diff --git a/lib/systemd/system/cold-boot-attack-defense-kexec-prepare.service b/lib/systemd/system/cold-boot-attack-defense-kexec-prepare.service index cfc1887..13bf23a 100644 --- a/lib/systemd/system/cold-boot-attack-defense-kexec-prepare.service +++ b/lib/systemd/system/cold-boot-attack-defense-kexec-prepare.service @@ -1,5 +1,7 @@ +### Copyrigh (C) 2023 - 2023 Friedrich Doku + [Unit] -Description=My Script +Description=https://www.kicksecure.com/wiki/Cold_Boot_Attack_Defense [Service] Type=oneshot diff --git a/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh b/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh index b7aa945..d96f32b 100755 --- a/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh +++ b/usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh @@ -72,7 +72,7 @@ dmsetup_actual_output: '$dmsetup_actual_output'" > /dev/kmsg sleep 5 fi - kexec -e + kexec -e && echo "kexec -e succeeded" || echo "kexec -e failed" } ram_wipe diff --git a/usr/libexec/security-misc/cold-boot-attack-defense-kexec-prepare b/usr/libexec/security-misc/cold-boot-attack-defense-kexec-prepare index 3865afb..1e6f7a5 100755 --- a/usr/libexec/security-misc/cold-boot-attack-defense-kexec-prepare +++ b/usr/libexec/security-misc/cold-boot-attack-defense-kexec-prepare @@ -1,8 +1,7 @@ #!/bin/bash ## Copyrigh (C) 2022 - 2022 ENCRYPTED SUPPORT LP +## Copyrigh (C) 2023 - 2023 Friedrich Doku ## See the file COPYING for copying conditions. -## modified by Friedrich Doku - set -x set -e @@ -13,27 +12,44 @@ env ## Lets hope $1 is set to reboot, poweroff or halt by systemd. true "1: $1" -sudo dbus-monitor --system | +initrd=/boot/initrd.img-$(uname -r) +kernel=/boot/vmlinuz-$(uname -r) + +if test -e $initrd; then + echo "Initrd File Found" +else + exit 1 + echo "Initrd File NOT FOUND" +fi + +if test -e $kernel; then + echo "Kernel File Found" +else + exit 1 + echo "Kernel File NOT FOUND" +fi + + +dbus-monitor --system | while read -r line; do if [[ $line =~ .*"poweroff.target".* ]]; then - kexec -l /boot/vmlinuz-$(uname -r) --initrd=/boot/initrd.img-$(uname -r) --reuse-cmdline --append="wiperamexit=yes wiperamaction=poweroff" + kexec -l $kernel --initrd=$initrd --reuse-cmdline --append="wiperamexit=yes wiperamaction=poweroff" break fi if [[ $line =~ .*"reboot.target".* ]]; then - kexec -l /boot/vmlinuz-$(uname -r) --initrd=/boot/initrd.img-$(uname -r) --reuse-cmdline --append="wiperamexit=yes wiperamaction=reboot" + kexec -l $kernel --initrd=$initrd --reuse-cmdline --append="wiperamexit=yes wiperamaction=reboot" break fi if [[ $line =~ .*"halt.target".* ]]; then - kexec -l /boot/vmlinuz-$(uname -r) --initrd=/boot/initrd.img-$(uname -r) --reuse-cmdline --append="wiperamexit=yes wiperamaction=halt" + kexec -l $kernel --initrd=$initrd --reuse-cmdline --append="wiperamexit=yes wiperamaction=halt" break fi if [[ $line =~ .*"kexec.target".* ]]; then - kexec -l /boot/vmlinuz-$(uname -r) --initrd=/boot/initrd.img-$(uname -r) --reuse-cmdline --append="wiperamexit=yes wiperamaction=reboot" + kexec -l $kernel --initrd=$initrd --reuse-cmdline --append="wiperamexit=yes wiperamaction=reboot" break fi done -sleep 10