linux-kernel - Re: [PATCH v2] kexec: add sysctl to disable kexec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Dec 2013 09:35:40 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Kees Cook <keescook@...omium.org>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Rik van Riel <riel@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	Rob Landley <rob@...dley.net>,
	Eric Biederman <ebiederm@...ssion.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Mel Gorman <mgorman@...e.de>,
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	kexec@...ts.infradead.org
Subject: Re: [PATCH v2] kexec: add sysctl to disable kexec

On Mon, Dec 09, 2013 at 05:06:10PM -0800, Kees Cook wrote:
> On Mon, Dec 9, 2013 at 4:34 PM, H. Peter Anvin <hpa@...or.com> wrote:
> > On 12/09/2013 04:16 PM, Kees Cook wrote:
> >> For general-purpose (i.e. distro) kernel builds it makes sense to build with
> >> CONFIG_KEXEC to allow end users to choose what kind of things they want to do
> >> with kexec. However, in the face of trying to lock down a system with such
> >> a kernel, there needs to be a way to disable kexec (much like module loading
> >> can be disabled). Without this, it is too easy for the root user to modify
> >> kernel memory even when CONFIG_STRICT_DEVMEM and modules_disabled are set.
> >>
> >> Signed-off-by: Kees Cook <keescook@...omium.org>
> >> Acked-by: Rik van Riel <riel@...hat.com>
> >
> > So the logic is to load a crashkernel and then lock down the machine
> > before services, networking etc. are enabled?
> 
> Right, or to just turn it off at boot time if kexec will not be used at all.

kdump kernel is loaded with the help of kdump service. Different distro's
might have different dependencies for that serivce. But recently in fedora
we wait network to come up before starting that service. (So that nfs
targets can be mounted and checked for valid dump destinations).

IOW, crash kernel is loaded quite late in the game (quite a few services
have run and possibly networking is up too). To me, practically one will
disable kdump also if you change state of this knob early.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/