[LU-381] CONFIG_SECURITY_DMESG_RESTRICT missing from config for RHEL6

• Status: Resolved
• Project: Lustre
• Affects Version/s: Lustre 2.1.0
• Fix Version/s: Lustre 2.0.0
• Type: Improvement
• Priority: Minor
• Reporter: Richard Henwood (Inactive)
• Assignee: Richard Henwood (Inactive)
• Resolution: Fixed

Environment

RHEL6, git lustre-release, compiling from source

• Epic: papercut

Description

Building Lustre from git/lustre-release on RHEL6, the .config file provided (lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config) does not contain a CONFIG_SECURITY_DMESG_RESTRICT directive.

During make config a interactive prompt is provided:

$ make oldconfig || make menuconfig
scripts/kconfig/conf -o arch/x86/Kconfig
*
* Restart config...
*
*
* Security options
*
Enable access key retention support (KEYS) [Y/n/?] y
  Enable the /proc/keys file by which keys may be viewed (KEYS_DEBUG_PROC_KEYS) [Y/n/?] y
Restrict unprivileged access to the kernel syslog (SECURITY_DMESG_RESTRICT) [N/y/?] (NEW)

This may be confusing to a user unfamiliar with SECURITY_DMESG_RESTRICT

I suggest that this value be asserted as the default and no prompt presented during make config

Comments

[Brian Murrell (Inactive)]

In fact our policy with regard to kernel configuration options is to do what upstream does. We want to change the config (when compared to upstream) as little as we need to to make Lustre work.

So the right thing to do here is investigate what RH set this value to for RHEL6 and do the same thing.

[Richard Henwood (Inactive)]

Thanks for the advice.

RHEL6 set: CONFIG_SECURITY_DMESG_RESTRICT=n

I'm preparing a patch to copy this assertion for Lustre .config.

[Richard Henwood (Inactive)]

The patch failed in Maloo. I've rebased and resubmitted.

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,el5,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,el6,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,sles11,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,client,el5,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,ubuntu1004,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,server,el5,ofa #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,server,el6,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,el5,ofa #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,client,ubuntu1004,ofa #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,server,el5,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,client,el5,ofa #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,server,el5,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » i686,client,el6,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,server,el5,ofa #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Build Master (Inactive)]

Integrated in lustre-master » x86_64,server,el6,inkernel #172
LU-381 add in RHEL6 value for CONFIG_SECURITY_DMESG_RESTRICT

Oleg Drokin : 60e6514a8280f90a97c00e18a3774b5e0212f7ff
Files :

• lustre/kernel_patches/kernel_configs/kernel-2.6.32-2.6-rhel6-x86_64.config

[Richard Henwood (Inactive)]

This fix has been merged.