linux-kernel - Re: [PATCH v7 2/7] crash_dump: make dm crypt keys persist for the kdump kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6wziog4akqkpye72r33srnfk4peojizdi3q55ipu2zvinusfov@iagx6it375qd>
Date: Thu, 16 Jan 2025 15:32:01 +0800
From: Coiby Xu <coxu@...hat.com>
To: Randy Dunlap <rdunlap@...radead.org>
Cc: kexec@...ts.infradead.org, Ondrej Kozina <okozina@...hat.com>, 
	Milan Broz <gmazyland@...il.com>, Thomas Staudt <tstaudt@...ibm.com>, 
	Daniel P . Berrangé <berrange@...hat.com>, Kairui Song <ryncsn@...il.com>, 
	Jan Pazdziora <jpazdziora@...hat.com>, Pingfan Liu <kernelfans@...il.com>, Baoquan He <bhe@...hat.com>, 
	Dave Young <dyoung@...hat.com>, linux-kernel@...r.kernel.org, x86@...nel.org, 
	Dave Hansen <dave.hansen@...el.com>, Vitaly Kuznetsov <vkuznets@...hat.com>, 
	Vivek Goyal <vgoyal@...hat.com>, Jonathan Corbet <corbet@....net>, 
	"open list:DOCUMENTATION" <linux-doc@...r.kernel.org>
Subject: Re: [PATCH v7 2/7] crash_dump: make dm crypt keys persist for the
 kdump kernel

On Wed, Jan 15, 2025 at 11:04:23PM -0800, Randy Dunlap wrote:
>Hi,

Hi Randy,

I appreciate your quick response!

>
>On 1/15/25 10:58 PM, Coiby Xu wrote:
>> diff --git a/Documentation/admin-guide/kdump/kdump.rst b/Documentation/admin-guide/kdump/kdump.rst
>> index 5376890adbeb..192d6796ab94 100644
>> --- a/Documentation/admin-guide/kdump/kdump.rst
>> +++ b/Documentation/admin-guide/kdump/kdump.rst
>> @@ -551,6 +551,34 @@ from within add_taint() whenever the value set in this bitmask matches with the
>>  bit flag being set by add_taint().
>>  This will cause a kdump to occur at the add_taint()->panic() call.
>>
>> +Write the dump file to encrypted disk volume
>> +============================================
>> +
>> +CONFIG_CRASH_DM_CRYPT can be enabled to support saving the dump file to
>> +encrypted disk volume. User space can interact with
>
>   an encrypted disk volume.
>
>> +/sys/kernel/config/crash_dm_crypt_keys for setup,
>> +
>> +1. Tell the 1st kernel what keys are needed to unlock the disk volumes,
>
>               first
>
>> +    # Add key #1
>> +    mkdir /sys/kernel/config/crash_dm_crypt_keys/7d26b7b4-e342-4d2d-b660-7426b0996720
>> +    # Add key #1's description
>> +    echo cryptsetup:7d26b7b4-e342-4d2d-b660-7426b0996720 > /sys/kernel/config/crash_dm_crypt_keys/description
>> +
>> +    # how many keys do we have now?
>> +    cat /sys/kernel/config/crash_dm_crypt_keys/count
>> +    1
>> +
>> +    # Add key#2 in the same way
>
>             key #2
>(be consisent)
>
>> +
>> +    # how many keys do we have now?
>> +    cat /sys/kernel/config/crash_dm_crypt_keys/count
>> +    2
>> +
>> +2. Load the dump-capture kernel
>> +
>> +3. After dump-capture kerne get booted, restore the keys to user keyring
>
>      After the dump-capture kernel is booted,

Thanks for catching the above issues! I'll apply all your suggested
changes to next version.

>
>> +   echo yes > /sys/kernel/crash_dm_crypt_keys/restore
>> +
>>  Contact
>>  =======
>>
>
>-- 
>~Randy
>
>

-- 
Best regards,
Coiby