security-misc/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh

79 lines
2.6 KiB
Bash
Raw Normal View History

#!/bin/sh
2022-06-29 15:24:27 -04:00
## Copyright (C) 2022 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
2022-06-29 15:19:56 -04:00
## See the file COPYING for copying conditions.
2022-06-29 16:02:05 -04:00
## Credits:
## First version by @friedy10.
## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh
2022-07-02 19:10:55 -04:00
drop_caches() {
sync
## https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook
### Ensure any remaining disk cache is erased by Linux' memory poisoning
echo 3 > /proc/sys/vm/drop_caches
sync
}
2022-07-02 16:02:28 -04:00
ram_wipe() {
local kernel_wiperam_setting
## getarg returns the last parameter only.
## if /proc/cmdline contains 'wiperam=skip wiperam=force' the last one wins.
kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." > /dev/kmsg
return 0
fi
if [ "$kernel_wiperam_setting" = "force" ]; then
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: wiperam=force detected, OK." > /dev/kmsg
else
if systemd-detect-virt &>/dev/null ; then
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." > /dev/kmsg
return 0
fi
fi
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." > /dev/kmsg
2022-06-30 13:56:29 -04:00
2022-07-02 19:10:55 -04:00
drop_caches
2022-07-02 19:07:06 -04:00
2022-06-30 13:56:29 -04:00
## TODO: sdmem settings. One pass only. Secure? Configurable?
2022-07-02 17:21:33 -04:00
## TODO: > /dev/kmsg 2> /dev/kmsg
2022-06-30 13:56:29 -04:00
sdmem -l -l -v
2022-07-02 19:10:55 -04:00
drop_caches
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: RAM wipe completed, OK." > /dev/kmsg
2022-06-30 13:56:29 -04:00
## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output.
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..." > /dev/kmsg
2022-06-29 15:17:40 -04:00
local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
2022-07-02 17:21:33 -04:00
echo "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." > /dev/kmsg
2022-07-28 09:56:24 -04:00
## This should probably be removed in production?
sleep 3
2022-06-29 15:17:40 -04:00
else
2022-07-02 17:21:33 -04:00
echo "\
WARNING: wipe-ram.sh:There are still mounted encrypted disks! RAM wipe failed!
2022-06-29 15:17:40 -04:00
debugging information:
dmsetup_expected_output: '$dmsetup_expected_output'
2022-07-02 17:21:33 -04:00
dmsetup_actual_output: '$dmsetup_actual_output'" > /dev/kmsg
2022-07-28 09:56:24 -04:00
## How else could the user be informed that something is wrong?
sleep 5
2022-06-29 15:17:40 -04:00
fi
2023-01-06 10:50:34 -05:00
kexec -e
2022-06-29 15:17:40 -04:00
}
ram_wipe