linux-kernel - Re: [PATCH v2] printk: Add kernel parameter to disable writes to /dev/kmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFx0VWvoSxNDE34j4u2nq1QEOaicmTeYmVWRmesdBXLGeA@mail.gmail.com>
Date:	Mon, 25 Apr 2016 13:23:36 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Peter Zijlstra <peterz@...radead.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...nel.org>, Borislav Petkov <bp@...en8.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Uwe Kleine-König 
	<u.kleine-koenig@...gutronix.de>
Subject: Re: [PATCH v2] printk: Add kernel parameter to disable writes to /dev/kmsg

On Mon, Apr 25, 2016 at 1:00 PM, Steven Rostedt <rostedt@...dmis.org> wrote:
>
> For the purpose to pass messages from early init through to final boot.
> Systemd continued this for the same purpose. Which I agree is totally
> legit. But where systemd fails, is that it continues to use this
> interface far beyond the need.
>
> I agree with Andrew, we should have had a way to close the pipe after
> the system was up and running.

I really don't think this should be about open/close, but about rate
limiting writes.

I think we'd be much better off allowing writes during early boot
(when the real root filesystem hasn't been started yet, so logging to
disk doesn't work - at that point the kernel log really is a better
alternative), and then just start throttling it later (possibly very
aggressively).

But the other issue is that once you actually have logging working, I
don't see why you don't just look at the system logs. Yeah, it's not
/var/log/messages any more, but it's not *that* hard to do. Just use
"journalctl -k" instead of dmesg, and you won't be missing data.

This is why I harp on rate limiting, and I think your patch is silly:
it solves the wrong problem (the one that isn't a real problem), and
it does it with a sledgehammer when a flyswatter would be more
appropriate.

              Linus