Re: [PATCH]: Add Network Sysrq Support

[Prarit Bhargava <prarit@redhat.com>]

On 06/21/2011 04:09 PM, Randy Dunlap wrote:
>
>
>> +remote sysrq.
>> +
>> +To use this do:
>> +
>> +mount -t debugfs none /sys/kernel/debug/
>> +echo 1 > /proc/sys/kernel/sysrq
>> +echo <hex digit val> > /sys/kernel/debug/network_sysrq_magic
>> +echo 1 > /sys/kernel/debug/network_sysrq_enable
>>     
> so all of this (insecure) stuff has to be done before you suspect that
> you need it .. in case the local keyboard/console is dead.
>
>   

Randy,

Yes -- this needs to be enabled before the system is unresponsive.  I've
used it to sysrq-c systems that were reproducibly hanging in ways that
the system could not be accessed via console or keyboard.  It really is
a debug feature.

[I've also sysrq-t'd and sysrq-m'd systems as well fwiw]

>> +
>> +Then on another system you can do:
>> +
>> +ping -c 1 -p <hex digit val><hex val of sysrq> <target_system_name>
>>     
> What are the <up to 30 hex digits> for?
>
>   

A secret key.  By turning this on you're leaving a system susceptible to
a panic by anyone else who decides to ping your system.  The ping
payload accepts up to a 32 digit hex number.  Two of those are needed
for the sysrq type, so that leaves 30.

I figured a 30 digit hash, with multiple enabling steps, and single-shot
mode, was good enough to alleviate any security issues anyone would have
about this code.

I'll take all of your suggestions into [v2].

Thanks for the review,

P.