On Mon, Nov 05, 2012 at 11:44:48AM -0800, Eric W. Biederman wrote: > Vivek Goyal <vgoyal at redhat.com> writes: > > > On Fri, Nov 02, 2012 at 02:32:48PM -0700, Eric W. Biederman wrote: > >> > >> It needs to be checked but /sbin/kexec should not use any functions that > >> trigger nss switch. No user or password or host name lookup should be > >> happening. > > > > I also think that we don't call routines which trigger nss switch but > > be probably can't rely on that as somebody might introduce it in > > future. So we need more robust mechanism to prevent it than just code > > inspection. > > The fact that we shouldn't use those routines is enough to let us > walk down a path where they are not used. Either with a static glibc > linked told to use no nss modules (--enable-static-nss ?), or with > another more restricted libc. I installed glibc-static and built kexec-tools using gcc "-static" option. It built just fine and infact kdump is working with it. Size of new kexec binary is around 1.4MB. Did not get any warning w.r.t nss, so I am assuming we are not calling any relevant functions. I did try building my own libc using --enable-static-nss but it does not seem to have built static versions of libnss*. Will look more into it and try linking kexec with this new glibc and see if that works. Also tried playing with klibc and uclibc a bit but can't get anything going quickly. Thanks Vivek
