mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-09 06:36:44 +07:00
Code Issues Packages Projects Releases Wiki Activity

improvement

Browse Source
This commit is contained in:
Patrick Schleizer 2022-07-02 16:02:28 -04:00
parent aebca1b3dc
commit 82e7863d5b
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 26 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
usr/lib/dracut/modules.d/40cold-boot-attack-defense/wipe-ram.sh
View File

@ -7,54 +7,65 @@
## First version by @friedy10. ## First version by @friedy10.
## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh ## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh
ram_wipe() { if [ -z "$DRACUT_SYSTEMD" ]; then
local OLD_DRACUT_QUIET warn_debug() {
OLD_DRACUT_QUIET="$DRACUT_QUIET" echo "<28>dracut Warning: $*" > /dev/kmsg
## check_quiet should show info in console. echo "dracut Warning: $*" >&2
DRACUT_QUIET='no' }
info_debug() {
echo "<30>dracut Info: $*" > /dev/kmsg
echo "dracut Info: $*" >&2 || :
}
else
warn_debug() {
echo "Warning: $*" >&2
}
info_debug() {
echo "Info: $*"
}
fi
ram_wipe() {
local kernel_wiperam_setting local kernel_wiperam_setting
## getarg returns the last parameter only. ## getarg returns the last parameter only.
## if /proc/cmdline contains 'wiperam=skip wiperam=force' the last one wins. ## if /proc/cmdline contains 'wiperam=skip wiperam=force' the last one wins.
kernel_wiperam_setting=$(getarg wiperam) kernel_wiperam_setting=$(getarg wiperam)
if [ "$kernel_wiperam_setting" = "skip" ]; then if [ "$kernel_wiperam_setting" = "skip" ]; then
info "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK." info_debug "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
DRACUT_QUIET="$OLD_DRACUT_QUIET"
return 0 return 0
fi fi
if [ "$kernel_wiperam_setting" = "force" ]; then if [ "$kernel_wiperam_setting" = "force" ]; then
info "wipe-ram.sh: wiperam=force detected, OK." info_debug "wipe-ram.sh: wiperam=force detected, OK."
else else
if systemd-detect-virt &>/dev/null ; then if systemd-detect-virt &>/dev/null ; then
info "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK." info_debug "wipe-ram.sh: Skip, because VM detected and not using wiperam=force kernel parameter, OK."
DRACUT_QUIET="$OLD_DRACUT_QUIET"
return 0 return 0
fi fi
fi fi
info "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..." info_debug "wipe-ram.sh: Cold boot attack defense... Starting RAM wipe on shutdown..."
## TODO: sdmem settings. One pass only. Secure? Configurable? ## TODO: sdmem settings. One pass only. Secure? Configurable?
sdmem -l -l -v sdmem -l -l -v
info "wipe-ram.sh: RAM wipe completed, OK." info_debug "wipe-ram.sh: RAM wipe completed, OK."
## In theory might be better to check this beforehand, but the test is ## In theory might be better to check this beforehand, but the test is
## really fast. The user has no chance of reading the console output ## really fast. The user has no chance of reading the console output
## without introducing an artificial delay because the sdmem which runs ## without introducing an artificial delay because the sdmem which runs
## after this, results in much more console output. ## after this, results in much more console output.
info "wipe-ram.sh: Checking if there are still mounted encrypted disks..." info_debug "wipe-ram.sh: Checking if there are still mounted encrypted disks..."
local dmsetup_actual_output dmsetup_expected_output local dmsetup_actual_output dmsetup_expected_output
dmsetup_actual_output="$(dmsetup ls --target crypt)" dmsetup_actual_output="$(dmsetup ls --target crypt)"
dmsetup_expected_output="No devices found" dmsetup_expected_output="No devices found"
if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then if [ "$dmsetup_actual_output" = "$dmsetup_expected_output" ]; then
info "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK." info_debug "wipe-ram.sh: Success, there are no more mounted encrypted disks, OK."
else else
warn "\ warn_debug "\
wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed! wipe-ram.sh: There are still mounted encrypted disks! RAM wipe failed!
debugging information: debugging information:
@ -62,8 +73,6 @@ dmsetup_expected_output: '$dmsetup_expected_output'
dmsetup_actual_output: '$dmsetup_actual_output'" dmsetup_actual_output: '$dmsetup_actual_output'"
fi fi
## Restore to previous value.
DRACUT_QUIET="$OLD_DRACUT_QUIET"
sleep 3 sleep 3
} }