'm surprised we
haven't moved to syslog-ng (as part of the base system) by now.  :-)

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |