[PATCH v2 0/7] makedumpfile security key filtering with eppic

[Dave Anderson]

----- Original Message -----
> Hi Vivek,
> 
> On 2012-11-14 20:24, Vivek Goyal wrote:
> 
> > On Thu, Nov 08, 2012 at 07:07:52PM +0530, Aravinda Prasad wrote:
> >> makedumpfile security key filtering enhancement - Add Eppic language
> >> support (formerly known as SIAL) to specify rules to scrub data in a
> >> dumpfile. Eppic was previously part of crash source code repository.
> >>
> >> The following series of patches enhance the makedumpfile to provide
> >> a more powerful way to specify rules and commands to traverse and
> >> erase complex data structures in a dump file by integrating Embeddable
> >> Pre-Processor and Interpreter for C (eppic).
> > 
> > Hi Aravinda,
> > 
> > Had few questions.
> > 
> > - Which file will contain all the rules?
> 
> 
> As of now rule files will not be provided by makedumpfile. However,
> writing a rule file is very easy - it is a C program.
> 
> > 
> > - What's the memory footprint of libeppic.a? Looks like this will be
> >   linked statically with makedumpfile, and how much is the size bloat of
> >   makedumpfile.
> 
> 
> Memory footprint of libeppic.a is around 1MB. Yes, this will be
> statically linked to makedumpfile. Users should specify EPPIC=on while
> building the makedumpfile and hence linking libeppic.a is optional
> 
> > 
> > - Is this supposed to work from kdump initramfs or it is supposed to be
> >   used on already saved dump (later during post processing).
> 
> 
> For the time being, it is only during post processing.

By post-processing, I understand you to say that the system would be
configured to do a full ELF vmcore dump, save it somewhere, and then
somebody would do the post-processing at a later time?

Or is it possible to run makedumpfile again on a compressed kdump that
was previously created at dump-time?
 
> > 
> >   Given the fact that it does not reduce the size of core file
> >   significantly, I would think that it is better to post process vmcore
> >   to wipe out some symbols.
> 
> 
> The main intention is to remove confidential information from the dump
> file, like ssh keys etc., which could be just few bytes, hence, may not
> reduce the size of the dump significantly.

So this would require you to first do a crash analysis on the unfiltered dumpfile,
find out what you want to filter, write a script, and then run makedumpfile
on the vmcore, correct?

Dave