[PATCH 00/10] makedumpfile/eppic: Sample eppic scripts

[PATCH 00/10] makedumpfile/eppic: Sample eppic scripts

[Aruna Balakrishnaiah]

The series has few sample eppic scripts to scrub the security
data.


---

Aruna Balakrishnaiah (10):
      Scrub executable name for each user process
      Scrub filenames of cached dentries
      Scrub all entries in the keyring
      Clear the message data of all ap_bus requests
      Scrub data in tcp socket buffers
      Scrub data of udp socket buffers
      Scrub data of unix socket buffers
      Scrub socket buffers of guest network I/O
      Scrub buffers involved in guest block I/O
      Install sample eppic scripts


 Makefile                           |    1 
 eppic_scripts/ap_messages.c        |   78 ++++++++++++++++++++++++++++++
 eppic_scripts/dir_names.c          |   78 ++++++++++++++++++++++++++++++
 eppic_scripts/keyring.c            |   57 ++++++++++++++++++++++
 eppic_scripts/proc_names.c         |   49 +++++++++++++++++++
 eppic_scripts/tcp_sk_buf.c         |   78 ++++++++++++++++++++++++++++++
 eppic_scripts/udp_sk_buf.c         |   79 ++++++++++++++++++++++++++++++
 eppic_scripts/unix_sk_buff.c       |   81 +++++++++++++++++++++++++++++++
 eppic_scripts/vhost_net_buffers.c  |   95 ++++++++++++++++++++++++++++++++++++
 eppic_scripts/vhost_scsi_buffers.c |   71 +++++++++++++++++++++++++++
 makedumpfile.spec                  |    3 +
 11 files changed, 670 insertions(+)
 create mode 100644 eppic_scripts/ap_messages.c
 create mode 100644 eppic_scripts/dir_names.c
 create mode 100644 eppic_scripts/keyring.c
 create mode 100644 eppic_scripts/proc_names.c
 create mode 100644 eppic_scripts/tcp_sk_buf.c
 create mode 100644 eppic_scripts/udp_sk_buf.c
 create mode 100644 eppic_scripts/unix_sk_buff.c
 create mode 100644 eppic_scripts/vhost_net_buffers.c
 create mode 100644 eppic_scripts/vhost_scsi_buffers.c

-- 


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 01/10] Scrub executable name for each user process

[Aruna Balakrishnaiah]

Walk all processes via the tasks lists starting from init_task

   extern struct task_struct init_task;

   struct task_struct {
        ...
        struct list_head tasks;
        ...
        char comm[TASK_COMM_LEN]; /* executable name excluding path */
        ...
   };

For each user space process clear executable name

   struct task_struct *tsk;
   list_for_each_entry(tsk, &init_task, tasks) {
       if (tsk->mm)
           memset(tsk->comm, 0, TASK_COMM_LEN);
   }


Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/proc_names.c |   49 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 eppic_scripts/proc_names.c

diff --git a/eppic_scripts/proc_names.c b/eppic_scripts/proc_names.c
new file mode 100644
index 0000000..12876df
--- /dev/null
+++ b/eppic_scripts/proc_names.c
@@ -0,0 +1,49 @@
+string
+proc_opt()
+{
+	    return "l";
+}
+
+string
+proc_usage()
+{
+	    return "\n";
+}
+
+static void
+proc_showusage()
+{
+	    printf("usage : proc %s", proc_usage());
+}
+
+string
+proc_help()
+{
+	    return "Help";
+}
+
+int
+proc()
+{
+	struct list_head *head, *next;
+	struct task_struct *tsk;
+
+	tsk = &init_task;
+
+	head = (struct list_head *) &(tsk->tasks);
+	next = (struct list_head *) tsk->tasks.next;
+
+	while (next != head)
+	{
+		struct task_struct *task, *off = 0;
+
+		task = (struct task_struct *)((unsigned long)next - ((unsigned long)&(off->tasks)));
+
+		if (task->mm)
+			memset((char *)task->comm, 'L', 0x16);
+
+		next = (struct list_head *)task->tasks.next;
+	}
+
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 02/10] Scrub filenames of cached dentries

[Aruna Balakrishnaiah]

 i) iterate over all mounted filesystems

   struct vfsmount {
        struct list_head mnt_hash;
        ...
        struct dentry *mnt_root;        /* root of the mounted tree */
        ...
   };

   for (u = 0; i < HASH_SIZE; u++) {
       struct vfsmount *mnt;
       list_for_each_entry(mnt, &mount_hashtable[u], mnt_hash) {
          struct dentry *root;
          root = mnt->mnt_root;
          ...
       }
   }

   ii) recursively walk the dentries of each tree starting from root dentry
       and clear d_name and d_iname

   struct dentry {
        ...
        struct qstr d_name;
        ...
        unsigned char d_iname[DNAME_INLINE_LEN];        /* small names */
        ...
        struct list_head d_subdirs;     /* our children */
        ...
   };

   void walk_dentries(struct dentry *dentry)
   {
       struct dentry *child;
       memset(dentry->d_iname, 0, DNAME_INLINE_LEN);
       memset(dentry->d_name.name, 0, dentry->d_name.len);
       list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child)
           walk_dentries(child);
   }

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/dir_names.c |   78 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 eppic_scripts/dir_names.c

diff --git a/eppic_scripts/dir_names.c b/eppic_scripts/dir_names.c
new file mode 100644
index 0000000..dbe6d00
--- /dev/null
+++ b/eppic_scripts/dir_names.c
@@ -0,0 +1,78 @@
+string
+vfs_opt()
+{
+	    return "l";
+}
+
+string
+vfs_usage()
+{
+	    return "\n";
+}
+
+static void
+vfs_showusage()
+{
+	    printf("usage : vfs %s", vfs_usage());
+}
+
+string
+vfs_help()
+{
+	    return "Help";
+}
+
+void
+rm_names(struct dentry *dir)
+{
+	struct list_head *next, *head;
+
+	memset(dir->d_iname, 0, 0x20);
+	memset(dir->d_name.name, 0, 0x20);
+
+	head = (struct list_head *)&(dir->d_subdirs);
+	next = (struct list_head *)dir->d_subdirs.next;
+
+	while (next != head)
+	{
+		struct dentry *child, *off = 0;
+
+		child = (struct dentry *)((unsigned long)next - (unsigned long)&(off->d_u));
+		rm_names(child);
+		next = child->d_u.d_child.next;
+	}
+
+	return;
+}
+
+int
+vfs()
+{
+	int i;
+	struct list_head *tab;
+
+	tab = (struct list_head *)mount_hashtable;
+
+	for (i = 0; i < 256; i++)
+	{
+		struct list_head *head, *next;
+
+		head = (struct list_head *) (tab + i);
+		next = (struct list_head *) head->next;
+
+		if (!next)
+			continue;
+
+		while (next != head)
+		{
+			struct mount *mntfs;
+			struct dentry *root;
+
+			mntfs = (struct mount *)((unsigned long)next);
+			root = (struct dentry *)mntfs->mnt.mnt_root;
+			rm_names(root);
+			next = mntfs->mnt_hash.next;
+		}
+	}
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 03/10] Scrub all entries in the keyring

[Aruna Balakrishnaiah]

Clear all entries in the keyring

   Scan the keyring_name_hash hash table

   static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];

   for (i = 0; i < KEYRING_NAME_HASH_SIZE; i++)
       if (!list_empty(&keyring_name_hash[i])) {
           ...
       }

   For each non-empty list walk all keyring entries

   struct key {
        ...
        struct key_type         *type;          /* type of key */
        ...
        unsigned short          datalen;        /* payload data length */
        ...
        union {
                struct list_head        link;
                ...
        } type_data;
        ...
        union {
                unsigned long           value;
                void __rcu              *rcudata;
                void                    *data;
                struct keyring_list __rcu *subscriptions;
        } payload;
   };

   struct key *key;
   list_for_each_entry(key, &keyring_name_hash[i], type_data.link) {
       ...
   }

   Clear value/rcudata/data dependent on the type of the key.

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/keyring.c |   57 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 eppic_scripts/keyring.c

diff --git a/eppic_scripts/keyring.c b/eppic_scripts/keyring.c
new file mode 100644
index 0000000..22e7db8
--- /dev/null
+++ b/eppic_scripts/keyring.c
@@ -0,0 +1,57 @@
+string
+skey_opt()
+{
+	    return "l";
+}
+
+string
+skey_usage()
+{
+	    return "\n";
+}
+
+static void
+skey_showusage()
+{
+	    printf("usage : skey %s", skey_usage());
+}
+
+string
+skey_help()
+{
+	    return "Help";
+}
+
+int
+skey()
+{
+	int i;
+	struct list_head **tab;
+
+	tab = &keyring_name_hash;
+
+	for (i = 0; i < 32; i++)
+	{
+		struct list_head *next, *head;
+
+		head = (struct list_head *) (tab + i);
+		next = (struct list_head *) head->next;
+
+		if (!next)
+			continue;
+
+		while (next != head)
+		{
+			struct key *mykey, *off = 0;
+
+			mykey = (struct key *)((unsigned long)(next) - ((unsigned long)&(off->type_data)));
+
+			memset((char *)&(mykey->payload.value), 'A', 0x8);
+			memset((char *)mykey->payload.rcudata, 'A', 0x20);
+			memset((char *)mykey->payload.data, 'A', 0x20);
+
+			next = (struct list_head *) mykey->type_data.link.next;
+		}
+	}
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 04/10] Clear the message data of all ap_bus requests

[Aruna Balakrishnaiah]

   Walk all devices in the LIST_HEAD(ap_device_list);

   struct ap_device {
        ...
        struct list_head list;          /* private list of all AP devices. */
       ...
        struct list_head pendingq;      /* List of message sent to AP queue. */
        int pendingq_count;             /* # requests on pendingq list. */
        struct list_head requestq;      /* List of message yet to be sent. */
        int requestq_count;             /* # requests on requestq list. */
        ...
   };

   struct ap_device *device;
   list_for_each_entry(device, &ap_device_list, list) {
        ...
   }

   For each ap device walk the pendingq and requestq list

   struct ap_message {
        struct list_head list;          /* Request queueing. */
        ...
        void *message;                  /* Pointer to message buffer. */
        size_t length;                  /* Message length. */
        ...
   };

   struct ap_message *apmsg;
   list_for_each_entry(apmsg, &device->pendingq, list) {
        ...
   }
   list_for_each_entry(apmsg, &device->requestq, list) {
        ...
   }

   For each message in pendingq and requestq clear the message

   memset(apmsg->message, 0, apmsg->length);

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/ap_messages.c |   78 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 eppic_scripts/ap_messages.c

diff --git a/eppic_scripts/ap_messages.c b/eppic_scripts/ap_messages.c
new file mode 100644
index 0000000..f0e9f6f
--- /dev/null
+++ b/eppic_scripts/ap_messages.c
@@ -0,0 +1,78 @@
+string
+ap_device_opt()
+{
+	    return "l";
+}
+
+string
+ap_device_usage()
+{
+	    return "\n";
+}
+
+static void
+ap_device_showusage()
+{
+	    printf("usage : ap_device %s", ap_device_usage());
+}
+
+string
+ap_device_help()
+{
+	    return "Help";
+}
+
+int
+ap_device()
+{
+	int i;
+	struct list_head *next;
+	struct list_head *head;
+	struct ap_device *off = 0;
+
+	head = (struct list_head *)&ap_device_list;
+	next = (struct list_head *)head->next;
+
+	if (!next)
+		return 1;
+
+	while (next != head)
+	{
+		struct ap_device *device;
+		struct list_head *next1, *head1;
+
+		device = (struct ap_device *)((unsigned long)next - ((unsigned long)&(off->list)));
+
+		head1 = (struct list_head *)&(device->pendingq);
+		next1 = (struct list_head *)device->pendingq.next;
+
+		while (next1 != head1)
+		{
+			struct ap_message *apmsg;
+			apmsg = (struct ap_message *)next1;
+
+			memset((char *)apmsg->message, 'L', apmsg->length);
+			memset((char *)&(apmsg->length), 'L', 0x8);
+
+			next1 = (struct list_head *)apmsg->list.next;
+		}
+
+		head1 = (struct list_head *)&(device->requestq);
+		next1 = (struct list_head *)device->requestq.next;
+
+		while (next1 != head1)
+		{
+			struct ap_message *apmsg;
+			apmsg = (struct ap_message *)next1;
+
+			memset((char *)apmsg->message, 'L', apmsg->length);
+			memset((char *)&(apmsg->length), 'L', 0x8);
+
+			next1 = (struct list_head *)apmsg->list.next;
+		}
+
+		next = (struct list_head *)device->list.next;
+	}
+
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 05/10] Scrub data in tcp socket buffers

[Aruna Balakrishnaiah]

     Find tcp domain sockets (struct sock *sk)

     tcp sockets:

       Iterate from 0 to INET_LHTABLE_SIZE and get inet_list_hashbucket from
       tcp_hash_info.listening_hash[<index>]
         for (i = 0; i < INET_LHTABLE_SIZE; i++) {
             struct inet_listen_hashbucket *ilb = &tcp_hashinfo.listening_hash[i];
         }
         for (i = 0; i < INET_LHTABLE_SIZE; i++) {
             struct inet_listen_hashbucket *ilb = &tcp_hashinfo.listening_hash[i];
         }
       For each hash bucket iterate over ilb->head null list to get sockets:
         struct sock *sk;
         sk_nulls_for_each(sk, node, &ilb->head) {
             ...
         }


      For each socket iterate over the socket buffers in
       sk_receive_queue and sk_write_queue:

       struct sock {
            ...
            struct sk_buff_head     sk_receive_queue;
            ...
            struct sk_buff_head     sk_write_queue;
            ...
       };

       struct sk_buff_head {
            struct sk_buff  *next;
            struct sk_buff  *prev;
       };

       For each struct sk_buff in the two lists clear the memory referenced
       by skb->data / skb->data_len:

       struct sk_buff {
            ...
            unsigned int            data_len;
            ...
            unsigned char           *data;
            ...
       };

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/tcp_sk_buf.c |   78 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 eppic_scripts/tcp_sk_buf.c

diff --git a/eppic_scripts/tcp_sk_buf.c b/eppic_scripts/tcp_sk_buf.c
new file mode 100644
index 0000000..4c3efc3
--- /dev/null
+++ b/eppic_scripts/tcp_sk_buf.c
@@ -0,0 +1,78 @@
+string
+tcp_opt()
+{
+	    return "l";
+}
+
+string
+tcp_usage()
+{
+	    return "\n";
+}
+
+static void
+tcp_showusage()
+{
+	    printf("usage : tcp %s", tcp_non_legacy_usage());
+}
+
+string
+tcp_help()
+{
+	    return "Help";
+}
+
+int
+tcp()
+{
+	int i;
+	struct inet_hashinfo *tab;
+	struct sock_common *off = 0;
+
+	tab = &tcp_hashinfo;
+
+	for (i = 0; i < 32; i++) {
+		struct hlist_nulls_node *pos;
+
+		pos = tab->listening_hash[i].head.first;
+
+		while (!((unsigned long)pos & 1)) {
+			struct sock *sk;
+			struct sk_buff *next;
+			struct sk_buff_head *head;
+			struct hlist_nulls_node *node;
+
+			sk  = (struct sock *)((unsigned long)pos - (unsigned long)&(off->skc_dontcopy_begin));
+
+			head = (struct sk_buff_head *)&(sk->sk_receive_queue);
+			next = (struct sk_buff *)sk->sk_receive_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *) next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+				next = buff->next;
+			}
+
+			head = (struct sk_buff_head *)&(sk->sk_write_queue);
+			next = (struct sk_buff *)sk->sk_write_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *) next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+				next = buff->next;
+			}
+
+			node = (struct hlist_nulls_node *)((unsigned long)sk + (unsigned long)&(off->skc_dontcopy_begin));
+			pos = node->next;
+		}
+	}
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 06/10] Scrub data of udp socket buffers

[Aruna Balakrishnaiah]

Find all udp sockets (struct sock *sk)

 udp sockets:

   Iterate from 0 to udp_table->mask and get udp_hslot from hash table:
     for (i = 0; i < udp->table->mask; i++) {
         struct udp_hslot *hslot = udp_table->hash[i];
         ...
     }
   For each hslot iterate over hslot->head null list to get sockets:
     struct sock *sk;
     sk_nulls_for_each(sk, node, &hslot->head) {
         ...
     }

  For each socket iterate over the socket buffers in
  sk_receive_queue and sk_write_queue:

   struct sock {
        ...
        struct sk_buff_head     sk_receive_queue;
        ...
        struct sk_buff_head     sk_write_queue;
        ...
   };

   struct sk_buff_head {
        struct sk_buff  *next;
        struct sk_buff  *prev;
   };

   For each struct sk_buff in the two lists clear the memory referenced
   by skb->data / skb->data_len:

   struct sk_buff {
        ...
        unsigned int            data_len;
        ...
        unsigned char           *data;
        ...
   };


Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/udp_sk_buf.c |   79 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 eppic_scripts/udp_sk_buf.c

diff --git a/eppic_scripts/udp_sk_buf.c b/eppic_scripts/udp_sk_buf.c
new file mode 100644
index 0000000..7e64300
--- /dev/null
+++ b/eppic_scripts/udp_sk_buf.c
@@ -0,0 +1,79 @@
+string
+udp_opt()
+{
+	    return "l";
+}
+
+string
+udp_usage()
+{
+	    return "\n";
+}
+
+static void
+udp_showusage()
+{
+	    printf("usage : udp %s", udp_usage());
+}
+
+string
+udp_help()
+{
+	    return "Help";
+}
+
+int
+udp()
+{
+	int i;
+	int size;
+	struct udp_table *table;
+	struct sock_common *off = 0;
+
+	table = &udp_table;
+
+	for (i = 0; i < table->mask; i++) {
+		struct hlist_nulls_node *pos;
+
+		pos = table->hash[i].head.first;
+
+		while (!((unsigned long)pos & 1)) {
+			struct sock *sk;
+			struct sk_buff *next;
+			struct sk_buff_head *head;
+			struct hlist_nulls_node *node;
+
+			sk  = (struct sock *)((unsigned long)pos - ((unsigned long)&(off->skc_dontcopy_begin)));
+
+			head = (struct sk_buff_head *)&(sk->sk_receive_queue);
+			next = (struct sk_buff *)sk->sk_receive_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *)next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+				next = buff->next;
+			}
+
+                        head = (struct sk_buff_head *)&(sk->sk_write_queue);
+			next = (struct sk_buff *)sk->sk_write_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *)next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+				next = buff->next;
+                        }
+
+			node = (struct hlist_nulls_node *)((unsigned long)sk + (unsigned long)&(off->skc_dontcopy_begin));
+		        pos = node->next;
+		}
+	}
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 07/10] Scrub data of unix socket buffers

[Aruna Balakrishnaiah]

 Iterate from 0 to UNIX_HASH_SIZE and then walk the hlist in
     for (i = 0; i < UNIX_HASH_SIZE; i++) {
         struct list_head *list = &unix_socket_table[i];
         ...
     }
   Walk each non-empty list in unix_socket_table
     struct sock *sk;
     sk_for_each(sk, node, &unix_socket_table[i])


   For each socket iterate over the socket buffers in
   sk_receive_queue and sk_write_queue:

   struct sock {
        ...
        struct sk_buff_head     sk_receive_queue;
        ...
        struct sk_buff_head     sk_write_queue;
        ...
   };

   struct sk_buff_head {
        struct sk_buff  *next;
        struct sk_buff  *prev;
   };

   For each struct sk_buff in the two lists clear the memory referenced
   by skb->data / skb->data_len:

   struct sk_buff {
        ...
        unsigned int            data_len;
        ...
        unsigned char           *data;
        ...
   };

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/unix_sk_buff.c |   81 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 eppic_scripts/unix_sk_buff.c

diff --git a/eppic_scripts/unix_sk_buff.c b/eppic_scripts/unix_sk_buff.c
new file mode 100644
index 0000000..6ab1e6c
--- /dev/null
+++ b/eppic_scripts/unix_sk_buff.c
@@ -0,0 +1,81 @@
+string
+sunix_opt()
+{
+	    return "l";
+}
+
+string
+sunix_usage()
+{
+	    return "\n";
+}
+
+static void
+sunix_showusage()
+{
+	    printf("usage : sunix %s", sunix_usage());
+}
+
+string
+sunix_help()
+{
+	    return "Help";
+}
+
+int
+sunix()
+{
+	int i;
+	int size;
+	struct hlist_head **tab;
+	struct sock_common *off = 0;
+
+	tab = &unix_socket_table;
+
+	for (i = 0; i < 256; i++) {
+		struct hlist_node *pos;
+		struct hlist_node *node;
+		struct hlist_head *tmp;
+
+		tmp = (struct hlist_head *)(tab + i);
+		pos = tmp->first;
+
+		while (pos) {
+			struct sock *sk;
+			struct sk_buff *next;
+			struct sk_buff_head *head;
+
+			sk = (struct sock *)((unsigned long)pos - (unsigned long)&(off->skc_dontcopy_begin));
+
+			head = (struct sk_buff_head *)&(sk->sk_receive_queue);
+			next = (struct sk_buff *)sk->sk_receive_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *)next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+				next = buff->next;
+			}
+
+			head = (struct sk_buff_head *)&(sk->sk_write_queue);
+			next = (struct sk_buff *)sk->sk_write_queue.next;
+
+			while (next != head)
+			{
+				struct sk_buff *buff = (struct sk_buff *)next;
+
+				memset((char *)buff->data, 'L', buff->data_len);
+				memset((char *)&(buff->data_len), 'L', 0x4);
+
+			        next = buff->next;
+			}
+
+			node = (struct hlist_node *)((unsigned long)sk + (unsigned long)&(off->skc_dontcopy_begin));
+			pos = node->next;
+		}
+	}
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 08/10] Scrub socket buffers of guest network I/O

[Aruna Balakrishnaiah]

vhost_net instance will be attached to the file's private data.
To get to the right file check the fdtable for each task, if the file
has registered its fops with vhost_net_open, if so we can retreive the
file's private data.

	if (task->files->fdt->fd[i]->f_op->open == &vhost_net_open)
		struct vhost_net *net = f->private_data;

	struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_MAX];
	struct vhost_virtqueue *vq = &nvq->vq;
	struct socket *sock = vq->private_data;
	struct sock *sk = sock->sk;

	struct sk_buff *next = sk->sk_receive_queue.next;
	struct sk_buff *prev = sk->sk_receive_queue.prev;

	Scrub next->data till the end of the sk_receive_queue and sk_write_queue list


Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/vhost_net_buffers.c |   95 +++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 eppic_scripts/vhost_net_buffers.c

diff --git a/eppic_scripts/vhost_net_buffers.c b/eppic_scripts/vhost_net_buffers.c
new file mode 100644
index 0000000..6c2b8df
--- /dev/null
+++ b/eppic_scripts/vhost_net_buffers.c
@@ -0,0 +1,95 @@
+string
+vhost_opt()
+{
+	    return "l";
+}
+
+string
+vhost_usage()
+{
+	    return "\n";
+}
+
+static void
+vhost_showusage()
+{
+	    printf("usage : net_ %s", vhost_usage());
+}
+
+string
+vhost_help()
+{
+	    return "Help";
+}
+
+void
+vhost_net(struct vhost_net *net)
+{
+	int i;
+
+	for (i = 0; i < 2; i++) {
+		struct vhost_net_virtqueue *nvq = &net->vqs[i];
+		struct vhost_virtqueue *vq = &nvq->vq;
+		struct socket *sock = (struct socket *)vq->private_data;
+		struct sock *sk = sock->sk;
+
+		struct sk_buff_head *head = &(sk->sk_receive_queue);
+		struct sk_buff *next = sk->sk_receive_queue.next;
+
+		while (next != head)
+		{
+			struct sk_buff *buff = (struct sk_buff *) next;
+
+			memset((unsigned char *)buff->data, 'L', buff->data_len);
+			memset((char *)&(buff->data_len), 'L', 0x4);
+
+			next = buff->next;
+		}
+
+		head = (struct sk_buff_head *)&(sk->sk_write_queue);
+		next = (struct sk_buff *)sk->sk_write_queue.next;
+
+		while (next != head)
+		{
+			struct sk_buff *buff = (struct sk_buff *) next;
+
+			memset((char *)buff->data, 'L', buff->data_len);
+			memset((char *)&(buff->data_len), 'L', 0x4);
+
+			next = buff->next;
+
+		}
+	}
+}
+
+int
+vhost()
+{
+	struct list_head *head, *next;
+	struct task_struct *tsk;
+
+	tsk = &init_task;
+
+	head = (struct list_head *) &(tsk->tasks);
+	next = (struct list_head *) tsk->tasks.next;
+
+	while (next != head)
+	{
+		int i;
+		struct task_struct *task, *off = 0;
+
+		task = (struct task_struct *)((unsigned long)next - ((unsigned long)&(off->tasks)));
+
+		if (task->files && task->files->fdt) {
+			for (i = 0; i < task->files->fdt->max_fds; i++) {
+				if (task->files->fdt->fd[i] && task->files->fdt->fd[i]->f_op
+					&& task->files->fdt->fd[i]->f_op->open == &vhost_net_open)
+					vhost_net((struct vhost_net *)task->files->fdt->fd[i]->private_data);
+			}
+		}
+
+		next = (struct list_head *)task->tasks.next;
+	}
+
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 09/10] Scrub buffers involved in guest block I/O

[Aruna Balakrishnaiah]

vhost_scsi instance will be attached to the file's private data.
To get to the right file check the fdtable for each task, if the file
has registered its fops with vhost_net_open, if so we can retreive the
file's private data.

if (task->files->fdt->fd[i]->f_op->open == &vhost_scsi_open)
	vhost_scsi *vs = task->files->fdt->fd[i]->private_data;

struct vhost_virtqueue *vq = (struct vhost_virtqueue *)vs->vqs[i].vq;
scrub vq->iov[j].iov_base

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 eppic_scripts/vhost_scsi_buffers.c |   71 ++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 eppic_scripts/vhost_scsi_buffers.c

diff --git a/eppic_scripts/vhost_scsi_buffers.c b/eppic_scripts/vhost_scsi_buffers.c
new file mode 100644
index 0000000..caa4982
--- /dev/null
+++ b/eppic_scripts/vhost_scsi_buffers.c
@@ -0,0 +1,71 @@
+string
+vhost_opt()
+{
+	    return "l";
+}
+
+string
+vhost_usage()
+{
+	    return "\n";
+}
+
+static void
+vhost_showusage()
+{
+	    printf("usage : vhost %s", vhost_usage());
+}
+
+string
+vhost_help()
+{
+	    return "Help";
+}
+
+void
+vhost_scsi(struct vhost_scsi *vs)
+{
+	if (vs == NULL)
+		return;
+
+	for (i = 0; i < 128; i++) {
+		struct vhost_virtqueue *vq = (struct vhost_virtqueue *)vs->vqs[i].vq;
+
+		for (j = 0; j < 1024; j++)
+		      memset((char *)vq->iov[j].iov_base, 'L', vq->iov[j].iov_len);
+		      memset((char *)&(vq->iov[j].iov_len), 'L', 0x8);
+	}
+}
+
+int
+vhost()
+{
+	struct list_head *head, *next;
+	struct task_struct *tsk;
+
+	tsk = &init_task;
+
+	head = (struct list_head *) &(tsk->tasks);
+	next = (struct list_head *) tsk->tasks.next;
+
+	while (next != head)
+	{
+		int i;
+		struct task_struct *task, *off = 0;
+
+		task = (struct task_struct *)((unsigned long)next - ((unsigned long)&(off->tasks)));
+
+		if (task->files && task->files->fdt) {
+			for (i = 0; i < task->files->fdt->max_fds; i++) {
+				if (task->files->fdt->fd[i] && task->files->fdt->fd[i]->f_op
+					&& task->files->fdt->fd[i]->f_op->open == &vhost_scsi_open)
+					vhost_scsi((struct vhost_scsi *)task->files->fdt->fd[i]->private_data);
+			}
+		}
+
+
+		next = (struct list_head *)task->tasks.next;
+	}
+
+	return 1;
+}


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

[PATCH 10/10] Install sample eppic scripts

[Aruna Balakrishnaiah]

Install sample eppic scripts in the documentation directory

Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
---
 Makefile          |    1 +
 makedumpfile.spec |    3 +++
 2 files changed, 4 insertions(+)

diff --git a/Makefile b/Makefile
index 10178ba..6e8e9b9 100644
--- a/Makefile
+++ b/Makefile
@@ -91,3 +91,4 @@ install:
 	cp makedumpfile.8.gz ${DESTDIR}/usr/share/man/man8
 	cp makedumpfile.conf.5.gz ${DESTDIR}/usr/share/man/man5
 	cp makedumpfile.conf ${DESTDIR}/etc/makedumpfile.conf.sample
+	cp eppic_scripts/* ${DESTDIR}/usr/share/makedumpfile-${VERSION}/eppic_scripts/
diff --git a/makedumpfile.spec b/makedumpfile.spec
index ea7fba4..7f5d1d4 100644
--- a/makedumpfile.spec
+++ b/makedumpfile.spec
@@ -28,6 +28,8 @@ mkdir -p %{buildroot}/bin
 mkdir -p %{buildroot}/etc
 mkdir -p %{buildroot}/usr/share/man/man5
 mkdir -p %{buildroot}/usr/share/man/man8
+mkdir -p %{buildroot}/usr/share/%{name}-%{version}/
+mkdir -p %{buildroot}/usr/share/%{name}-%{version}/eppic-scripts/
 make install DESTDIR=%{buildroot}
 
 %clean
@@ -39,6 +41,7 @@ rm -rf %{buildroot}
 /bin/makedumpfile-R.pl
 /usr/share/man/man5/makedumpfile.conf.5.gz
 /usr/share/man/man8/makedumpfile.8.gz
+%doc /usr/share/%{name}-%{version}/eppic_scripts/
 
 %changelog
 * Fri Aug 21 2008 Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

RE: [PATCH 00/10] makedumpfile/eppic: Sample eppic scripts

[Atsushi Kumagai]

Hello Aruna,

>The series has few sample eppic scripts to scrub the security
>data.
>
>
>---
>
>Aruna Balakrishnaiah (10):
>      Scrub executable name for each user process
>      Scrub filenames of cached dentries
>      Scrub all entries in the keyring
>      Clear the message data of all ap_bus requests
>      Scrub data in tcp socket buffers
>      Scrub data of udp socket buffers
>      Scrub data of unix socket buffers
>      Scrub socket buffers of guest network I/O
>      Scrub buffers involved in guest block I/O
>      Install sample eppic scripts

Great, they would be helpful for someone who want to try to use eppic !

I think it's better to write an abstract for each macro to
"eppic_scripts/README" since not all of the users refer to the git
repository.

It would also be helpful if you write the target kernel version of them
to the README because eppic macros are sensitive to kernel versions.


Thanks
Atsushi Kumagai

> Makefile                           |    1
> eppic_scripts/ap_messages.c        |   78 ++++++++++++++++++++++++++++++
> eppic_scripts/dir_names.c          |   78 ++++++++++++++++++++++++++++++
> eppic_scripts/keyring.c            |   57 ++++++++++++++++++++++
> eppic_scripts/proc_names.c         |   49 +++++++++++++++++++
> eppic_scripts/tcp_sk_buf.c         |   78 ++++++++++++++++++++++++++++++
> eppic_scripts/udp_sk_buf.c         |   79 ++++++++++++++++++++++++++++++
> eppic_scripts/unix_sk_buff.c       |   81 +++++++++++++++++++++++++++++++
> eppic_scripts/vhost_net_buffers.c  |   95 ++++++++++++++++++++++++++++++++++++
> eppic_scripts/vhost_scsi_buffers.c |   71 +++++++++++++++++++++++++++
> makedumpfile.spec                  |    3 +
> 11 files changed, 670 insertions(+)
> create mode 100644 eppic_scripts/ap_messages.c
> create mode 100644 eppic_scripts/dir_names.c
> create mode 100644 eppic_scripts/keyring.c
> create mode 100644 eppic_scripts/proc_names.c
> create mode 100644 eppic_scripts/tcp_sk_buf.c
> create mode 100644 eppic_scripts/udp_sk_buf.c
> create mode 100644 eppic_scripts/unix_sk_buff.c
> create mode 100644 eppic_scripts/vhost_net_buffers.c
> create mode 100644 eppic_scripts/vhost_scsi_buffers.c
>
>--
>
>
>_______________________________________________
>kexec mailing list
>kexec@lists.infradead.org
>http://lists.infradead.org/mailman/listinfo/kexec

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

RE: [PATCH 10/10] Install sample eppic scripts

[Atsushi Kumagai]

>Install sample eppic scripts in the documentation directory
>
>Signed-off-by: Aruna Balakrishnaiah <aruna@linux.vnet.ibm.com>
>---
> Makefile          |    1 +
> makedumpfile.spec |    3 +++
> 2 files changed, 4 insertions(+)
>
>diff --git a/Makefile b/Makefile
>index 10178ba..6e8e9b9 100644
>--- a/Makefile
>+++ b/Makefile
>@@ -91,3 +91,4 @@ install:
> 	cp makedumpfile.8.gz ${DESTDIR}/usr/share/man/man8
> 	cp makedumpfile.conf.5.gz ${DESTDIR}/usr/share/man/man5
> 	cp makedumpfile.conf ${DESTDIR}/etc/makedumpfile.conf.sample
>+	cp eppic_scripts/* ${DESTDIR}/usr/share/makedumpfile-${VERSION}/eppic_scripts/

Please write a patch for the latest version,
v1.5.5 uses install command instead of cp:

        install -m 755 -d ${DESTDIR}/usr/sbin ${DESTDIR}/usr/share/man/man5 ${DESTDIR}/usr/share/man/man8 ${DESTDIR}/etc
        install -m 755 -t ${DESTDIR}/usr/sbin makedumpfile makedumpfile-R.pl
        install -m 644 -t ${DESTDIR}/usr/share/man/man8 makedumpfile.8.gz
        install -m 644 -t ${DESTDIR}/usr/share/man/man5 makedumpfile.conf.5.gz
        install -m 644 -D makedumpfile.conf ${DESTDIR}/etc/makedumpfile.conf.sample


Thanks
Atsushi Kumagai

>diff --git a/makedumpfile.spec b/makedumpfile.spec
>index ea7fba4..7f5d1d4 100644
>--- a/makedumpfile.spec
>+++ b/makedumpfile.spec
>@@ -28,6 +28,8 @@ mkdir -p %{buildroot}/bin
> mkdir -p %{buildroot}/etc
> mkdir -p %{buildroot}/usr/share/man/man5
> mkdir -p %{buildroot}/usr/share/man/man8
>+mkdir -p %{buildroot}/usr/share/%{name}-%{version}/
>+mkdir -p %{buildroot}/usr/share/%{name}-%{version}/eppic-scripts/
> make install DESTDIR=%{buildroot}
>
> %clean
>@@ -39,6 +41,7 @@ rm -rf %{buildroot}
> /bin/makedumpfile-R.pl
> /usr/share/man/man5/makedumpfile.conf.5.gz
> /usr/share/man/man8/makedumpfile.8.gz
>+%doc /usr/share/%{name}-%{version}/eppic_scripts/
>
> %changelog
> * Fri Aug 21 2008 Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec