Re: [PATCH v2 0/7] makedumpfile security key filtering with eppic

From: Aravinda Prasad <aravinda@linux.vnet.ibm.com>
To: Atsushi Kumagai <kumagai-atsushi@mxc.nes.nec.co.jp>
Cc: ananth@in.ibm.com, mahesh@linux.vnet.ibm.com,
	kexec@lists.infradead.org, LChouinard@s2sys.com,
	tachibana@mxm.nes.nec.co.jp, anderson@redhat.com,
	vgoyal@redhat.com, buendgen@de.ibm.com
Subject: Re: [PATCH v2 0/7] makedumpfile security key filtering with eppic
Date: Tue, 04 Dec 2012 14:26:11 +0530	[thread overview]
Message-ID: <50BDBAAB.6050207@linux.vnet.ibm.com> (raw)
In-Reply-To: <20121204173625.b79ad10832e0adaa6e4db451@mxc.nes.nec.co.jp>

On 2012-12-04 14:06, Atsushi Kumagai wrote:

> Hello Aravinda,
> 
> On Mon, 3 Dec 2012 13:40:01 -0500
> Vivek Goyal <vgoyal@redhat.com> wrote:
> 
>> On Mon, Dec 03, 2012 at 08:05:54PM +0530, Aravinda Prasad wrote:
>>
>> [..]
>>>>> Another approach is to dynamically load libeppic library - similar way
>>>>> how crash does it. No major changes will be done to makedumpfile code,
>>>>> except the addition of --eppic flag. Upon specifying --eppic flag
>>>>> makedumpfile will dlopen libeppic.so, which will have functionality to
>>>>> scrub the specified data. This will prevent makedumpfile bloat and will
>>>>> not affect the size of initramfs as --eppic is only specified during
>>>>> post processing. The distribution should build and ship libeppic.so and
>>>>> the procedure for building .so will be similar to what we have in crash.
>>>>
>>>> It will still show up in dynamic library dependencing using ldd. We will
>>>> have to put some hack to exclude the leppic despite the fact that
>>>> makedumpfile is dependent on it. 
>>>>
>>>> In F18, now we use dracut to build kdump initramfs. On command line we
>>>> specify any extra binaries to be included and makedumpfile is one of
>>>> those. Dracut will determine all the dependencies and automatically pull
>>>> these in. So even if we don't use --eppic flag, dracult will pull in
>>>> eppic shared library anyway.
>>>
>>>
>>> I think ldd or dracut will not be able to make out that we are dependent
>>> on libeppic.so as we will be using the dlopen("libeppic.so, ...) call to
>>> dynamically load. No extra flags will be added to Makefile to specify
>>> -leppic while building makedumpfile. Hence, from my understanding, while
>>> building kdump initramfs, dracut cannot determine that we are dependent
>>> on eppic
>>
>> Ok, if dracut does not pull in libeppic and does not bloat size of
>> initramfs, I am fine.
> 
> I agree with this idea too.
> 
> However, the release date is closing in, so would you re-send the patch set
> based on v1.5.1 ? I will accept it as official feature in v1.5.2.
> 

sure. Thanks Atsushi

> 
> Thanks
> Atsushi Kumagai
> 

-- 
Regards,
Aravinda

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec