Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-08-17 13:30:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

use warn instead of info for now

Browse source 
because dracut does not show info messages when kernel parameter quiet is set
This commit is contained in:
Patrick Schleizer 2023-01-09 05:34:07 -05:00
parent 7fa6946694
commit d769099db1
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
4 changed files with 24 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

14
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram-needshutdown.sh
View file

@ -13,25 +13,25 @@ ram_wipe_check_needshutdown() {
kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then
info "wipe-ram-needshutdown.sh: Skip, because wiperam=skip kernel parameter detected, OK."
warn "wipe-ram-needshutdown.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi
if [ "$kernel_wiperam_setting" = "force" ]; then
info "wipe-ram-needshutdown.sh: wiperam=force detected, OK."
warn "wipe-ram-needshutdown.sh: wiperam=force detected, OK."
else
detect_virt_output="$(systemd-detect-virt 2>&1)"
detect_virt_exit_code="$?"
info "wipe-ram-needshutdown.sh: detect_virt_output: '$detect_virt_output'"
info "wipe-ram-needshutdown.sh: detect_virt_exit_code: '$detect_virt_exit_code'"
warn "wipe-ram-needshutdown.sh: detect_virt_output: '$detect_virt_output'"
warn "wipe-ram-needshutdown.sh: detect_virt_exit_code: '$detect_virt_exit_code'"
if [ "$detect_virt_exit_code" = "0" ]; then
info "wipe-ram-needshutdown.sh: Skip, because running inside a VM detected and not using wiperam=force kernel parameter, OK."
warn "wipe-ram-needshutdown.sh: Skip, because running inside a VM detected and not using wiperam=force kernel parameter, OK."
return 0
fi
info "wipe-ram-needshutdown.sh: Bare metal (not running inside a VM) detected, OK."
warn "wipe-ram-needshutdown.sh: Bare metal (not running inside a VM) detected, OK."
fi
info "wipe-ram-needshutdown.sh: Calling dracut function need_shutdown to drop back into initramfs at shutdown, OK."
warn "wipe-ram-needshutdown.sh: Calling dracut function need_shutdown to drop back into initramfs at shutdown, OK."
need_shutdown
return 0

18
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh
View file

@ -25,15 +25,15 @@ ram_wipe() {
kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then
info "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
warn "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi
if [ "$kernel_wiperam_setting" = "force" ]; then
info "wipe-ram.sh: wiperam=force detected, OK."
warn "wipe-ram.sh: wiperam=force detected, OK."
else
if systemd-detect-virt &>/dev/null ; then
info "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
warn "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
return 0
fi
fi
@ -44,7 +44,7 @@ ram_wipe() {
return 0
fi
info "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
warn "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
drop_caches
@ -54,20 +54,20 @@ ram_wipe() {
drop_caches
info "wipe-ram.sh: RAM wipe completed, OK."
warn "wipe-ram.sh: RAM wipe completed, OK."
## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output.
info "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
warn "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
info "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
warn "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
else
## dracut should unmount the root encrypted disk cryptsetup luksClose during shutdown
## https://github.com/dracutdevs/dracut/issues/1888
@ -81,9 +81,9 @@ dmsetup_actual_output: '$dmsetup_actual_output'"
sleep 5
fi
info "wipe-ram.sh: Now running 'kexec --exec'..."
warn "wipe-ram.sh: Now running 'kexec --exec'..."
if kexec --exec ; then
info "wipe-ram.sh: 'kexec --exec' succeeded."
warn "wipe-ram.sh: 'kexec --exec' succeeded."
return 0
fi