move

usr/lib/dracut/modules.d/40cold-boot-attack-defense/module-setup.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+
+## Copyright (C) 2022 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+# called by dracut
+check() {
+    require_binaries sleep || return 1
+    require_binaries dmsetup || return 1
+    require_binaries sdmem || return 1
+    return 0
+}
+
+# called by dracut
+depends() {
+    return 0
+}
+
+# called by dracut
+install() {
+    inst_multiple sleep
+    inst_multiple sdmem
+    inst_multiple dmsetup
+    inst_hook shutdown 40 "$moddir/wipe.sh"
+    inst_hook cleanup 80 "$moddir/wipe-needshutdown.sh"
+}
+
+# called by dracut
+installkernel() {
+    return 0
+}

usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-needshutdown.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+## Copyright (C) 2022 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+need_shutdown

usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+## Copyright (C) 2022 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+ram_wipe() {
+   info "$0: START: COLD BOOT ATTACK DEFENSE - RAM WIPE ON SHUTDOWN"
+
+   local OLD_DRACUT_QUIET
+   OLD_DRACUT_QUIET="$DRACUT_QUIET"
+   DRACUT_QUIET='no'
+
+   info "$0: Checking if there are still mounted encrypted disks..."
+
+   local dmsetup_actual_output dmsetup_expected_output
+   dmsetup_actual_output="$(dmsetup ls --target crypt)"
+   dmsetup_expected_output="No devices found"
+
+   if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
+      info "$0: Success, there are no more mounted encrypted disks, OK."
+   else
+      warn "\
+$0: There are still mounted encrypted disks! RAM wipe failed!
+
+debugging information:
+dmsetup_expected_output: '$dmsetup_expected_output'
+dmsetup_actual_output: '$dmsetup_actual_output'"
+      sleep 5
+      return 0
+   fi
+
+   info "$0: Starting RAM wipe..."
+
+   ## TODO: sdmem settings. One pass only. Secure? Configurable?
+   sdmem -l -l -f
+
+   info "$0: RAM wipe completed, OK."
+
+   ## Restore to previous value.
+   DRACUT_QUIET="$OLD_DRACUT_QUIET"
+
+   info "$0: END: COLD BOOT ATTACK DEFENSE - RAM WIPE ON SHUTDOWN"
+   sleep 3
+}
+
+ram_wipe