[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4E01174E.2010403@redhat.com>
Date: Tue, 21 Jun 2011 18:12:30 -0400
From: Prarit Bhargava <prarit@...hat.com>
To: Randy Dunlap <rdunlap@...otime.net>
CC: netdev@...r.kernel.org, davem@...emloft.net, agospoda@...hat.com,
nhorman@...hat.com, lwoodman@...hat.com
Subject: Re: [PATCH]: Add Network Sysrq Support
On 06/21/2011 04:09 PM, Randy Dunlap wrote:
>
>
>> +remote sysrq.
>> +
>> +To use this do:
>> +
>> +mount -t debugfs none /sys/kernel/debug/
>> +echo 1 > /proc/sys/kernel/sysrq
>> +echo <hex digit val> > /sys/kernel/debug/network_sysrq_magic
>> +echo 1 > /sys/kernel/debug/network_sysrq_enable
>>
> so all of this (insecure) stuff has to be done before you suspect that
> you need it .. in case the local keyboard/console is dead.
>
>
Randy,
Yes -- this needs to be enabled before the system is unresponsive. I've
used it to sysrq-c systems that were reproducibly hanging in ways that
the system could not be accessed via console or keyboard. It really is
a debug feature.
[I've also sysrq-t'd and sysrq-m'd systems as well fwiw]
>> +
>> +Then on another system you can do:
>> +
>> +ping -c 1 -p <hex digit val><hex val of sysrq> <target_system_name>
>>
> What are the <up to 30 hex digits> for?
>
>
A secret key. By turning this on you're leaving a system susceptible to
a panic by anyone else who decides to ping your system. The ping
payload accepts up to a 32 digit hex number. Two of those are needed
for the sysrq type, so that leaves 30.
I figured a 30 digit hash, with multiple enabling steps, and single-shot
mode, was good enough to alleviate any security issues anyone would have
about this code.
I'll take all of your suggestions into [v2].
Thanks for the review,
P.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists