From 608952ff718efae8f1ac331e05ae7a8348c23b74 Mon Sep 17 00:00:00 2001 From: Frederic CORNU Date: Tue, 9 Jan 2018 17:45:49 +0100 Subject: [PATCH] Improve PTI detection In case of a busy or misconfigured server, kernel message buffer loop can be filled with messages broadcasted later than boot time. So dmesg command wont return boot time messages. Grepping /var/log/dmesg fixes it and this log file location semms pretty standard across many common distros --- spectre-meltdown-checker.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spectre-meltdown-checker.sh b/spectre-meltdown-checker.sh index 2a9a874..5eb1226 100755 --- a/spectre-meltdown-checker.sh +++ b/spectre-meltdown-checker.sh @@ -651,8 +651,8 @@ if [ "$opt_live" = 1 ]; then elif [ -e /sys/kernel/debug/x86/pti_enabled ]; then # RedHat Backport creates a dedicated file, see https://access.redhat.com/articles/3311301 kpti_enabled=$(cat /sys/kernel/debug/x86/pti_enabled 2>/dev/null) - elif dmesg | grep -Eq 'Kernel/User page tables isolation: enabled|Kernel page table isolation enabled'; then - # if we can't find the flag, grep in dmesg + elif grep -Eq 'Kernel/User page tables isolation: enabled|Kernel page table isolation enabled' /var/log/dmesg; then + # if we can't find the flag, grep in /var/log/dmesg kpti_enabled=1 else kpti_enabled=0