From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44300) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Un8RV-0005vY-CO for qemu-devel@nongnu.org; Thu, 13 Jun 2013 10:24:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Un8RR-0007oW-Kg for qemu-devel@nongnu.org; Thu, 13 Jun 2013 10:24:01 -0400 Received: from mx.ipv6.kamp.de ([2a02:248:0:51::16]:42100 helo=mx01.kamp.de) by eggs.gnu.org with smtp (Exim 4.71) (envelope-from ) id 1Un8RR-0007ni-99 for qemu-devel@nongnu.org; Thu, 13 Jun 2013 10:23:57 -0400 Message-ID: <51B9D5FB.10801@kamp.de> Date: Thu, 13 Jun 2013 16:23:55 +0200 From: Peter Lieven MIME-Version: 1.0 References: <51B96205.4010601@kamp.de> <20130613084015.GF2633@stefanha-thinkpad.redhat.com> <51B98822.1030402@kamp.de> <8761xi7016.fsf@blackfin.pond.sub.org> In-Reply-To: <8761xi7016.fsf@blackfin.pond.sub.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC] sanitize memory on system reset List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Markus Armbruster Cc: Stefan Hajnoczi , "qemu-devel@nongnu.org" , "H. Peter Anvin" On 13.06.2013 12:55, Markus Armbruster wrote: > Peter Lieven writes: > >> On 13.06.2013 10:40, Stefan Hajnoczi wrote: >>> On Thu, Jun 13, 2013 at 08:09:09AM +0200, Peter Lieven wrote: >>>> I was thinking if it would be a good idea to zeroize all memory >>>> resources on system reset and >>>> madvise dontneed them afterwards. This would avoid system reset >>>> attacks in case the attacker >>>> has only access to the console of a vServer but not on the physical >>>> host and it would shrink >>>> RSS size of the vServer siginificantly. >>> I wonder if you'll hit weird OS installers or PXE clients that rely on >>> stashing stuff in memory across reset. >> One point: >> Wouldn't a memory test which some systems do at startup break these as well? > Systems that distinguish between warm and cold boot (such as PCs) > generally run POST only on cold boot. > > I'm not saying triggering warm reboot and expecting memory contents to > survive is a good idea, but it has been done. so you would vote for not touching it or at least enable it only through a cmdline paramter? Peter