[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20121106193419.GH4548@redhat.com>
Date: Tue, 6 Nov 2012 14:34:19 -0500
From: Vivek Goyal <vgoyal@...hat.com>
To: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: Matthew Garrett <mjg@...hat.com>,
Mimi Zohar <zohar@...ux.vnet.ibm.com>,
Khalid Aziz <khalid@...ehiking.org>, kexec@...ts.infradead.org,
horms@...ge.net.au, Dave Young <dyoung@...hat.com>,
"H. Peter Anvin" <hpa@...or.com>,
linux kernel mailing list <linux-kernel@...r.kernel.org>,
Dmitry Kasatkin <dmitry.kasatkin@...el.com>,
Roberto Sassu <roberto.sassu@...ito.it>,
Kees Cook <keescook@...omium.org>,
Peter Jones <pjones@...hat.com>
Subject: Re: Kdump with signed images
On Mon, Nov 05, 2012 at 11:44:48AM -0800, Eric W. Biederman wrote:
> Vivek Goyal <vgoyal@...hat.com> writes:
>
> > On Fri, Nov 02, 2012 at 02:32:48PM -0700, Eric W. Biederman wrote:
> >>
> >> It needs to be checked but /sbin/kexec should not use any functions that
> >> trigger nss switch. No user or password or host name lookup should be
> >> happening.
> >
> > I also think that we don't call routines which trigger nss switch but
> > be probably can't rely on that as somebody might introduce it in
> > future. So we need more robust mechanism to prevent it than just code
> > inspection.
>
> The fact that we shouldn't use those routines is enough to let us
> walk down a path where they are not used. Either with a static glibc
> linked told to use no nss modules (--enable-static-nss ?), or with
> another more restricted libc.
I installed glibc-static and built kexec-tools using gcc "-static" option.
It built just fine and infact kdump is working with it.
Size of new kexec binary is around 1.4MB.
Did not get any warning w.r.t nss, so I am assuming we are not calling
any relevant functions.
I did try building my own libc using --enable-static-nss but it does not
seem to have built static versions of libnss*. Will look more into it
and try linking kexec with this new glibc and see if that works.
Also tried playing with klibc and uclibc a bit but can't get anything
going quickly.
Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists