mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-10-01 08:25:45 -04:00
93 lines
3.0 KiB
Bash
Executable File
93 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
|
## Copyright (C) 2023 - 2023 Friedrich Doku <friedrichdoku@gmail.com>
|
|
## See the file COPYING for copying conditions.
|
|
|
|
## Credits:
|
|
## First version by @friedy10.
|
|
## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh
|
|
|
|
drop_caches() {
|
|
sync
|
|
## https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook
|
|
### Ensure any remaining disk cache is erased by Linux' memory poisoning
|
|
echo 3 > /proc/sys/vm/drop_caches
|
|
sync
|
|
}
|
|
|
|
ram_wipe() {
|
|
local kernel_wiperam_setting
|
|
## getarg returns the last parameter only.
|
|
## if /proc/cmdline contains 'wiperam=skip wiperam=force' the last one wins.
|
|
kernel_wiperam_setting=$(getarg wiperam)
|
|
|
|
if [ "$kernel_wiperam_setting" = "skip" ]; then
|
|
info "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
|
|
return 0
|
|
fi
|
|
|
|
if [ "$kernel_wiperam_setting" = "force" ]; then
|
|
info "wipe-ram.sh: wiperam=force detected, OK."
|
|
else
|
|
if systemd-detect-virt &>/dev/null ; then
|
|
info "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
kernel_wiperamexit_setting=$(getarg wiperamexit)
|
|
if [ "$kernel_wiperamexit_setting" = "yes" ]; then
|
|
warn "wipe-ram.sh: Skip, because wiperamexit=yes to avoid RAM wipe reboot loop."
|
|
return 0
|
|
fi
|
|
|
|
info "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
|
|
|
|
drop_caches
|
|
|
|
## TODO: sdmem settings. One pass only. Secure? Configurable?
|
|
## TODO: > /dev/kmsg 2> /dev/kmsg
|
|
sdmem -l -l -v
|
|
|
|
drop_caches
|
|
|
|
info "wipe-ram.sh: RAM wipe completed, OK."
|
|
|
|
## In theory might be better to check this beforehand, but the test is
|
|
## really fast. The user has no chance of reading the console output
|
|
## without introducing an artificial delay because the sdmem which runs
|
|
## after this, results in much more console output.
|
|
info "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
|
|
|
|
local dmsetup_actual_output dmsetup_expected_output
|
|
dmsetup_actual_output="$(dmsetup ls --target crypt)"
|
|
dmsetup_expected_output="No devices found"
|
|
|
|
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
|
|
info "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
|
|
## This should probably be removed in production?
|
|
sleep 3
|
|
else
|
|
warn "\
|
|
wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed!
|
|
|
|
debugging information:
|
|
dmsetup_expected_output: '$dmsetup_expected_output'
|
|
dmsetup_actual_output: '$dmsetup_actual_output'"
|
|
## How else could the user be informed that something is wrong?
|
|
sleep 5
|
|
fi
|
|
|
|
info "wipe-ram.sh: Now running kexec --exec..."
|
|
if kexec --exec ; then
|
|
info "wipe-ram.sh: kexec --exec succeeded."
|
|
return 0
|
|
fi
|
|
|
|
warn "wipe-ram.sh: kexec --exec failed!"
|
|
sleep 5
|
|
}
|
|
|
|
ram_wipe
|