[PATCH v2 0/7] makedumpfile security key filtering with eppic

[Aravinda Prasad]

On 2012-11-15 01:51, Dave Anderson wrote:

> 
> 
> ----- Original Message -----
>> Hi Vivek,
>>
>> On 2012-11-14 20:24, Vivek Goyal wrote:
>>
>>> On Thu, Nov 08, 2012 at 07:07:52PM +0530, Aravinda Prasad wrote:
>>>> makedumpfile security key filtering enhancement - Add Eppic language
>>>> support (formerly known as SIAL) to specify rules to scrub data in a
>>>> dumpfile. Eppic was previously part of crash source code repository.
>>>>
>>>> The following series of patches enhance the makedumpfile to provide
>>>> a more powerful way to specify rules and commands to traverse and
>>>> erase complex data structures in a dump file by integrating Embeddable
>>>> Pre-Processor and Interpreter for C (eppic).
>>>
>>> Hi Aravinda,
>>>
>>> Had few questions.
>>>
>>> - Which file will contain all the rules?
>>
>>
>> As of now rule files will not be provided by makedumpfile. However,
>> writing a rule file is very easy - it is a C program.
>>
>>>
>>> - What's the memory footprint of libeppic.a? Looks like this will be
>>>   linked statically with makedumpfile, and how much is the size bloat of
>>>   makedumpfile.
>>
>>
>> Memory footprint of libeppic.a is around 1MB. Yes, this will be
>> statically linked to makedumpfile. Users should specify EPPIC=on while
>> building the makedumpfile and hence linking libeppic.a is optional
>>
>>>
>>> - Is this supposed to work from kdump initramfs or it is supposed to be
>>>   used on already saved dump (later during post processing).
>>
>>
>> For the time being, it is only during post processing.
> 
> By post-processing, I understand you to say that the system would be
> configured to do a full ELF vmcore dump, save it somewhere, and then
> somebody would do the post-processing at a later time?


Yes exactly.

> 
> Or is it possible to run makedumpfile again on a compressed kdump that
> was previously created at dump-time?


Yes, it is possible to run makedumpfile with eppic again and again on
compressed kdump, dump which excludes unnecessary pages and dumpfile
which is already filtered by eppic.

> 
>>>
>>>   Given the fact that it does not reduce the size of core file
>>>   significantly, I would think that it is better to post process vmcore
>>>   to wipe out some symbols.
>>
>>
>> The main intention is to remove confidential information from the dump
>> file, like ssh keys etc., which could be just few bytes, hence, may not
>> reduce the size of the dump significantly.
> 
> So this would require you to first do a crash analysis on the unfiltered dumpfile,
> find out what you want to filter, write a script, and then run makedumpfile
> on the vmcore, correct?


Need not be always. If users know what to erase in advance they can skip
the crash analysis part. I had mentioned an example in my previous reply
to Vivek on how to erase keyring data from struct key.

> 
> Dave
> 
> 


-- 
Regards,
Aravinda