Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-27 07:49:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

output

Browse Source
This commit is contained in:
Patrick Schleizer 2023-01-07 12:46:21 -05:00
parent 2860560edb
commit 999a82ed94
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
usr/lib/dracut/modules.d/10ram-wipe-exit/wipe-ram.sh
View File

@ -9,16 +9,16 @@ ram_wipe_action() {
kernel_wiperam_exit=$(getarg wiperamexit) kernel_wiperam_exit=$(getarg wiperamexit)
if [ "$kernel_wiperam_exit" = "no" ]; then if [ "$kernel_wiperam_exit" = "no" ]; then
info "INFO: Skip, because wiperamexit=no kernel parameter detected, OK." info "Skip, because wiperamexit=no kernel parameter detected, OK."
return 0 return 0
fi fi
if [ "$kernel_wiperam_exit" != "yes" ]; then if [ "$kernel_wiperam_exit" != "yes" ]; then
info "INFO: Skip, becuase wiperamexit parameter is not used." info "Skip, because wiperamexit parameter is unset."
return 0 return 0
fi fi
info "INFO: wiperamexit=yes. Running second RAM wipe..." info "wiperamexit=yes, therefore running second RAM wipe..."
sdmem -l -l -v sdmem -l -l -v
} }

20
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh
View File

@ -23,20 +23,20 @@ ram_wipe() {
kernel_wiperam_setting=$(getarg wiperam) kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then if [ "$kernel_wiperam_setting" = "skip" ]; then
info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." info "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0 return 0
fi fi
if [ "$kernel_wiperam_setting" = "force" ]; then if [ "$kernel_wiperam_setting" = "force" ]; then
info "INFO: wipe-ram.sh: wiperam=force detected, OK." info "wipe-ram.sh: wiperam=force detected, OK."
else else
if systemd-detect-virt &>/dev/null ; then if systemd-detect-virt &>/dev/null ; then
info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." info "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
return 0 return 0
fi fi
fi fi
info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." info "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
drop_caches drop_caches
@ -46,25 +46,25 @@ ram_wipe() {
drop_caches drop_caches
info "INFO: wipe-ram.sh: RAM wipe completed, OK." info "wipe-ram.sh: RAM wipe completed, OK."
## In theory might be better to check this beforehand, but the test is ## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output ## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs ## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output. ## after this, results in much more console output.
info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..." info "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
local dmsetup_actual_output dmsetup_expected_output local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)" dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found" dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." info "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
## This should probably be removed in production? ## This should probably be removed in production?
sleep 3 sleep 3
else else
info "\ warn "\
WARNING: wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed! wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed!
debugging information: debugging information:
dmsetup_expected_output: '$dmsetup_expected_output' dmsetup_expected_output: '$dmsetup_expected_output'
@ -73,7 +73,7 @@ dmsetup_actual_output: '$dmsetup_actual_output'"
sleep 5 sleep 5
fi fi
kexec -e && info "kexec -e succeeded" || info "kexec -e failed" kexec -e && info "kexec -e succeeded" || warn "kexec -e failed"
} }
ram_wipe ram_wipe