{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft nab\u00eddl syst\u00e9m spr\u00e1vy p\u0159\u00edstupu IPE pro j\u00e1dro Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost navrhla k diskusi v mailing listu v\u00fdvoj\u00e1\u0159\u016f j\u00e1dra Linux k\u00f3d LSM modulu s implementac\u00ed mechanismu IPE (Integrity Policy Enforcement), kter\u00fd roz\u0161i\u0159uje st\u00e1vaj\u00edc\u00ed syst\u00e9my mand\u00e1tov\u00e9ho \u0159\u00edzen\u00ed p\u0159\u00edstupu. M\u00edsto v\u00e1z\u00e1n\u00ed na zna\u010dky a cesty se rozhodnut\u00ed o povolen\u00ed nebo z\u00e1kazu operace d\u011bl\u00e1 na z\u00e1klad\u011b trval\u00fdch vlastnost\u00ed syst\u00e9mov\u00e9 komponenty, se kterou se operace prov\u00e1d\u00ed. Modul umo\u017e\u0148uje stanovit celkovou politiku zaji\u0161t\u011bn\u00ed integrity pro cel\u00fd syst\u00e9m, kter\u00e1 ur\u010duje, jak\u00e9 operace jsou p\u0159\u00edpustn\u00e9 a jak\u00fdm zp\u016fsobem by m\u011bla b\u00fdt ov\u011b\u0159ena autentickost komponent\u016f. <\/p>\n

IPE je zam\u011b\u0159eno na vytvo\u0159en\u00ed pln\u011b verificovateln\u00fdch syst\u00e9m\u016f, jejich\u017e integrita je potvrzena od po\u010d\u00e1te\u010dn\u00edho zav\u00e1d\u011b\u010de a j\u00e1dra a\u017e po koncov\u00e9 spustiteln\u00e9 soubory, konfigurace a na\u010d\u00edtan\u00e9 soubory. Nap\u0159\u00edklad pomoc\u00ed IPE lze ur\u010dit, kter\u00e9 spustiteln\u00e9 soubory lze spou\u0161t\u011bt s ohledem na jejich shodu s referen\u010dn\u00ed verz\u00ed pomoc\u00ed kryptografick\u00fdch hash\u016f poskytovan\u00fdch syst\u00e9mem dm-verity. V p\u0159\u00edpad\u011b zm\u011bny nebo podvr\u017een\u00ed souboru m\u016f\u017ee IPE blokovat operaci nebo zaznamenat fakt poru\u0161en\u00ed integrity. <\/p>\n

Navrhovan\u00fd mechanismus m\u016f\u017ee b\u00fdt aplikov\u00e1n v ovlada\u010d\u00edch pro vestav\u011bn\u00e1 za\u0159\u00edzen\u00ed, kde je ve\u0161ker\u00fd software a nastaven\u00ed speci\u00e1ln\u011b sestaveno a poskytov\u00e1no vlastn\u00edkem, nap\u0159\u00edklad v datov\u00fdch centrech Microsoftu se IPE pou\u017e\u00edv\u00e1 v za\u0159\u00edzen\u00ed pro firewall. Oproti jin\u00fdm syst\u00e9m\u016fm pro kontrolu integrity, jako je IMA, se IPE vyzna\u010duje nez\u00e1vislost\u00ed na metadatech v FS \u2014 v\u0161echny vlastnosti, kter\u00e9 ur\u010duj\u00ed p\u0159\u00edpustnost operac\u00ed, jsou ulo\u017eeny p\u0159\u00edmo v j\u00e1d\u0159e. <\/p>\n

Pravidla jsou ur\u010dena v textov\u00e9 form\u011b pomoc\u00ed sad kl\u00ed\u010d-hodnota. Z\u00e1kladn\u00edmi jsou kl\u00ed\u010d \u201eop\u201c, kter\u00fd ur\u010duje operaci, na kterou se pravidlo vztahuje (nap\u0159\u00edklad, op=EXECUTE se aktivuje p\u0159i pokusu o proveden\u00ed), a \u201eaction\u201c, kter\u00fd ur\u010duje akci (nap\u0159\u00edklad \u201eaction=DENY\u201c pro blokaci). Pravidla jsou spojena s vlastnostmi, kter\u00e9 poskytuj\u00ed extern\u00ed subsyst\u00e9my, jako jsou dm-verity a fs-verity. <\/p>\n

Nap\u0159\u00edklad, pravidla op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY povol\u00ed pouze zav\u00e1d\u011bn\u00ed z verifikovan\u00e9 \u010d\u00e1sti, zak\u00e1\u017ee spu\u0161t\u011bn\u00ed soubor\u016f z \u010d\u00e1st\u00ed, kter\u00e9 nemaj\u00ed podpisy v dm-verity, a tak\u00e9 selektivn\u011b zak\u00e1\u017ee proveden\u00ed souboru s hash \u201e401fce\u20260dec146938\u201c. <\/p>\n

Po\u010d\u00e1te\u010dn\u00ed sada zav\u00e1d\u011bc\u00edch pravidel je ur\u010dena pomoc\u00ed nastaven\u00ed SECURITY_IPE_BOOT_POLICY a je sou\u010d\u00e1st\u00ed sestavy j\u00e1dra, zat\u00edmco dal\u0161\u00ed pravidla se p\u0159id\u00e1vaj\u00ed podle pot\u0159eby p\u0159es soubor \/sys\/kernel\/security\/ipe\/new_policy. P\u0159ed\u00e1van\u00e1 pravidla jsou \u0161ifrov\u00e1na pomoc\u00ed certifik\u00e1tu definovan\u00e9ho v SYSTEM_TRUSTED_KEYRING. <\/p>\n

Na syst\u00e9mech pro v\u0161eobecn\u00e9 pou\u017eit\u00ed se doporu\u010duje pou\u017e\u00edvat IPE v kombinaci se syst\u00e9mem DIGLIM, kter\u00fd vyvinula spole\u010dnost Huawei. DIGLIM je realizov\u00e1n pomoc\u00ed eBPF a umo\u017e\u0148uje snadno implementovat kontrolu integrity na \u00farovni jednotliv\u00fdch soubor\u016f v b\u011b\u017en\u00fdch distribuc\u00edch, ani\u017e by bylo nutn\u00e9 je p\u0159ed\u011blat (je prezentov\u00e1n jako varianta Secure Boot, funguj\u00edc\u00ed na aplika\u010dn\u00ed \u00farovni). Podstatou DIGLIM je udr\u017eov\u00e1n\u00ed souboru kontroln\u00edch hash\u016f pro soubory a metadata a poskytov\u00e1n\u00ed p\u0159\u00edstupu k vykonateln\u00fdm soubor\u016fm pouze tehdy, pokud jeho hash je v tomto souboru. Seznam hash\u016f m\u016f\u017ee b\u00fdt z\u00edsk\u00e1n od spr\u00e1vce bal\u00ed\u010dk\u016f RPM nebo ru\u010dn\u011b vygenerov\u00e1n u\u017eivatelem.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043c\u0435\u0442\u043a\u0430\u043c \u0438 \u043f\u0443\u0442\u044f\u043c \u0432 IPE \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438\u043b\u0438 \u0437\u0430\u043f\u0440\u0435\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f. \u041c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u0431\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113980","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft navrhl syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu IPE pro j\u00e1dro Linux | ProHoster","description":"Spole\u010dnost zve\u0159ejnila k\u00f3d modulu LSM, kter\u00fd implementuje mechanismus IPE (Integrity Policy Enforcement), kter\u00fd roz\u0161i\u0159uje st\u00e1vaj\u00edc\u00ed syst\u00e9my mandatorn\u00edho \u0159\u00edzen\u00ed p\u0159\u00edstupu, na diskusn\u00edch listech v\u00fdvoj\u00e1\u0159\u016f j\u00e1dra Linux.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IPE \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-29T16:25:59+00:00","article:modified_time":"2024-02-29T16:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/113980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=113980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/113980\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=113980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=113980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=113980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}