martedì 23 febbraio 2016

Magig SysRq

Magic SysRq key

The magic SysRq key is a key combination in the Linux kernel which allows the user to perform various low level commands regardless of the system's state using the SysRq key. It is often used to recover from freezes, or to reboot a computer without corrupting the filesystem.[1]
Much like Sun Microsystems's Open Firmware (OpenBoot), this key combination provides access to powerful tools for software development and disaster recovery. In this sense, it can be considered a form of escape sequence. Principal among the offered commands are means to forcibly unmount file systems, kill processes, recover keyboard state, and write unwritten data to disk. With respect to these tasks, this feature serves as a tool of last resort.

Magic commands

The key combination consists of Alt, SysRq and another key, which controls the command issued (as shown in the table below). Users with a keyboard layout other than QWERTY have to remember that their layout becomes. 



To be able to use this functionality the CONFIG_MAGIC_SYSRQ option has to be enabled at kernel compile time.


The Purpose


Action

QWERTY

Dvorak

AZERTY

Set the console log level, which controls the types of kernel messages that are output to the console
0 through 9
0
through
9
0 through 9

(without using shift)

Immediately reboot the system, without unmounting partitions 

or syncing
b
x
b
Reboot kexec and output a crashdump
c
j
c
Display all currently held Locks
d
e
d
Send the SIGTERM signal to all processes except init (PID 1)
e
.
e
Call oom_kill, which kills a process to alleviate an OOM condition
f
u
f
When using Kernel Mode Setting, provides emergency support for switching back to the kernel's framebuffer console
g
i
g
Output a terse help document to the console
Any key which is not bound to a command should also do the trick
h
d
h
Send the SIGKILL signal to all processes except init
i
c
i
Kill all processes on the current virtual console (Can be used to kill X and svgalib programs, see below)
This was originally designed to imitate a Secure Access Key
k
t
k
Show a stack backtrace of all currently executing tasks
l
n
l
Output current memory information to the console
m
m
,

QWERTY when they use one of these combinations. For example, on a Dvorak keyboard, the key below '9' and '0' counts as a 'o', not as an 'r', so it shuts the system down instead of switching the keyboard to raw mode. Furthermore, some keyboards may not provide a separate SysRq key. In this case, a separate "Print" key should be present. The AltGr key, if present, can be used in place of Alt key in order to avoid alternative uses of these combinations such as Screenshot for Alt+SysRq+s under Gnome. It also can be accessed from the serial console.



Reset the nice level of all high-priority and real-time tasks
n
b
n
Shut off the system
o
r
o
Output the current registers and flags to the console
p
l
p
Display all active high-resolution timers and clock sources.
q
'
a
Switch the keyboard from raw mode, the mode used by programs such as X11 and svgalib, to XLATE mode
r
p
r
Sync all mounted filesystems
s
o
s
Output a list of current tasks and their information to the console
t
y
t
Remount all mounted filesystems in read-only mode
u
g
u
Output Voyager SMP processor information
v
k
v
Display list of blocked (D state) tasks
w
,
z

Common usage


While this was originally implemented as part of the kernel's keyboard handler for debugging, the functionality has been also exposed via the proc filesystem and is commonly used to provide extended management capabilities to headless and remote systems. As an example, shell script can be simply used:


Command line access and configuration




echo b > /proc/sysrq-trigger


This is equivalent to the key combination Alt + SysRq + B which reboots the machine.

The feature is controlled both by a compile-time option in the kernel configuration, CONFIG_MAGIC_SYSRQ, and a sysctl kernel parameter, kernel.sysrq. This can be accessed through the proc filesystem as well, e.g.:


echo 1 > /proc/sys/kernel/sysrq


Some Linux distributions come with the magic sysrq disabled as a security
measure, considered by some to be misguided. You'll see in /etc/sysctl.conf

kernel.sysrq = 0
Change this to
kernel.sysrq = 1
and run
sysctl -p

You should always check for this on a new Linux system before running into a freeze that makes you wish magic sysrq was working.


Remote access


The linux daemon sysrqd (http://julien.danjou.info/sysrqd/) provides a method of accessing SysRq features over TCP/IP port 4094 after authenticating with a plain-text password.


Graphical programs


When magic SysRq keys are used to kill a frozen graphical program, the program has no chance to restore text mode. This can make everything unreadable. The commands textmode (part of SVGAlib) and reset can restore text mode and make the console readable again.

In hypervisors
The Xen hypervisor has functionality to send magic commands to hosted domains via its "xm" command.

"Raising Elephants" mnemonic device


A common idiom to perform a safe reboot of a Linux computer which has otherwise locked up, the QWERTY (or AZERTY) mnemonic "Raising Elephants Is So Utterly Boring", "Reboot Even If System Utterly Broken" or simply remembering the word "BUSIER" backwards, is often useful. It stands for:
unRaw tErminate kIll
(send SIGTERM to all processes, allowing them to terminate gracefully), (send SIGKILL to all processes, forcing them to terminate immediately), (flush data to disk),
(remount all filesystems read-only),


Sync

Unmount reBoot.
(take control of keyboard back from X),


This can prevent a fsck being required on reboot and gives some programs a chance to save emergency backups of unsaved work.
Security concerns
Some people view this key as giving access to dangerous system-level commands to anyone who has physical access to the keyboard or serial console.[6] It has been argued that this perceived security is illusory, as anyone with physical access to the computer would already have the capability to compromise its security.[7] The advent of the procfs interface has rekindled debate over this subject.


Another common version of this mnemonic device is "Raising Skinny Elephants Is Utterly Boring", which performs the same task, but in an alternate order. There is debate regarding whether the Sync command should come earlier or later.

Wait a few seconds between each command. For example, many applications will do an emergency save on receiving SIGTERM, but if SIGKILL is sent too soon, the application will not have time. Likewise, the Sync and Unmount processes need a few seconds before the system is rebooted.



Nessun commento:

Posta un commento