linux-kernel - [PATCH] sysrq: Allow access to sensitive keys to be restricted by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 30 Sep 2013 02:31:08 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.cz>
Cc:	Bastian Blank <waldi@...ian.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] sysrq: Allow access to sensitive keys to be restricted by
 default

From: Bastian Blank <waldi@...ian.org>

Add a Kconfig variable to set the initial value of the Magic SysRq mask
(sysctl: kernel.sysrq).

Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
This has been in Debian for a while, but should probably be signed-off
by Bastian as well.

Debian sets this to 0x01b6, which excludes.

          8 - enable debugging dumps of processes etc.
         64 - enable signalling of processes (term, kill, oom-kill)

Ben.

--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -18,7 +18,7 @@
 #include <linux/types.h>
 
 /* Enable/disable SYSRQ support by default (0==no, 1==yes). */
-#define SYSRQ_DEFAULT_ENABLE	1
+#define SYSRQ_DEFAULT_ENABLE	CONFIG_MAGIC_SYSRQ_DEFAULT_MASK
 
 /* Possible values of bitmask for enabling sysrq functions */
 /* 0x0001 is reserved for enable everything */
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -312,6 +312,14 @@ config MAGIC_SYSRQ
 	  keys are documented in <file:Documentation/sysrq.txt>. Don't say Y
 	  unless you really know what this hack does.
 
+config MAGIC_SYSRQ_DEFAULT_MASK
+	hex "Default mask for Magic SysRq keys on the console"
+	depends on MAGIC_SYSRQ
+	default 1
+	help
+	  Specifies the default mask for the allowed SysRq keys.  This can be
+	  used to disable several sensitive keys by default.
+
 config DEBUG_KERNEL
 	bool "Kernel debugging"
 	help

-- 
Ben Hutchings
Life is like a sewer:
what you get out of it depends on what you put into it.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/