Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-26 23:37:05 -05:00
Code Issues Packages Projects Releases Wiki Activity

Get rid of /dev/kmsg

Browse Source
This commit is contained in:
Friedrich Doku 2023-01-07 11:31:02 -05:00
parent 78a4fad667
commit b8e82fffca
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh
View File

@ -23,20 +23,20 @@ ram_wipe() {
kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then
info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." > /dev/kmsg
info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi
if [ "$kernel_wiperam_setting" = "force" ]; then
info "INFO: wipe-ram.sh: wiperam=force detected, OK." > /dev/kmsg
info "INFO: wipe-ram.sh: wiperam=force detected, OK."
else
if systemd-detect-virt &>/dev/null ; then
info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." > /dev/kmsg
info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
return 0
fi
fi
info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." > /dev/kmsg
info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
drop_caches
@ -46,20 +46,20 @@ ram_wipe() {
drop_caches
info "INFO: wipe-ram.sh: RAM wipe completed, OK." > /dev/kmsg
info "INFO: wipe-ram.sh: RAM wipe completed, OK."
## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output.
info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..." > /dev/kmsg
info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..."
local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." > /dev/kmsg
info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
## This should probably be removed in production?
sleep 3
else
@ -68,7 +68,7 @@ WARNING: wipe-ram.sh:There are still mounted encrypted disks! RAM wipe failed!
debugging information:
dmsetup_expected_output: '$dmsetup_expected_output'
dmsetup_actual_output: '$dmsetup_actual_output'" > /dev/kmsg
dmsetup_actual_output: '$dmsetup_actual_output'"
## How else could the user be informed that something is wrong?
sleep 5
fi