diff --git a/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh b/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh index a30c285..2346a12 100755 --- a/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh +++ b/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh @@ -23,20 +23,20 @@ ram_wipe() { kernel_wiperam_setting=$(getarg wiperam) if [ "$kernel_wiperam_setting" = "skip" ]; then - info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." > /dev/kmsg + info "INFO: wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." return 0 fi if [ "$kernel_wiperam_setting" = "force" ]; then - info "INFO: wipe-ram.sh: wiperam=force detected, OK." > /dev/kmsg + info "INFO: wipe-ram.sh: wiperam=force detected, OK." else if systemd-detect-virt &>/dev/null ; then - info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." > /dev/kmsg + info "INFO: wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." return 0 fi fi - info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." > /dev/kmsg + info "INFO: wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." drop_caches @@ -46,20 +46,20 @@ ram_wipe() { drop_caches - info "INFO: wipe-ram.sh: RAM wipe completed, OK." > /dev/kmsg + info "INFO: wipe-ram.sh: RAM wipe completed, OK." ## In theory might be better to check this beforehand, but the test is ## really fast. The user has no chance of reading the console output ## without introducing an artificial delay because the sdmem which runs ## after this, results in much more console output. - info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..." > /dev/kmsg + info "INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks..." local dmsetup_actual_output dmsetup_expected_output dmsetup_actual_output="$(dmsetup ls --target crypt)" dmsetup_expected_output="No devices found" if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then - info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." > /dev/kmsg + info "INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." ## This should probably be removed in production? sleep 3 else @@ -68,7 +68,7 @@ WARNING: wipe-ram.sh:There are still mounted encrypted disks! RAM wipe failed! debugging information: dmsetup_expected_output: '$dmsetup_expected_output' -dmsetup_actual_output: '$dmsetup_actual_output'" > /dev/kmsg +dmsetup_actual_output: '$dmsetup_actual_output'" ## How else could the user be informed that something is wrong? sleep 5 fi