diff options
author | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-04-20 02:39:29 +0200 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-07-15 16:03:01 +0200 |
commit | 4d3beaa06d3536aa8968d1828a66bd5ccb5036ac (patch) | |
tree | 3bc769db2b6214f2e7fa298e915a313225949a21 /Documentation/SAK.txt | |
parent | docs: blockdev: add it to the admin-guide (diff) | |
download | linux-4d3beaa06d3536aa8968d1828a66bd5ccb5036ac.tar.xz linux-4d3beaa06d3536aa8968d1828a66bd5ccb5036ac.zip |
docs: security: move some books to it and update
The following files belong to security:
Documentation/security/LSM.rst -> Documentation/security/lsm-development.rst
Documentation/lsm.txt -> Documentation/security/lsm.rst
Documentation/SAK.txt -> Documentation/security/sak.rst
Documentation/siphash.txt -> Documentation/security/siphash.rst
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'Documentation/SAK.txt')
-rw-r--r-- | Documentation/SAK.txt | 91 |
1 files changed, 0 insertions, 91 deletions
diff --git a/Documentation/SAK.txt b/Documentation/SAK.txt deleted file mode 100644 index 260e1d3687bd..000000000000 --- a/Documentation/SAK.txt +++ /dev/null @@ -1,91 +0,0 @@ -========================================= -Linux Secure Attention Key (SAK) handling -========================================= - -:Date: 18 March 2001 -:Author: Andrew Morton - -An operating system's Secure Attention Key is a security tool which is -provided as protection against trojan password capturing programs. It -is an undefeatable way of killing all programs which could be -masquerading as login applications. Users need to be taught to enter -this key sequence before they log in to the system. - -From the PC keyboard, Linux has two similar but different ways of -providing SAK. One is the ALT-SYSRQ-K sequence. You shouldn't use -this sequence. It is only available if the kernel was compiled with -sysrq support. - -The proper way of generating a SAK is to define the key sequence using -``loadkeys``. This will work whether or not sysrq support is compiled -into the kernel. - -SAK works correctly when the keyboard is in raw mode. This means that -once defined, SAK will kill a running X server. If the system is in -run level 5, the X server will restart. This is what you want to -happen. - -What key sequence should you use? Well, CTRL-ALT-DEL is used to reboot -the machine. CTRL-ALT-BACKSPACE is magical to the X server. We'll -choose CTRL-ALT-PAUSE. - -In your rc.sysinit (or rc.local) file, add the command:: - - echo "control alt keycode 101 = SAK" | /bin/loadkeys - -And that's it! Only the superuser may reprogram the SAK key. - - -.. note:: - - 1. Linux SAK is said to be not a "true SAK" as is required by - systems which implement C2 level security. This author does not - know why. - - - 2. On the PC keyboard, SAK kills all applications which have - /dev/console opened. - - Unfortunately this includes a number of things which you don't - actually want killed. This is because these applications are - incorrectly holding /dev/console open. Be sure to complain to your - Linux distributor about this! - - You can identify processes which will be killed by SAK with the - command:: - - # ls -l /proc/[0-9]*/fd/* | grep console - l-wx------ 1 root root 64 Mar 18 00:46 /proc/579/fd/0 -> /dev/console - - Then:: - - # ps aux|grep 579 - root 579 0.0 0.1 1088 436 ? S 00:43 0:00 gpm -t ps/2 - - So ``gpm`` will be killed by SAK. This is a bug in gpm. It should - be closing standard input. You can work around this by finding the - initscript which launches gpm and changing it thusly: - - Old:: - - daemon gpm - - New:: - - daemon gpm < /dev/null - - Vixie cron also seems to have this problem, and needs the same treatment. - - Also, one prominent Linux distribution has the following three - lines in its rc.sysinit and rc scripts:: - - exec 3<&0 - exec 4>&1 - exec 5>&2 - - These commands cause **all** daemons which are launched by the - initscripts to have file descriptors 3, 4 and 5 attached to - /dev/console. So SAK kills them all. A workaround is to simply - delete these lines, but this may cause system management - applications to malfunction - test everything well. - |