linux-kernel - Re: logging on kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4FD8AE74.3080708@teksavvy.com>
Date:	Wed, 13 Jun 2012 11:15:00 -0400
From:	Mark Lord <kernel@...savvy.com>
To:	Mahmood Naderan <nt_mahmood@...oo.com>
CC:	Jiri Kosina <jkosina@...e.cz>, Alan Cox <alan@...rguk.ukuu.org.uk>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Cong Wang <xiyou.wangcong@...il.com>
Subject: Re: logging on kernel panic

On 12-06-13 10:52 AM, Mahmood Naderan wrote:
>
>> The kernel log may not hit /var/log/syslog when kernel panics,
> Can I ask why. Just before a panic, kernel is still alive and can log. 
> Isn't that?

The kernel writes log messages to a circular in-RAM fifo (/proc/kmsg).
They then later get saved to a file such as /var/log/syslog by some
userspace task, eg. rsyslogd or syslogd.

At the point a Kernel Panic, the kernel is considered "dead",
or "non trustworthy" due to the error condition that triggered the panic.
Attempting to continue after the panic would be unwise,
with the possibilities including opening huge security holes/leaks
and/or corrupting user data.

So it is no longer alive, and will not be scheduling the userspace tasks
that might copy the log to a file for you.  Thus, nothing gets saved.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/