Re: [PATCH]: Add Network Sysrq Support

Prarit Bhargava [off-list ref] wrote:

[ cc'd John Haxby, who worked on xt_SYSREQ ]

On 06/21/2011 06:58 PM, David Miller wrote:

quoted

From: Florian Westphal <fw@strlen.de>
Date: Wed, 22 Jun 2011 00:56:45 +0200

quoted

This is one of the reasons why I still think that
xt_SYSREQ would be the better solution, you get all
kinds of filtering features for free.

You could even use crazy things like '-m time' to restrict
sysreq availability to working hours and whatnot.

Agreed.

Using the netfilter xt-SYSRQ code seems to store the entered code and
execute it later after the system has returned to a normal state....
which is much too late to be useful.

The target handler of the kernel part invokes handle_sysrq(),
I don't see any delaying/queueing?

FWIW, the old discussion is in the archives:
search for subject "nf-next: sysrq and condition 20100421" from Jan
Engelhardt, or try
http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/33615/focus=34808

As far as i understand the use case described by John Haxby matches yours.

Patrick McHardy suggested an alternative standalone method involving
encapsulation sockets; perhaps the reasons why this path was not chosen
have changed.

I think that a standalone module (i.e. not requiring netfilter) that
runs the sysreq handling after all netfilter hooks would be optimal,
but I don't see a simple method to implement that.