)]}'
{
  "commit": "bfdc0b497faa82a0ba2f9dddcf109231dd519fcc",
  "tree": "932897262447dacb7158b81209748a295d93e20b",
  "parents": [
    "cb16e95fa2996743a6e80a665ed2ed0590bd38cf"
  ],
  "author": {
    "name": "Richard Weinberger",
    "email": "richard@nod.at",
    "time": "Wed Mar 23 16:43:11 2011 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Wed Mar 23 19:46:54 2011 -0700"
  },
  "message": "sysctl: restrict write access to dmesg_restrict\n\nWhen dmesg_restrict is set to 1 CAP_SYS_ADMIN is needed to read the kernel\nring buffer.  But a root user without CAP_SYS_ADMIN is able to reset\ndmesg_restrict to 0.\n\nThis is an issue when e.g.  LXC (Linux Containers) are used and complete\nuser space is running without CAP_SYS_ADMIN.  A unprivileged and jailed\nroot user can bypass the dmesg_restrict protection.\n\nWith this patch writing to dmesg_restrict is only allowed when root has\nCAP_SYS_ADMIN.\n\nSigned-off-by: Richard Weinberger \u003crichard@nod.at\u003e\nAcked-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nAcked-by: Serge E. Hallyn \u003cserge@hallyn.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Kees Cook \u003ckees.cook@canonical.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: Eugene Teo \u003ceugeneteo@kernel.org\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "97ab1690f5ed4678d48caa75ed3b71ac5e3970dd",
      "old_mode": 33188,
      "old_path": "kernel/sysctl.c",
      "new_id": "c0bb32414b174d575f836c9eb779f2e30cb793dd",
      "new_mode": 33188,
      "new_path": "kernel/sysctl.c"
    }
  ]
}