Commit Graph

77 Commits

Author SHA1 Message Date
Konrad Witaszczyk
480f31c214 Add support for encrypted kernel crash dumps.
Changes include modifications in kernel crash dump routines, dumpon(8) and
savecore(8). A new tool called decryptcore(8) was added.

A new DIOCSKERNELDUMP I/O control was added to send a kernel crash dump
configuration in the diocskerneldump_arg structure to the kernel.
The old DIOCSKERNELDUMP I/O control was renamed to DIOCSKERNELDUMP_FREEBSD11 for
backward ABI compatibility.

dumpon(8) generates an one-time random symmetric key and encrypts it using
an RSA public key in capability mode. Currently only AES-256-CBC is supported
but EKCD was designed to implement support for other algorithms in the future.
The public key is chosen using the -k flag. The dumpon rc(8) script can do this
automatically during startup using the dumppubkey rc.conf(5) variable.  Once the
keys are calculated dumpon sends them to the kernel via DIOCSKERNELDUMP I/O
control.

When the kernel receives the DIOCSKERNELDUMP I/O control it generates a random
IV and sets up the key schedule for the specified algorithm. Each time the
kernel tries to write a crash dump to the dump device, the IV is replaced by
a SHA-256 hash of the previous value. This is intended to make a possible
differential cryptanalysis harder since it is possible to write multiple crash
dumps without reboot by repeating the following commands:
# sysctl debug.kdb.enter=1
db> call doadump(0)
db> continue
# savecore

A kernel dump key consists of an algorithm identifier, an IV and an encrypted
symmetric key. The kernel dump key size is included in a kernel dump header.
The size is an unsigned 32-bit integer and it is aligned to a block size.
The header structure has 512 bytes to match the block size so it was required to
make a panic string 4 bytes shorter to add a new field to the header structure.
If the kernel dump key size in the header is nonzero it is assumed that the
kernel dump key is placed after the first header on the dump device and the core
dump is encrypted.

Separate functions were implemented to write the kernel dump header and the
kernel dump key as they need to be unencrypted. The dump_write function encrypts
data if the kernel was compiled with the EKCD option. Encrypted kernel textdumps
are not supported due to the way they are constructed which makes it impossible
to use the CBC mode for encryption. It should be also noted that textdumps don't
contain sensitive data by design as a user decides what information should be
dumped.

savecore(8) writes the kernel dump key to a key.# file if its size in the header
is nonzero. # is the number of the current core dump.

decryptcore(8) decrypts the core dump using a private RSA key and the kernel
dump key. This is performed by a child process in capability mode.
If the decryption was not successful the parent process removes a partially
decrypted core dump.

Description on how to encrypt crash dumps was added to the decryptcore(8),
dumpon(8), rc.conf(5) and savecore(8) manual pages.

EKCD was tested on amd64 using bhyve and i386, mipsel and sparc64 using QEMU.
The feature still has to be tested on arm and arm64 as it wasn't possible to run
FreeBSD due to the problems with QEMU emulation and lack of hardware.

Designed by:	def, pjd
Reviewed by:	cem, oshogbo, pjd
Partial review:	delphij, emaste, jhb, kib
Approved by:	pjd (mentor)
Differential Revision:	https://reviews.freebsd.org/D4712
2016-12-10 16:20:39 +00:00
Sevan Janiyan
0530a5214f dumpon(8) appears to be present in FreeBSD 2.0.5,
despite initial import of man page listed FreeBSD 2.1.

PR:		212445
Approved by:	bcr (mentor)
MFC after:	4 days
Differential Revision:	https://reviews.freebsd.org/D8105
2016-10-02 23:35:45 +00:00
Marcelo Araujo
0bfc2a1246 Use nitems() instead of sizeof(name) / sizeof(*name).
MFC after:	2 weeks.
2016-04-19 04:28:25 +00:00
Glen Barber
406d87b1c3 Explicitly add more files to the 'runtime' package.
Sponsored by:	The FreeBSD Foundation
2016-02-09 20:19:31 +00:00
Steven Hartland
45a9027de4 Fix dumpon compatibility with dumpdev kenv
The dumpdev kenv supports devices without the /dev/ prefix, fix dumpon to
also support this which is required after r288153.

MFC after:	1 week
Sponsored by:	Multiplay
2015-11-23 14:06:21 +00:00
Simon J. Gerraty
ccfb965433 Add META_MODE support.
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision:       D2796
Reviewed by: brooks imp
2015-06-13 19:20:56 +00:00
Simon J. Gerraty
44d314f704 dirdeps.mk now sets DEP_RELDIR 2015-06-08 23:35:17 +00:00
Simon J. Gerraty
9268022b74 Merge from head@274682 2014-11-19 01:07:58 +00:00
Andrey V. Elsukov
a62c8c6a99 Revert r156046. We support setting dumpdev via loader tunable again.
Also change default disk name to ada.

MFC after:	3 weeks
2014-10-08 12:19:48 +00:00
Simon J. Gerraty
fae50821ae Updated dependencies 2014-05-16 14:09:51 +00:00
Simon J. Gerraty
76b28ad6ab Updated dependencies 2014-05-10 05:16:28 +00:00
Simon J. Gerraty
d1d0158641 Merge from head 2013-09-05 20:18:59 +00:00
Joel Dahl
4684a6ef0c Adapt to the fact that minidumps are now on by default.
PR:		177188
2013-04-30 07:22:03 +00:00
Simon J. Gerraty
7cf3a1c6b2 Updated dependencies 2013-03-11 17:21:52 +00:00
Simon J. Gerraty
f5f7c05209 Updated dependencies 2013-02-16 01:23:54 +00:00
Simon J. Gerraty
23090366f7 Sync from head 2012-11-04 02:52:03 +00:00
Alfred Perlstein
4a790edd1b Document that you can use -v along with -l.
Noticed by: pjd
2012-11-02 17:30:08 +00:00
Alfred Perlstein
f6848434fe Add an option to display the current dump device via dumpon -l.
MFC after:	2 weeks
2012-11-01 18:59:19 +00:00
Marcel Moolenaar
7750ad47a9 Sync FreeBSD's bmake branch with Juniper's internal bmake branch.
Requested by: Simon Gerraty <sjg@juniper.net>
2012-08-22 19:25:57 +00:00
Ruslan Ermilov
106d839190 Switch the default WARNS level for sbin/ to 6.
Submitted by:	Ulrich Spörlein
2009-10-19 16:00:24 +00:00
John Baldwin
b54a17cd2f Whitespace and style nits. 2006-10-31 22:36:49 +00:00
Paul Saab
ce893772bd With minidumps, the dumping partition could be smaller than physical
memory, so checking the size of the partition is not necessary.

Tested by:	kris
2006-04-27 19:01:54 +00:00
Kris Kennaway
3676d4b6e2 It has not been possible to specify a dumpdev in loader.conf since 2002,
so don't raise false hopes here.
2006-02-27 00:15:53 +00:00
Pav Lucistnik
62aedb0446 - Mention the size of the additional header
PR:		docs/85867
Submitted by:	dinoex
MFC after:	1 week
2006-01-07 19:17:13 +00:00
Ruslan Ermilov
6087df9e8b Sort sections. 2005-01-18 10:09:38 +00:00
Dag-Erling Smørgrav
9872f15d75 Promote mediasize and physmem to uintmax_t when comparing them. 2004-10-04 06:54:19 +00:00
Dag-Erling Smørgrav
53504142a9 Whitespace nit. 2004-10-03 23:53:54 +00:00
Dag-Erling Smørgrav
9f4ed0f59b dumpon builds cleanly at WARNS level 6. 2004-10-03 23:39:14 +00:00
Dag-Erling Smørgrav
c0046e261f Verify that the specified device is at least as large as hw.physmem. 2004-10-03 23:38:49 +00:00
Dag-Erling Smørgrav
842ddc99ec Wrap some long lines (no content changes) 2004-10-03 23:35:34 +00:00
Maxim Konovalov
b705040954 `off' is a keyword, not a parameter name.
Obtained from:	DragonFly
2004-07-18 09:57:47 +00:00
Mark Murray
4c723140a4 Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp
2004-04-09 19:58:40 +00:00
Johan Karlsson
604d24db95 style.Makefile(5):
Use WARNS?= instead of WARNS=.
2004-02-23 20:25:27 +00:00
Hiten Pandya
8340d5bcae Bring the dumpon(8) man page closer to reality:
- dumpon utility has not used kern.dumpdev sysctl
      since rev. 1.14 (sbin/dumpon/dumpon.c) when phk@
      updated it to use the DIOCSKERNELDUMP ioctl [1]
    - remove obsolete reference to sysctl(3)

While I am there, fix two style nits:

    - use .Nm instead of `dumpon'
    - change NOTES to IMPLEMENTATION NOTES, to bring
      it in line with recommended section headings in
      mdoc(7)

Original patch by: Martin Faxer <gmh003532brfmasthugget.se> [1]

PR: docs/39293
Approved and Reviewed by: des (mentor), re (scottl, bmah)
2003-05-07 19:37:51 +00:00
David E. O'Brien
c69284ca08 Use __FBSDID() to quiet GCC 3.3 warnings. 2003-05-03 18:41:59 +00:00
Tom Rhodes
ce66ddb763 s/filesystem/file system/g as discussed on -developers 2002-08-21 18:11:48 +00:00
Ruslan Ermilov
80c9c8be99 Improve wording even more. 2002-08-13 11:39:38 +00:00
Matthew Dillon
6ff8114c79 Replace the 'at least the amount of physical memory + 64K' with a better
explanation in regards to sizing the dump device.
2002-07-09 17:27:08 +00:00
Philippe Charnier
e1205e80e5 The .Nm utility 2002-07-06 19:34:18 +00:00
Alfred Perlstein
4a21733e2d unbreak build: include string.h for strcmp prototype. 2002-05-11 03:07:38 +00:00
Tom Rhodes
0042d709b8 Update dumpon manual page to explain single/multi-user usability
PR:	36465
No Objections from:	ru
2002-04-09 19:51:50 +00:00
Poul-Henning Kamp
7f086a0852 Rename DIOCGKERNELDUMP to DIOCSKERNELDUMP as it strictly speaking
is a "set" not a "get" operation.

Sponsored by:	DARPA & NAI Labs.
2002-04-09 10:04:09 +00:00
Poul-Henning Kamp
2dd527b3ac Move generic disk ioctls from <sys/disklabel.h> to <sys/disk.h>.
Sponsored by:	DARPA & NAI Labs
2002-04-08 09:20:07 +00:00
Poul-Henning Kamp
9e9c1cad4c Here follows the new kernel dumping infrastructure.
Caveats:

The new savecore program is not complete in the sense that it emulates
enough of the old savecores features to do the job, but implements none
of the options yet.

I would appreciate if a userland hacker could help me out getting savecore
to do what we want it to do from a users point of view, compression,
email-notification, space reservation etc etc.  (send me email if
you are interested).

Currently, savecore will scan all devices marked as "swap" or "dump" in
/etc/fstab _or_ any devices specified on the command-line.

All architectures but i386 lack an implementation of dumpsys(), but
looking at the i386 version it should be trivial for anybody familiar
with the platform(s) to provide this function.

Documentation is quite sparse at this time, more to come.

Sponsored by:   DARPA, NAI Labs

Details:

Dumpon now opens the device and uses ioctl(DIOCGKERNELDUMP) to set it
to be the dumpdevice.  When "off" is set, /dev/null is used.
2002-03-31 22:24:24 +00:00
Warner Losh
d1a939c146 o __P
o Strict ANSI declarations.
o return (foo);
o main (int, char *[])
2002-03-18 06:59:15 +00:00
Maxim Sobolev
21367f05ab CG hard sentence breaks.
Submitted by:	ru
2002-01-23 09:35:55 +00:00
Maxim Sobolev
65ab9c78a3 Don't use `you'.
Submitted by:	ru
2002-01-22 21:11:18 +00:00
Maxim Sobolev
dcd7d9b7b7 Allow dump device be configured as early as possible using loader(8) tunable.
This allows obtaining crash dumps from the panics occured during late stages
of kernel initialisation before system enters into single-user mode.

MFC after:	2 weeks
2002-01-21 01:16:11 +00:00
David E. O'Brien
2d68bf45bf Default to WARNS=2.
Binary builds that cannot handle this must explicitly set WARNS=0.

Reviewed by:	mike
2001-12-04 02:19:58 +00:00
Nick Hibma
76c83512ef Typo. 2001-10-28 16:47:06 +00:00