Should (lesser) Adversaries with Physical Access be part of the Threat Model of Whonix / Whonix-Host / Kicksecure?

According to the kernel docs, setting kernel.sysrq=64 enables signalling of processes so you can send a sigkill to a specific process to kill it.

I meant to say “coredump” when talking about crashdumps. Coredumps contain the recorded memory of a program which can be analysed.

It does seem like the sysrq key isn’t as bad as I originally though it was. I don’t really like having all of those debugging capabilities exposed to anyone with local access though.

1 Like