linux-kernel - Re: [PATCH v4 4/5] pstore: add pmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 28 Jan 2015 09:28:58 -0800
From:	Mark Salyzyn <salyzyn@...roid.com>
To:	Łukasz Stelmach <stlman@...zta.fm>
CC:	linux-kernel@...r.kernel.org, Anton Vorontsov <anton@...msg.org>,
	Colin Cross <ccross@...roid.com>,
	Kees Cook <keescook@...omium.org>,
	Tony Luck <tony.luck@...el.com>,
	Krzysztof Kozlowski <k.kozlowski@...sung.com>,
	"Bartłomiej Żołnierkiewicz stlman@...zta.fm" 
	<b.zolnierkie@...sung.com>
Subject: Re: [PATCH v4 4/5] pstore: add pmsg

On 01/13/2015 04:16 PM, Łukasz Stelmach wrote:
>> A secured user-space accessible pstore object. Writes
>> to /dev/pmsg0 are appended to the buffer, on reboot
>> the persistent contents are available in
>> /sys/fs/pstore/pmsg-ramoops-[ID].
>>
>> One possible use is syslogd, or other daemon, can
>> write messages, then on reboot provides a means to
>> triage user-space activities leading up to a panic
>> as a companion to the pstore dmesg or console logs.
>>
>> Signed-off-by: Mark Salyzyn <salyzyn@...roid.com>
>> ---
> I am not an expert but this smells like duplicating /dev/kmsg. If
> I remember correctly since about Linux 3.5 /dev/kmsg is writable for the
> user-space and every single process (modulo MAC/DAC) can log there. The
> messages from user-space are preserved accross reboots as a part of the
> kmsg/printk buffer anyway.
>
> What is the advantege of pmsg0 over /dev/kmsg?

- Precious little user-space content goes to kmsg (otherwise you can ask 
why is there a syslogd?), there is a reason for this, user space is 
notorious for containing Personal Identifiable Information whereas 
kernel information does not.
- pmsg0 can take a lot of content (with a ramoops backend) and will not 
disrupt/DOS the kernel logs.
- State, Binary or packetized content can go to /dev/pmsg0 and not 
interfere with the text content in kmsg
- /dev/pmsg0 write is atomic
- /dev/pmsg0 is write only, there is no access to the live content 
_unless_ there is a reboot.
- Personal identification which abounds in user space could be placed 
into /dev/pmsg0, and there is no way except a reboot in order to extract 
the content, and then /sys/fs/pstore/pmsg-ramoops-0 can be deleted, or 
heavily MAC and DAC controlled to enforce protection (doing so to kmsg 
would be unlivable)

Sincerely -- Mark Salyzyn
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/