Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-27 07:39:25 -05:00
Code Issues Packages Projects Releases Wiki Activity

output

Browse Source
This commit is contained in:
Patrick Schleizer 2023-01-07 12:46:21 -05:00
parent 2860560edb
commit 999a82ed94
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
usr/lib/dracut/modules.d/10ram-wipe-exit/wipe-ram.sh
View File

@ -9,16 +9,16 @@ ram_wipe_action() {
kernel_wiperam_exit=$(getarg wiperamexit)
if [ "$kernel_wiperam_exit" = "no" ]; then
info "INFO: Skip, because wiperamexit=no kernel parameter detected, OK."
info "Skip, because wiperamexit=no kernel parameter detected, OK."
return 0
fi
if [ "$kernel_wiperam_exit" != "yes" ]; then
info "INFO: Skip, becuase wiperamexit parameter is not used."
info "Skip, because wiperamexit parameter is unset."
return 0
fi
info "INFO: wiperamexit=yes. Running second RAM wipe..."
info "wiperamexit=yes, therefore running second RAM wipe..."
sdmem -l -l -v
}

20
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh
View File

@ -23,20 +23,20 @@ ram_wipe() {
kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then
info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
info "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi
if [ "$kernel_wiperam_setting" = "force" ]; then
info "INFO: wipe-ram.sh: wiperam=force detected, OK."
info "wipe-ram.sh: wiperam=force detected, OK."
else
if systemd-detect-virt &>/dev/null ; then
info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
info "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
return 0
fi
fi
info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
info "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
drop_caches
@ -46,25 +46,25 @@ ram_wipe() {
drop_caches
info "INFO: wipe-ram.sh: RAM wipe completed, OK."
info "wipe-ram.sh: RAM wipe completed, OK."
## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output.
info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..."
info "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
info "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
## This should probably be removed in production?
sleep 3
else
info "\
WARNING: wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed!
warn "\
wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed!
debugging information:
dmsetup_expected_output: '$dmsetup_expected_output'
@ -73,7 +73,7 @@ dmsetup_actual_output: '$dmsetup_actual_output'"
sleep 5
fi
kexec -e && info "kexec -e succeeded" || info "kexec -e failed"
kexec -e && info "kexec -e succeeded" || warn "kexec -e failed"
}
ram_wipe