1. 16 Mar, 2020 2 commits
  2. 05 Jan, 2020 1 commit
  3. 11 Jul, 2019 2 commits
  4. 04 Apr, 2019 2 commits
  5. 12 Jan, 2019 1 commit
    • intrigeri's avatar
      Mount a dedicated tmpfs on /run/initramfs instead of trying to remount /run... · 290620df
      intrigeri authored
      Mount a dedicated tmpfs on /run/initramfs instead of trying to remount /run with the "exec" option (refs: #16097).
      My previous approach, i.e. "let's remount /run with the exec option via a unit
      file started as part of the shutdown procedure", worked just fine for clean
      shutdown. But it does not work for emergency shutdown, i.e. when the boot medium
      is physically removed: for some reason (possibly missing bits in the memlockd
      configuration), this service is not started, and then systemd-shutdown won't
      return to the initramfs because /run/initramfs/shutdown is not executable.
      So let's instead disregard /run and extract the initramfs into a dedicated
      tmpfs, that we mount on /run/initramfs (where systemd-shutdown will look for
      it), and that we mount without the "noexec" option.
      Also, remove manual calls to eject(1):
       - They increase chances that the shutdown process breaks due to missing
         files locked in memory by memlockd.
       - Their sole benefit is to ensure we physically eject the DVD. It's unclear if
         this code is still needed nowadays. Regardless, starting with Tails 3.12, the
         only supported use case for ISO and DVD is virtual machines, which are not
         targeted by the emergency shutdown feature, which is about removing the
         *physical* boot medium.
  6. 10 Jan, 2019 1 commit
    • intrigeri's avatar
      Fix memory erasure on shutdown with systemd v239 (refs: #16097). · 634e5a6d
      intrigeri authored
      Remounting /run with the "exec" option in /lib/systemd/system-shutdown/tails
      does not work anymore with systemd v239, while it worked at least until systemd
      v237. I could not find out why by reading systemd's NEWS file.
      So let's instead do this there:
       - For clean shutdown: in a new, dedicated service, started immediately before
         final.target, which itself is a synchronization point that ensures this
         service is started before the transition to systemd-shutdown and in turn to
         the initramfs, where we finish the unmounting and other clean ups needed to
         erase the memory.
       - For emergency shutdown: in the udev watchdog script, before calling the
         unclean shutdown code, which bypasses final.target and thus won't run
         tails-remount-run-exec.service. Too bad we have to duplicate this mount
         command but it seems that both instances will become unnecessary quickly
         enough, once systemd DTRT™. Another way would be to manually start
         tails-remount-run-exec.service from the udev watchdog script but I'm
         concerned it will be unreliable when the boot medium has been unplugged.
  7. 25 May, 2017 5 commits
  8. 18 May, 2017 2 commits
    • intrigeri's avatar
      Return to the initramfs (unpacked in /run/initramfs) on shutdown (refs:... · 888ccc5a
      intrigeri authored
      Return to the initramfs (unpacked in /run/initramfs) on shutdown (refs: #12428, #12354, Debian#778849).
      … otherwise the aufs read-write (tmpfs) branch, among possibly other things,
      can't be properly unmounted and its content remains in memory.
       * We have to handle some unmounting ourselves in initramfs-pre-shutdown-hook:
         systemd-shutdown doesn't manage to unmount the aufs read-write
         branch (/oldroot/lib/live/mount/overlay) as it is needed by the
         aufs (/oldroot) filesystem, and reciprocally it cannot unmount /oldroot as it
         is kept busy by /oldroot/lib/live/mount/*. So we disentangle this mess
         ourselves. And we have to manually empty the aufs read-write (tmpfs) branch,
         otherwise for some reason its content remains in memory. This code will of
         course need to be adapted for overlayfs some day.
       * We lock /bin/kill in memory: apparently systemd-exit.service needs it.
       * We remount /run on shutdown *before* dropping caches, just in case dropping
         caches removes what we've locked into memory.
       * We unpack the initramfs to /run/initramfs at *boot* time: sadly, I was not
         able to have it unpacked reliably in udev-watchdog-wrapper when the boot
         medium is ejected, so we'll use a little bit more RAM (instead of locking the
         compressed initramfs into memory, we're storing the uncompressed one there)
         and probably slow down the boot a bit, in order to make emergency shutdown
         robust. Note, however, that we save some of the RAM used by the uncompressed
         initramfs by deleting the worst offenders (kernel modules).
       * For now the whole procedure is quite noisy on the screen: the pre-shutdown
         hook runs under "set -x", doesn't run "clear", and spits out lots of
         debugging information. The goal is to enable users to provide useful
         debugging data if they have problems with emergency shutdown. Once we have
         shipped this code in a few releases and trust it's robust enough, we can
         surely reconsider and polish the UX by making the output less noisy.
       * We use absolute paths in many places to avoid $PATH lookup which might
         fail if the root filesystem is not there anymore.
    • intrigeri's avatar
      Drop kexec-based memory erasure feature (refs: #12354). · e2caab51
      intrigeri authored
      It's not reliable enough and provides poor UX. Linux memory poisoning
      works well enough to get rid of it.
  9. 01 Jun, 2016 1 commit
  10. 09 Dec, 2015 1 commit
  11. 30 Nov, 2015 2 commits
  12. 10 Nov, 2015 1 commit
  13. 07 Mar, 2015 4 commits
  14. 21 Feb, 2015 2 commits
  15. 21 Nov, 2014 2 commits
    • Tails developers's avatar
      Update link in design doc. · 6e6fe580
      Tails developers authored
    • Tails developers's avatar
      Repair emergency shutdown on boot medium removal (Closes: #8098). · f3161bbe
      Tails developers authored
      The GDM unit file has a Restart=always directive, which is good in the general
      case. However, it breaks our emergency shutdown on boot medium removal feature.
      Let's disable it, then.
      Also, the kexec-load initscript normally silently exits unless systemd is
      currently running a reboot job. This is not the case when the emergency shutdown
      has been triggered, so let's remove this check. (And besides, to be able to run
      this check after the boot medium has been removed, we would have to lock way
      more files in memory).
  16. 18 Nov, 2014 2 commits
  17. 13 Nov, 2014 1 commit
  18. 26 Jun, 2014 2 commits
  19. 04 May, 2014 1 commit
  20. 29 Apr, 2011 1 commit
  21. 14 Apr, 2011 1 commit