From nobody Tue Jun 16 05:24:40 2026 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BFA9394470 for ; Thu, 16 Apr 2026 13:14:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776345269; cv=none; b=Vir0dHDGFW4WaNK36nEHXQ6xPwAKlQS9qkrKaa4VLoMhSGxjMOcKPLGLVdOiuIrEQ4AMZfDmOypGkTLvWG/wL4SRywmE7PdmV41dhh8SOLRgB7cjNIb8LxeT/iYlx9nq9B1cpAvt06EWyYnxqsNE9e29wAFG0AkeII41tXMdjB0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776345269; c=relaxed/simple; bh=5AJsOgYaQnITGNqOqit9HwSaFnKSSLcZyF7ZFqvmlgs=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=f96y6lIL/K1gL8jZfbfNcwa97Bpxgcwx5sjrpMcA7rvv3KrdfrBfyfJnbAS93HnclrLpHiHroMHkmucwS+FipuOVIC5rUgP4qk9hdnXr7jcmLPjU21yW6Jv2+PqArdAVfFIqnbj5T89DODOiOfxKXVY0pvURTrE7ouiEJPJWvUc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oFuaiIlC; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oFuaiIlC" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c79467f128cso1578635a12.3 for ; Thu, 16 Apr 2026 06:14:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776345268; x=1776950068; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=xrdHztCp3KFh57kUoKZvj6n8RP0Ytj76L6PrWda2Ixw=; b=oFuaiIlC05RZkgswANAiQzSRxne9NaW/x2hH0687bHlRg8I5xNwNIH9l/DTq1jg2QP HOvZ50ZgVMKjwmi2UJyvoZFLDWODrPvqlXPeZN1xqgvrv3K56OOVXEpCig+peVlJQ1E0 K6wnRX/9pjTFiddLzsNlt7ZW3JIybfv3HxsRReO/ly35g1IpazkfwRrxyWqs3ZKN8gxW 36MMU6VClQYlHap/vvNa63tOKD9mUiXl2lFI4S4kOqgN5rYzImKxhOpmG6+xNsLvg06L 0NBFwaVfHYprrHx+SUmzpRK6ULQNDoHYr7+6vachlAmeBHlS9Z6PjJ9kNEA7VisZDMo6 gQWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776345268; x=1776950068; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xrdHztCp3KFh57kUoKZvj6n8RP0Ytj76L6PrWda2Ixw=; b=hmaGX8z9rg6eAVvZwlyzupoFp9pdJxi4+pLDhrwhKpOAW7V7NggowoWbDpUygArC0v z2U0n+JRHfOK9reQLR6Lgst0mg7oRJF63hN+WJDrsgl7vcILGAsN+pu6ucg/1rCwnFBN UrsTBYKqTOxWHZg6a6k5w+4eoLluSecRHYol37sVGns4AxDv8SaKxgWZnPPhBY4sNW1E qZjwuVn05OgjqsekgFOZ8zzytiSG2UinX5kzB2AbJ8qvrq1Kiq6uHfhJI2PNcJA6bVOP rk1f0Y4agCdRWUL6alrhW/k+YQ2m0PL+WpCM1na3qjO38obh0ePgdLap+KOkGgjziiSI T83A== X-Forwarded-Encrypted: i=1; AFNElJ87KzwpGPbfgGQoD3Dcg7YxfwhQ44yVn1LPKWuxRgDGkZu+oZL3K4swdMYbeoihvHz4IP1nVwS5QCcjFO0=@vger.kernel.org X-Gm-Message-State: AOJu0YyPt0nJzEpy33lOjYSx+LZTDE9hp9ckPn7JsgFmYvuSBlTMyMTm gEk9+w1sCxIYtqgWMTRPuNGqZFkslIjjLWTjJPaqBcfiAqFcn9PCk1MA X-Gm-Gg: AeBDieua9cRt8CWQhExaWcOOgyLWCCk3BZFrFGcf4FILfezTq0osd/3CYNeTiaOyHTw Mc6Jt3lL6B1lu6aGu/wyxgc6NzTFYgK8WaPCcQ0LP1kbCa0IkoUQc5kRwCtUBLavZumskQHcJXM Za/Kw7okWsxWmlwEP9JedFt7PjZrvHG3v9wrVCUBDqvc8dvQO5e7VEcsiD6xoD8lXyp5zp36NEg iRaReSgyijJOrrBCN2O91zZfgL8CGTSfzcRvrZc6cCWvBHaUyDgXRfkNhnB0xtxoqGcaTQdqqJr Rr7X6ALCEv1Vuk1b+z1EEDeT65p5KblEnLOFH1clcDWpop/ayEvUO2U+yWsKGPr6eEK8lMUWl4r 7PmpClbGmPfs6WCVSXTTuV4aASPa5ax8GbVi6vLvmRFwo1QHx88g7INm9dyHsLJ1gcHvTjBrCHH Zw9pRT1vyWcU8Gr516mRhp8GqB8gUnT9D+ X-Received: by 2002:a17:90b:2689:b0:35f:b953:244c with SMTP id 98e67ed59e1d1-35fb953263bmr15728963a91.0.1776345267649; Thu, 16 Apr 2026 06:14:27 -0700 (PDT) Received: from xiao.mioffice.cn ([43.224.245.230]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36132cd52c3sm2483648a91.10.2026.04.16.06.14.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 06:14:26 -0700 (PDT) From: Xiang Gao To: gregkh@linuxfoundation.org, jirislaby@kernel.org Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Xiang Gao Subject: [PATCH] sysrq: add optional logging of caller info on /proc/sysrq-trigger write Date: Thu, 16 Apr 2026 21:14:19 +0800 Message-Id: <20260416131419.1231012-1-gxxa03070307@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xiang Gao When /proc/sysrq-trigger is written to, there is no record of which process triggered the sysrq operation. This makes it difficult to audit or debug who initiated a sysrq action, especially when the write comes from a shell spawned by system()/popen() where the immediate caller is "sh" rather than the originating application. Add CONFIG_MAGIC_SYSRQ_TRIGGER_LOG (default n) and a runtime toggle via module parameter sysrq.trigger_log (default off). When both are enabled, the kernel logs the triggering process's comm, pid, tgid, uid, and walks up to 5 levels of the parent process chain. This allows tracing the original initiator even through system()/popen()/fork+exec indirection. Example output: sysrq: proc trigger: comm=3Dsh pid=3D68 tgid=3D68 uid=3D0 sysrq: parent[0]: comm=3Dmy_app pid=3D67 tgid=3D67 sysrq: parent[1]: comm=3Dinit pid=3D1 tgid=3D1 Usage: # Compile-time: enable CONFIG_MAGIC_SYSRQ_TRIGGER_LOG=3Dy # Runtime: echo 1 > /sys/module/sysrq/parameters/trigger_log # Or boot parameter: sysrq.trigger_log=3D1 Signed-off-by: Xiang Gao --- drivers/tty/sysrq.c | 29 +++++++++++++++++++++++++++++ lib/Kconfig.debug | 16 ++++++++++++++++ 2 files changed, 45 insertions(+) diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c index c2e4b31b699a..e9277e7de35b 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c @@ -48,6 +48,9 @@ #include #include #include +#ifdef CONFIG_MAGIC_SYSRQ_TRIGGER_LOG +#include +#endif #include #include #include @@ -59,6 +62,12 @@ static int __read_mostly sysrq_enabled =3D CONFIG_MAGIC_SYSRQ_DEFAULT_ENAB= LE; static bool __read_mostly sysrq_always_enabled; =20 +#ifdef CONFIG_MAGIC_SYSRQ_TRIGGER_LOG +static bool sysrq_trigger_log; +module_param_named(trigger_log, sysrq_trigger_log, bool, 0644); +MODULE_PARM_DESC(trigger_log, "Log caller info on /proc/sysrq-trigger writ= e"); +#endif + static bool sysrq_on(void) { return sysrq_enabled || sysrq_always_enabled; @@ -1209,6 +1218,26 @@ static ssize_t write_sysrq_trigger(struct file *file= , const char __user *buf, bool bulk =3D false; size_t i; =20 +#ifdef CONFIG_MAGIC_SYSRQ_TRIGGER_LOG + if (sysrq_trigger_log) { + struct task_struct *task; + int depth =3D 0; + + pr_info("proc trigger: comm=3D%s pid=3D%d tgid=3D%d uid=3D%u\n", + current->comm, current->pid, current->tgid, + from_kuid(&init_user_ns, current_uid())); + + rcu_read_lock(); + task =3D current; + while (task->pid > 1 && depth < 5) { + task =3D rcu_dereference(task->real_parent); + pr_info(" parent[%d]: comm=3D%s pid=3D%d tgid=3D%d\n", + depth++, task->comm, task->pid, task->tgid); + } + rcu_read_unlock(); + } +#endif + for (i =3D 0; i < count; i++) { char c; =20 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index aac60b6cfa4b..46bd361decd0 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -705,6 +705,22 @@ config MAGIC_SYSRQ_SERIAL_SEQUENCE =20 If unsure, leave an empty string and the option will not be enabled. =20 +config MAGIC_SYSRQ_TRIGGER_LOG + bool "Log caller info on /proc/sysrq-trigger write" + depends on MAGIC_SYSRQ + default n + help + If you say Y here, the kernel can log the process name, pid, + tgid, uid and parent process chain when /proc/sysrq-trigger + is written to. This is useful for auditing who triggered a + sysrq operation. + + The logging is controlled at runtime via module parameter + sysrq.trigger_log (default off). Enable it with: + echo 1 > /sys/module/sysrq/parameters/trigger_log + + If unsure, say N. + config DEBUG_FS bool "Debug Filesystem" help --=20 2.34.1