[HOME] [DOWNLOAD] [DOCS] [NEWS] [SUPPORT] [TIPS] [ISSUES] [CONTRIBUTE] [DONATE]

SysRq (Magic SysRq key)

Yes, should be possible via /dev/uinput.

2 Likes

Alright. Then unfortunately sysrq restriction is required.

2 Likes

Should CONFIG_MAGIC_SYSRQ be disabled in hardened-kernel to get rid of it entirely or should we just whitelist a few functions like SAK?

1 Like

Need SAK for https://www.whonix.org/wiki/Root#Prevent_Malware_from_Sniffing_the_Root_Password

Anything else that makes sense?

1 Like

The o command can be used to quickly shutdown if in an emergency but this makes it easier for DoS and is much better done on the host.

The f command can be used to kill a process taking up too much memory which might be useful to save the system from crashing.

Not sure how fine granular we can whitelist whatever we want?

madaidan via Whonix Forum:

The o command can be used to quickly shutdown if in an emergency but this makes it easier for DoS and is much better done on the host.

Yes but if we set it in security-misc it applies to host and VM.

The f command can be used to kill a process taking up too much memory which might be useful to save the system from crashing.

Could this be abused too to kill important processes?

1 Like

In my experience this command does fuck all. I end up using a hotkey combo and click the frozen app window to shut it off.

The only useful one is the the emergency shutdown.

1 Like

See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html#how-do-i-enable-the-magic-sysrq-key

We can set the bitmask of allowed functions. If we just want the shutdown function, we can set the sysctl to 128.

If we want to set the default in the kernel config, we change CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE to be the bitmask in hexadecimal form.

Yes.

madaidan via Whonix Forum:

See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html#how-do-i-enable-the-magic-sysrq-key

I see. However, it doesn’t look very flexible. We can’t pick and choose
any arbitrary combination of commands?

We can set the bitmask of allowed functions. If we just want the shutdown function, we can set the sysctl to 128.

Could you please white list SAK and shutdown?

If we want to set the default in the kernel config, we change CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE to be the bitmask in hexadecimal form.

Better a security-misc sysctl.

2 Likes

Not specific commands. Only groups of commands.

1 Like

This shows more ways to remotely trigger sysrq.

2 Likes

Why not both? CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE can still be overridden at runtime via the sysctl. It just sets the default.

1 Like
2 Likes

madaidan via Whonix Forum:

https://github.com/Whonix/security-misc/pull/60

https://github.com/Whonix/hardened-kernel/pull/43

Awesome! Merged. :slight_smile:

1 Like

Did you miss https://github.com/Whonix/hardened-kernel/pull/43?

1 Like

Yes, now merged.

1 Like

Is SysRq tamed enough currently?

Quote https://www.kernel.org/doc/Documentation/SAK.txt

Why?

Because…

It is only available if the kernel was compiled with sysrq support.

?

Just because SysRq isn’t universally available on all Linux distributions isn’t any reason to go for that?

Yes. security-misc restricts it sufficiently.

1 Like
[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Contributors] [Investors] [Priority Support] [Professional Support]