{"id":29880,"date":"2019-10-31T21:32:27","date_gmt":"2019-10-31T18:32:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\/"},"modified":"2019-10-31T21:32:27","modified_gmt":"2019-10-31T18:32:27","slug":"milliony-binarnikov-spustya-kak-ukreplyalsya-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","title":{"rendered":"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/bf51e5698530d4a6a44ff97f542a2a87.png\" style=\"display:block;margin: 0 auto;\" \/><b>TL;DR<\/b>. V tomto \u010dl\u00e1nku prozkoum\u00e1me bezpe\u010dnostn\u00ed sch\u00e9mata (hardening schemes), kter\u00e1 funguj\u00ed p\u0159\u00edmo z krabice v p\u011bti popul\u00e1rn\u00edch distribuc\u00edch Linuxu. Pro ka\u017edou z nich jsme vzali v\u00fdchoz\u00ed konfiguraci j\u00e1dra, nainstalovali v\u0161echny bal\u00ed\u010dky a analyzovali bezpe\u010dnostn\u00ed sch\u00e9mata ve vno\u0159en\u00fdch bin\u00e1rn\u00edch souborech. Uva\u017eujeme o distribuc\u00edch OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 a 7, a tak\u00e9 Ubuntu 14.04, 12.04 a 18.04 LTS. <\/p>\n<p>V\u00fdsledky potvrzuj\u00ed, \u017ee i z\u00e1kladn\u00ed sch\u00e9mata, jako jsou stack canaries a position-independent code, je\u0161t\u011b nejsou \u0161iroce vyu\u017e\u00edv\u00e1na. Situace je je\u0161t\u011b hor\u0161\u00ed u kompil\u00e1tor\u016f, pokud jde o ochranu proti zranitelnostem, jako je stack clash, kter\u00e9 se dostaly do centra pozornosti v lednu po zve\u0159ejn\u011bn\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">informac\u00ed o zranitelnostech v systemd<\/a><\/noindex>. Ale nen\u00ed v\u0161echno tak beznad\u011bjn\u00e9. Ve v\u00fdznamn\u00e9 \u010d\u00e1sti bin\u00e1rn\u00edch soubor\u016f jsou implementov\u00e1ny z\u00e1kladn\u00ed ochrann\u00e9 metody, a jejich po\u010det roste s ka\u017edou verz\u00ed. <\/p>\n<p>Kontrola uk\u00e1zala, \u017ee nejv\u00edce ochrann\u00fdch metod je implementov\u00e1no v Ubuntu 18.04 na \u00farovni opera\u010dn\u00edho syst\u00e9mu a aplikac\u00ed, n\u00e1sleduje Debian 9. Na druhou stranu, v OpenSUSE 12.4, CentOS 7 a RHEL 7 jsou tak\u00e9 implementov\u00e1na z\u00e1kladn\u00ed ochrann\u00e1 sch\u00e9mata, a ochrana proti stack clash je \u0161iro\u0161e aplikov\u00e1na s mnohem hust\u0161\u00edm souborem bal\u00ed\u010dk\u016f ve v\u00fdchoz\u00edm nastaven\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>\u00davod<\/h1>\n<p>\nZaji\u0161t\u011bn\u00ed vysok\u00e9 kvality softwaru je obt\u00ed\u017en\u00e9. Navzdory obrovsk\u00e9mu mno\u017estv\u00ed pokro\u010dil\u00fdch n\u00e1stroj\u016f pro statickou anal\u00fdzu k\u00f3du a dynamickou anal\u00fdzu za b\u011bhu, jako\u017e i zna\u010dn\u00e9mu pokroku v v\u00fdvoji kompil\u00e1tor\u016f a programovac\u00edch jazyk\u016f, modern\u00ed software st\u00e1le trp\u00ed zranitelnostmi, kter\u00e9 jsou neust\u00e1le zneu\u017e\u00edv\u00e1ny \u00fato\u010dn\u00edky. Situace je je\u0161t\u011b hor\u0161\u00ed v ekosyst\u00e9mech, kter\u00e9 zahrnuj\u00ed zastaral\u00fd k\u00f3d. V takov\u00fdch p\u0159\u00edpadech \u010del\u00edme nejen v\u011b\u010dn\u00e9mu probl\u00e9mu hled\u00e1n\u00ed potenci\u00e1ln\u011b zneu\u017eiteln\u00fdch chyb, ale jsme tak\u00e9 omezeni tvrd\u00fdmi r\u00e1mci zp\u011btn\u00e9 kompatibility, kter\u00e9 \u010dasto vy\u017eaduj\u00ed zachov\u00e1n\u00ed omezen\u00e9ho, a je\u0161t\u011b hor\u0161\u00edho zraniteln\u00e9ho nebo chybov\u00e9ho k\u00f3du.<\/p>\n<p>Zde p\u0159ich\u00e1zej\u00ed na sc\u00e9nu metody ochrany nebo zpevn\u011bn\u00ed softwaru (hardening). N\u011bkter\u00e9 typy chyb nem\u016f\u017eeme zabr\u00e1nit, ale m\u016f\u017eeme zt\u00ed\u017eit \u017eivot \u00fato\u010dn\u00edkovi a \u010d\u00e1ste\u010dn\u011b vy\u0159e\u0161it probl\u00e9m t\u00edm, \u017ee zamez\u00edme nebo zt\u00ed\u017e\u00edme jejich prov\u00e1d\u011bn\u00ed. <i>provozov\u00e1n\u00ed<\/i> t\u011bchto chyb. Tato ochrana se pou\u017e\u00edv\u00e1 ve v\u0161ech modern\u00edch opera\u010dn\u00edch syst\u00e9mech, p\u0159i\u010dem\u017e metody se v\u00fdrazn\u011b li\u0161\u00ed v obt\u00ed\u017enosti, \u00fa\u010dinnosti a v\u00fdkonnosti: od z\u00e1sobn\u00edkov\u00fdch kan\u00e1rk\u016f (stack canaries) a <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Address_space_layout_randomization\">ASLR<\/a><\/noindex> a\u017e po komplexn\u00ed ochrany <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Control-flow_integrity\">CFI<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Return-oriented_programming\">ROP<\/a><\/noindex>. V tomto \u010dl\u00e1nku se pod\u00edv\u00e1me na to, jak\u00e9 metody ochrany se pou\u017e\u00edvaj\u00ed v nejpopul\u00e1rn\u011bj\u0161\u00edch distribuc\u00edch Linuxu v defaultn\u00edm nastaven\u00ed, a tak\u00e9 prozkoum\u00e1me vlastnosti bin\u00e1rn\u00edk\u016f, kter\u00e9 se \u0161\u00ed\u0159\u00ed prost\u0159ednictv\u00edm syst\u00e9m\u016f spr\u00e1vy bal\u00edk\u016f ka\u017ed\u00e9 distribuce.<\/p>\n<h3>CVE a bezpe\u010dnost<\/h3>\n<p>\nV\u0161ichni jsme vid\u011bli \u010dl\u00e1nky s n\u00e1zvy jako \"Nejzraniteln\u011bj\u0161\u00ed aplikace roku\" nebo \"Nejzraniteln\u011bj\u0161\u00ed opera\u010dn\u00ed syst\u00e9my\". Obvykle tam uv\u00e1d\u011bj\u00ed statistiky o celkov\u00e9m po\u010dtu z\u00e1znam\u016f o zranitelnostech typu <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/\">CVE (Common Vulnerability and Exposures)<\/a><\/noindex>, z\u00edskan\u00fdch z <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/\">N\u00e1rodn\u00ed datab\u00e1ze zranitelnosti (NVD)<\/a><\/noindex> od <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nist.gov\/\">NIST<\/a><\/noindex> a dal\u0161\u00edch zdroj\u016f. Pozd\u011bji jsou tyto aplikace nebo opera\u010dn\u00ed syst\u00e9my hodnoceny podle po\u010dtu CVE. Bohu\u017eel, a\u010dkoliv jsou CVE velmi u\u017eite\u010dn\u00e9 pro sledov\u00e1n\u00ed probl\u00e9m\u016f a informov\u00e1n\u00ed dodavatel\u016f a u\u017eivatel\u016f, p\u0159\u00edli\u0161 toho ne\u0159\u00edkaj\u00ed o skute\u010dn\u00e9 bezpe\u010dnosti softwaru.<\/p>\n<p>Pro p\u0159\u00edklad zva\u017eme celkov\u00fd po\u010det CVE za posledn\u00ed \u010dty\u0159i roky pro j\u00e1dro Linux a p\u011bt nejpopul\u00e1rn\u011bj\u0161\u00edch serverov\u00fdch distribuc\u00ed, konkr\u00e9tn\u011b Ubuntu, Debian, Red Hat Enterprise Linux a OpenSUSE.<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/16d74634f010e340aedbce441513e3f8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 1<\/i><\/p>\n<p>Co n\u00e1m \u0159\u00edk\u00e1 tento graf? Znamen\u00e1 v\u011bt\u0161\u00ed po\u010det CVE, \u017ee jedna distribuce je zraniteln\u011bj\u0161\u00ed ne\u017e jin\u00e1? Odpov\u011b\u010f je ne. Nap\u0159\u00edklad v tomto \u010dl\u00e1nku uvid\u00edte, \u017ee v Debianu byla implementov\u00e1na p\u0159\u00edsn\u011bj\u0161\u00ed ochrann\u00e1 opat\u0159en\u00ed ve srovn\u00e1n\u00ed t\u0159eba s OpenSUSE nebo RedHat Linux, a p\u0159esto m\u00e1 Debian v\u00edce CVE. Nebo\u0165 to neznamen\u00e1 oslabov\u00e1n\u00ed bezpe\u010dnosti: ani p\u0159\u00edtomnost CVE neznamen\u00e1, \u017ee zranitelnost <i>je zneu\u017eiteln\u00e1<\/i>. Hlavn\u00ed sk\u00f3re z\u00e1va\u017enosti poskytuje p\u0159edstavu o tom, jak je <i>pravd\u011bpodobn\u00e9<\/i> vyu\u017eit\u00ed zranitelnosti, ale nakonec je zneu\u017eitelnost do zna\u010dn\u00e9 m\u00edry z\u00e1visl\u00e1 na ochran\u011b p\u0159\u00edtomn\u00e9 v posti\u017een\u00fdch syst\u00e9mech a tak\u00e9 na zdroj\u00edch a mo\u017enostech \u00fato\u010dn\u00edk\u016f. Nav\u00edc, absence zpr\u00e1v CVE nic ne\u0159\u00edk\u00e1 o jin\u00fdch <i>nezaregistrovan\u00fdch nebo nezn\u00e1m\u00fdch<\/i> Zranitelnostech. Rozd\u00edl v CVE m\u016f\u017ee b\u00fdt vysv\u011btlen nejen kvalitou softwaru, ale tak\u00e9 dal\u0161\u00edmi faktory, v\u010detn\u011b prost\u0159edk\u016f vy\u010dlen\u011bn\u00fdch na testov\u00e1n\u00ed nebo velikosti u\u017eivatelsk\u00e9 z\u00e1kladny. V na\u0161em p\u0159\u00edkladu m\u016f\u017ee v\u011bt\u0161\u00ed po\u010det CVE u Debianu jednodu\u0161e nazna\u010dovat, \u017ee Debian poskytuje v\u00edce softwarov\u00fdch bal\u00ed\u010dk\u016f. <\/p>\n<p>Samoz\u0159ejm\u011b, syst\u00e9m CVE poskytuje u\u017eite\u010dn\u00e9 informace, kter\u00e9 umo\u017e\u0148uj\u00ed vytv\u00e1\u0159et odpov\u00eddaj\u00edc\u00ed ochrany. \u010c\u00edm l\u00e9pe ch\u00e1peme p\u0159\u00ed\u010diny selh\u00e1n\u00ed programu, t\u00edm snadn\u011bji m\u016f\u017eeme ur\u010dit mo\u017en\u00e9 zp\u016fsoby zneu\u017eit\u00ed a vyvinout odpov\u00eddaj\u00edc\u00ed mechanismy <i>detekce a reakce<\/i>. Na obr. 2 jsou zn\u00e1zorn\u011bny kategorie zranitelnost\u00ed pro v\u0161echny distribuce za posledn\u00ed \u010dty\u0159i roky (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cvedetails.com\/top-50-products.php\">zdroj<\/a><\/noindex>). Je z\u0159ejm\u00e9, \u017ee v\u011bt\u0161ina CVE spad\u00e1 do n\u00e1sleduj\u00edc\u00edch kategori\u00ed: odm\u00edtnut\u00ed slu\u017eby (DoS), vykon\u00e1n\u00ed k\u00f3du, p\u0159ete\u010den\u00ed, po\u0161kozen\u00ed pam\u011bti, \u00fanik (exfiltrace) informac\u00ed a eskalace privilegi\u00ed. A\u010dkoli mnoh\u00e9 CVE jsou zohledn\u011bny n\u011bkolikr\u00e1t v r\u016fzn\u00fdch kategori\u00edch, celkov\u011b se stejn\u00e9 probl\u00e9my udr\u017euj\u00ed rok co rok. V dal\u0161\u00ed \u010d\u00e1sti \u010dl\u00e1nku posoud\u00edme pou\u017eit\u00ed r\u016fzn\u00fdch ochrann\u00fdch sch\u00e9mat k prevenci zneu\u017eit\u00ed uveden\u00fdch zranitelnost\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/45948bc64673540cfb3e1774c3247634.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 2<\/i><\/p>\n<h3>\u00dakoly<\/h3>\n<p>\nV tomto \u010dl\u00e1nku se chyst\u00e1me odpov\u011bd\u011bt na n\u00e1sleduj\u00edc\u00ed ot\u00e1zky:<\/p>\n<ul>\n<li>Jak\u00e1 je bezpe\u010dnost r\u016fzn\u00fdch distribuc\u00ed Linuxu? Jak\u00e9 ochrann\u00e9 mechanismy existuj\u00ed v j\u00e1dru a aplikac\u00edch u\u017eivatelsk\u00e9ho prostoru?\n<\/li>\n<li>Jak se v pr\u016fb\u011bhu \u010dasu zm\u011bnilo p\u0159ijet\u00ed ochrann\u00fdch mechanism\u016f pro r\u016fzn\u00e9 distribuce?\n<\/li>\n<li>Jak\u00e9 jsou pr\u016fm\u011brn\u00e9 z\u00e1vislosti bal\u00ed\u010dk\u016f a knihoven u ka\u017ed\u00e9 distribuce?\n<\/li>\n<li>Jak\u00e9 ochrany jsou implementov\u00e1ny pro ka\u017ed\u00fd bin\u00e1rn\u00ed soubor?<\/li>\n<\/ul>\n<p><\/p>\n<h3>Volba distribuc\u00ed<\/h3>\n<p>\nUkazuje se, \u017ee je obt\u00ed\u017en\u00e9 naj\u00edt p\u0159esnou statistiku o instalac\u00edch distribuc\u00ed, proto\u017ee v mnoha p\u0159\u00edpadech po\u010det sta\u017een\u00ed neodr\u00e1\u017e\u00ed po\u010det skute\u010dn\u00fdch instalac\u00ed. Nicm\u00e9n\u011b varianty Unixu tvo\u0159\u00ed v\u011bt\u0161inu serverov\u00fdch syst\u00e9m\u016f (na webov\u00fdch serverech 69,2 %, podle <noindex><a rel=\"nofollow\" href=\"https:\/\/w3techs.com\/technologies\/overview\/operating_system\/all\">statistik\u00e1ch<\/a><\/noindex> W3techs a dal\u0161\u00edch zdroj\u016f), a jejich pod\u00edl neust\u00e1le roste. Proto jsme se v na\u0161em v\u00fdzkumu zam\u011b\u0159ili na distribuce dostupn\u00e9 p\u0159\u00edmo na platform\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/\">Google Cloud<\/a><\/noindex>. Konkr\u00e9tn\u011b jsme vybrali n\u00e1sleduj\u00edc\u00ed opera\u010dn\u00ed syst\u00e9my:<\/p>\n<p>Distribuce\/verze<br \/>\nJ\u00e1dro<br \/>\nBuild<\/p>\n<p>OpenSUSE 12.4<br \/>\n4.12.14-95.3-default<br \/>\n#1 SMP Wed Dec 5 06:00:48 UTC 2018 (63a8d29)<\/p>\n<p>Debian 9 (stretch)<br \/>\n4.9.0-8-amd64<br \/>\n#1 SMP Debian 4.9.130-2 (2018-10-27)<\/p>\n<p>CentOS 6.10<br \/>\n2.6.32-754.10.1.el6.x86_64<br \/>\n#1 SMP Tue Jan 15 17:07:28 UTC 2019<\/p>\n<p>CentOS 7<br \/>\n3.10.0-957.5.1.el7.x86_64<br \/>\n#1 SMP Fri Feb 1 14:54:57 UTC 2019<\/p>\n<p>Red Hat Enterprise Linux Server 6.10 (Santiago)<br \/>\n2.6.32-754.9.1.el6.x86_64<br \/>\n#1 SMP Wed Nov 21 15:08:21 EST 2018<\/p>\n<p>Red Hat Enterprise Linux Server 7.6 (Maipo)<br \/>\n3.10.0-957.1.3.el7.x86_64<br \/>\n#1 SMP Thu Nov 15 17:36:42 UTC 2018<\/p>\n<p>Ubuntu 14.04 (Trusty Tahr)<br \/>\n4.4.0\u2013140-generic<br \/>\n <br \/>\n#166~14.04.1-Ubuntu SMP Sat Nov 17 01:52:43 UTC 20\u2026<\/p>\n<p>Ubuntu 16.04 (Xenial Xerus)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27~16.04.1-Ubuntu SMP Fri Dec 7 09:59:47 UTC 2018<\/p>\n<p>Ubuntu 18.04 (Bionic Beaver)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27-Ubuntu SMP Thu Dec 6 18:27:01 UTC 2018<\/p>\n<p><i>Tabulka 1<\/i> <\/p>\n<h1>Anal\u00fdza<\/h1>\n<p>\nProzkoum\u00e1me v\u00fdchoz\u00ed konfiguraci j\u00e1dra i vlastnosti bal\u00ed\u010dk\u016f dostupn\u00fdch prost\u0159ednictv\u00edm spr\u00e1vce bal\u00ed\u010dk\u016f ka\u017ed\u00e9 distribuce hned po instalaci. Zva\u017eujeme pouze bal\u00ed\u010dky z v\u00fdchoz\u00edch zrcadel ka\u017ed\u00e9 distribuce, ignorujeme bal\u00ed\u010dky z nestabiln\u00edch repozit\u00e1\u0159\u016f (nap\u0159. zrcadla 'testing' v Debianu) a bal\u00ed\u010dky t\u0159et\u00edch stran (nap\u0159. bal\u00ed\u010dky Nvidia ze standardn\u00edch zrcadel). Nav\u00edc se nezab\u00fdv\u00e1me u\u017eivatelsky kompilovan\u00fdmi j\u00e1dry nebo konfiguracemi s vy\u0161\u0161\u00ed \u00farovn\u00ed zabezpe\u010den\u00ed.<\/p>\n<h3>Anal\u00fdza konfigurace j\u00e1dra<\/h3>\n<p>\nPou\u017eili jsme skript pro anal\u00fdzu zalo\u017een\u00fd na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/a13xp0p0v\/kconfig-hardened-check\">otev\u0159en\u00e9m kontroloru kconfig<\/a><\/noindex>. Zohled\u0148ujeme v\u00fdchoz\u00ed bezpe\u010dnostn\u00ed nastaven\u00ed zmi\u0148ovan\u00fdch distribuc\u00ed a srovn\u00e1v\u00e1me je s seznamem od <noindex><a rel=\"nofollow\" href=\"http:\/\/kernsec.org\/wiki\/index.php\/Kernel_Self_Protection_Project\/Recommended_Settings\">Projektu ochrany j\u00e1dra<\/a><\/noindex> (KSPP). Pro ka\u017ed\u00e9 konfigura\u010dn\u00ed nastaven\u00ed tabulka 2 popisuje po\u017eadovan\u00e9 nastaven\u00ed: tik je za distribuce, kter\u00e9 odpov\u00eddaj\u00ed doporu\u010den\u00edm KSSP (objasn\u011bn\u00ed pojm\u016f viz. <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/kernel-configuration-glossary\/\">zde<\/a><\/noindex>; v budouc\u00edch \u010dl\u00e1nc\u00edch podrobn\u011b popisujeme, jak byly n\u011bkter\u00e9 z t\u011bchto ochrann\u00fdch metod vyvinuty a jak lze syst\u00e9m hacknout v jejich nep\u0159\u00edtomnosti).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/dx\/oh\/o0\/dxoho0z-lifjcybajszqb-aiirq.png\"><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/b1a42826f4afc78a2b25d158100b2ba4.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/2177579e65e4fe6bb320903756a04b9b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nObecn\u011b plat\u00ed, \u017ee nov\u00e1 j\u00e1dra maj\u00ed p\u0159\u00edsn\u011bj\u0161\u00ed v\u00fdchoz\u00ed nastaven\u00ed. Nap\u0159\u00edklad CentOS 6.10 a RHEL 6.10 na j\u00e1d\u0159e 2.6.32 postr\u00e1daj\u00ed v\u011bt\u0161inu kritick\u00fdch funkc\u00ed implementovan\u00fdch v nov\u011bj\u0161\u00edch j\u00e1drech, jako jsou <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Supervisor_Mode_Access_Prevention\">SMAP<\/a><\/noindex>, p\u0159\u00edsn\u00e1 povolen\u00ed RWX, randomizaci adres nebo ochranu copy2usr. Je d\u016fle\u017eit\u00e9 poznamenat, \u017ee mnoh\u00e9 z voliteln\u00fdch konfigurac\u00ed z tabulky chyb\u00ed ve star\u0161\u00edch verz\u00edch j\u00e1dra a v re\u00e1ln\u00e9m pou\u017eit\u00ed nejsou pou\u017eiteln\u00e9 \u2014 v tabulce je to v\u0161ak st\u00e1le uvedeno jako nedostate\u010dn\u00e9 zabezpe\u010den\u00ed. Podobn\u011b, pokud konfigurace v dan\u00e9 verzi chyb\u00ed, ale pro zabezpe\u010den\u00ed by m\u011bla b\u00fdt tato konfigurace zak\u00e1z\u00e1na, pova\u017euje se to za rozumn\u00e9 nastaven\u00ed. <\/p>\n<p>Je\u0161t\u011b jeden aspekt interpretace v\u00fdsledk\u016f: n\u011bkter\u00e9 konfigurace j\u00e1dra, kter\u00e9 zvy\u0161uj\u00ed \u00fato\u010dnou plochu, mohou b\u00fdt z\u00e1rove\u0148 pou\u017eity pro bezpe\u010dnost. Takov\u00e9 p\u0159\u00edklady zahrnuj\u00ed uprobes a kprobes, moduly j\u00e1dra a BPF\/eBPF. Na\u0161e doporu\u010den\u00ed je pou\u017e\u00edt v\u00fd\u0161e uveden\u00e9 mechanismy pro zaji\u0161t\u011bn\u00ed skute\u010dn\u00e9 ochrany, nebo\u0165 jejich pou\u017eit\u00ed nen\u00ed trivi\u00e1ln\u00ed a p\u0159edpokl\u00e1d\u00e1, \u017ee se \u0161kodliv\u00e9 subjekty ji\u017e dostaly do syst\u00e9mu. Ale pokud jsou tyto volby aktivov\u00e1ny, m\u011bl by syst\u00e9mov\u00fd administr\u00e1tor aktivn\u011b monitorovat zneu\u017e\u00edv\u00e1n\u00ed.<\/p>\n<p>Dal\u0161\u00edm zkoum\u00e1n\u00edm z\u00e1pis\u016f v tabulce 2 vid\u00edme, \u017ee modern\u00ed j\u00e1dra nab\u00edz\u00ed n\u011bkolik mo\u017enost\u00ed pro ochranu p\u0159ed zneu\u017eit\u00edm takov\u00fdch zranitelnost\u00ed, jako je \u00fanik informac\u00ed a p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku\/haldy. Pozorujeme v\u0161ak, \u017ee i ty nejnov\u011bj\u0161\u00ed popul\u00e1rn\u00ed distribuce je\u0161t\u011b neimplementovaly slo\u017eit\u011bj\u0161\u00ed ochranu (nap\u0159\u00edklad s patchem <noindex><a rel=\"nofollow\" href=\"https:\/\/grsecurity.net\/\">grsecurity<\/a><\/noindex>) nebo modern\u00ed ochranu proti \u00fatok\u016fm na op\u011btovn\u00e9 pou\u017eit\u00ed k\u00f3du (nap\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.columbia.edu\/~theofilos\/files\/slides\/krx.pdf\">kombinace randomizace se sch\u00e9maty typu R^X pro k\u00f3d<\/a><\/noindex>). Co je je\u0161t\u011b hor\u0161\u00ed, i tyto pokro\u010dilej\u0161\u00ed ochrann\u00e9 prost\u0159edky nechr\u00e1n\u00ed p\u0159ed cel\u00fdm spektrem \u00fatok\u016f. Je tedy pro syst\u00e9mov\u00e9 administr\u00e1tory mimo\u0159\u00e1dn\u011b d\u016fle\u017eit\u00e9 doplnit rozumn\u00e9 konfigurace \u0159e\u0161en\u00edmi, kter\u00e1 nab\u00edzej\u00ed detekci a prevenci exploit\u016f v re\u00e1ln\u00e9m \u010dase.<\/p>\n<h3>Anal\u00fdza aplikac\u00ed<\/h3>\n<p>\nNen\u00ed p\u0159ekvapen\u00edm, \u017ee jednotliv\u00e9 distribuce maj\u00ed r\u016fzn\u00e9 vlastnosti bal\u00ed\u010dk\u016f, mo\u017enosti kompilace, z\u00e1vislosti knihoven atd. Rozd\u00edly existuj\u00ed i mezi <noindex><a rel=\"nofollow\" href=\"https:\/\/upload.wikimedia.org\/wikipedia\/commons\/1\/1b\/Linux_Distribution_Timeline.svg\">p\u0159\u00edbuzn\u00fdmi<\/a><\/noindex> distribucemi a bal\u00ed\u010dky s mal\u00fdm po\u010dtem z\u00e1vislost\u00ed (nap\u0159\u00edklad coreutils v Ubuntu nebo Debianu). Abychom ohodnotili rozd\u00edly, st\u00e1hli jsme v\u0161echny dostupn\u00e9 bal\u00ed\u010dky, extrahovali jejich obsah a analyzovali bin\u00e1rn\u00ed soubory a z\u00e1vislosti. Pro ka\u017ed\u00fd bal\u00ed\u010dek jsme sledovali dal\u0161\u00ed bal\u00ed\u010dky, od kter\u00fdch z\u00e1visel, a pro ka\u017ed\u00fd bin\u00e1rn\u00ed soubor jsme sledovali jeho z\u00e1vislosti. V t\u00e9to \u010d\u00e1sti shrneme na\u0161e z\u00e1v\u011bry.<\/p>\n<h4>Distribuce<\/h4>\n<p>\nCelkov\u011b jsme st\u00e1hli 361\u00a0556 bal\u00ed\u010dk\u016f pro v\u0161echny distribuce, p\u0159i\u010dem\u017e jsme zrcadlo pou\u017e\u00edvali pouze pro v\u00fdchoz\u00ed bal\u00ed\u010dky. Ignorovali jsme bal\u00ed\u010dky bez vykonateln\u00fdch ELF soubor\u016f, jako jsou zdrojov\u00e9 k\u00f3dy, p\u00edsma atd. Po filtrov\u00e1n\u00ed z\u016fstalo 129\u00a0569 bal\u00ed\u010dk\u016f, kter\u00e9 obsahuj\u00ed celkem 584\u00a0457 bin\u00e1rn\u00edch soubor\u016f. Rozd\u011blen\u00ed bal\u00ed\u010dk\u016f a soubor\u016f podle distribuc\u00ed je zn\u00e1zorn\u011bno na obr.\u00a03.<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/a24975fba7413ac8069c07412e5476cc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 3<\/i><\/p>\n<p>Je patrn\u00e9, \u017ee \u010d\u00edm modern\u011bj\u0161\u00ed distribuce, t\u00edm v\u00edce bal\u00ed\u010dk\u016f a bin\u00e1rn\u00edch soubor\u016f obsahuje, co\u017e je logick\u00e9. Bal\u00ed\u010dky Ubuntu a Debian zahrnuj\u00ed tak\u00e9 mnohem v\u00edce bin\u00e1rn\u00edch soubor\u016f (jak vykonateln\u00fdch, tak dynamick\u00fdch modul\u016f a knihoven) ne\u017e CentOS, SUSE a RHEL, co\u017e potenci\u00e1ln\u011b ovliv\u0148uje \u00fato\u010dnou plochu Ubuntu a Debian (je t\u0159eba poznamenat, \u017ee \u010d\u00edsla odr\u00e1\u017eej\u00ed v\u0161echny bin\u00e1rky v\u0161ech verz\u00ed bal\u00ed\u010dku, tedy n\u011bkter\u00e9 soubory jsou analyzov\u00e1ny n\u011bkolikr\u00e1t). To je zvl\u00e1\u0161\u0165 d\u016fle\u017eit\u00e9, pokud vezmeme v \u00favahu z\u00e1vislosti mezi bal\u00ed\u010dky. Zranitelnost v bin\u00e1rn\u00edm souboru jednoho bal\u00ed\u010dku m\u016f\u017ee ovlivnit mnoho \u010d\u00e1st\u00ed ekosyst\u00e9mu, jak m\u016f\u017ee zraniteln\u00e1 knihovna ovlivnit v\u0161echny bin\u00e1rn\u00ed soubory, kter\u00e9 ji importuj\u00ed. Jako v\u00fdchoz\u00ed bod se pod\u00edvejme na rozd\u011blen\u00ed po\u010dtu z\u00e1vislost\u00ed podle bal\u00ed\u010dk\u016f v r\u016fzn\u00fdch opera\u010dn\u00edch syst\u00e9mech:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ii\/e3\/e5\/iie3e5-ei26ezg5yvcyvtzqzl80.png\"><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/c6570e643d92103c87659e61f5d395a6.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Obr. 4<\/i> <\/p>\n<p>V t\u00e9m\u011b\u0159 v\u0161ech distribuc\u00edch m\u00e1 60% bal\u00ed\u010dk\u016f minim\u00e1ln\u011b 10 z\u00e1vislost\u00ed. Krom\u011b toho m\u00e1 n\u011bkolik bal\u00ed\u010dk\u016f v\u00fdrazn\u011b v\u00edce z\u00e1vislost\u00ed (v\u00edce ne\u017e 100). Tot\u00e9\u017e plat\u00ed pro zp\u011btn\u00e9 z\u00e1vislosti bal\u00ed\u010dk\u016f: jak se o\u010dek\u00e1valo, n\u011bkolik bal\u00ed\u010dk\u016f je pou\u017e\u00edv\u00e1no mnoha jin\u00fdmi bal\u00ed\u010dky v distribuci, a proto maj\u00ed zranitelnosti v t\u011bchto n\u011bkolika vybran\u00fdch vysok\u00e9 riziko. Jako p\u0159\u00edklad je v n\u00e1sleduj\u00edc\u00ed tabulce uvedeno 20 bal\u00ed\u010dk\u016f s nejvy\u0161\u0161\u00edm po\u010dtem zp\u011btn\u00fdch z\u00e1vislost\u00ed v SLES, CentOS 7, Debian 9 a Ubuntu 18.04 (v ka\u017ed\u00e9 bu\u0148ce je uveden bal\u00ed\u010dek a po\u010det zp\u011btn\u00fdch z\u00e1vislost\u00ed).<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/0aa544db8be1af7bffe21b6314537e18.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabulka 3<\/i><\/p>\n<p>Zaj\u00edmav\u00fd fakt. I kdy\u017e v\u0161echny analyzovan\u00e9 OS jsou postaveny pro architekturu x86_64 a v\u011bt\u0161ina bal\u00ed\u010dk\u016f je definov\u00e1na jako x86_64 a x86, bal\u00ed\u010dky \u010dasto obsahuj\u00ed bin\u00e1rn\u00ed soubory pro jin\u00e9 architektury, jak je zn\u00e1zorn\u011bno na obr.\u00a05.<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/b40f607e0c2f169bd1df21bd9994de8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 5<\/i><\/p>\n<p>V n\u00e1sleduj\u00edc\u00ed \u010d\u00e1sti se hloub\u011bji zam\u011b\u0159\u00edme na charakteristiky analyzovan\u00fdch bin\u00e1rn\u00edch soubor\u016f.<\/p>\n<h4>Statistika ochrany bin\u00e1rn\u00edch soubor\u016f<\/h4>\n<p>\nJako absolutn\u00ed minimum je t\u0159eba se sezn\u00e1mit se z\u00e1kladn\u00edm souborem mo\u017enost\u00ed ochrany pro existuj\u00edc\u00ed bin\u00e1rn\u00ed soubory. N\u011bkolik distribuc\u00ed Linuxu p\u0159ich\u00e1z\u00ed se skripty, kter\u00e9 tyto kontroly prov\u00e1d\u011bj\u00ed. Nap\u0159\u00edklad v Debianu\/Ubuntu existuje takov\u00fd skript. Zde je p\u0159\u00edklad jeho fungov\u00e1n\u00ed:<\/p>\n<pre><code class=\"bash\">$ hardening-check $(which docker)\n\/usr\/bin\/docker:\n Pozice nez\u00e1visl\u00fd spustiteln\u00fd soubor: ano\n Ochrana z\u00e1sobn\u00edku: ano\n Fortify Source funkce: ne, nalezeny pouze nechr\u00e1n\u011bn\u00e9 funkce!\n P\u0159enosov\u00e9 adresy pouze pro \u010dten\u00ed: ano\n Ihned vazba: ano<\/code><\/pre>\n<p>\nSkript kontroluje p\u011bt <noindex><a rel=\"nofollow\" href=\"http:\/\/manpages.ubuntu.com\/manpages\/trusty\/man1\/hardening-check.1.html\">ochrann\u00fdch funkc\u00ed<\/a><\/noindex>:<\/p>\n<ul>\n<li>Pozice nez\u00e1visl\u00fd spustiteln\u00fd soubor (PIE): ukazuje, zda lze um\u00edstit textovou \u010d\u00e1st programu do pam\u011bti s c\u00edlem dos\u00e1hnout randomizace, pokud je v j\u00e1d\u0159e povoleno ASLR.\n<\/li>\n<li>Ochrana z\u00e1sobn\u00edku: jsou zapnuty z\u00e1sobn\u00edkov\u00e9 kan\u00e1rky na ochranu proti \u00fatok\u016fm zp\u016fsoben\u00fdm p\u0159ete\u010den\u00edm z\u00e1sobn\u00edku.\n<\/li>\n<li>Fortify Source: jsou nebezpe\u010dn\u00e9 funkce (nap\u0159\u00edklad strcpy) nahrazeny jejich bezpe\u010dn\u011bj\u0161\u00edmi alternativami, a u vol\u00e1n\u00ed kontrolovan\u00fdch za b\u011bhu \u2013 jejich neov\u011b\u0159en\u00fdmi alternativami (nap\u0159. memcpy m\u00edsto __memcpy_chk).\n<\/li>\n<li>Relokace pouze pro \u010dten\u00ed (RELRO): jsou z\u00e1znamy tabulky relokac\u00ed ozna\u010deny jako \u201epouze pro \u010dten\u00ed\u201c, pokud jsou aktivov\u00e1ny p\u0159ed v\u00fdpo\u010dtem.\n<\/li>\n<li>Ihned vazba: umo\u017e\u0148uje linkeru runtime prov\u00e9st v\u0161echny relokace p\u0159ed za\u010d\u00e1tkem vykon\u00e1v\u00e1n\u00ed programu (to je ekvivalentn\u00ed pln\u00e9mu RELRO).<\/li>\n<\/ul>\n<p>\nJsou uveden\u00e9 mechanismy dostate\u010dn\u00e9? Bohu\u017eel ne. Existuj\u00ed zn\u00e1m\u00e9 zp\u016fsoby, jak obch\u00e1zet v\u0161echny v\u00fd\u0161e uveden\u00e9 ochrany, ale \u010d\u00edm p\u0159\u00edsn\u011bj\u0161\u00ed je ochrana, t\u00edm vy\u0161\u0161\u00ed je pr\u00e1h pro \u00fato\u010dn\u00edka. Nap\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity15\/sec15-paper-di-frederico.pdf\">metody obch\u00e1zen\u00ed RELRO<\/a><\/noindex> je t\u011b\u017e\u0161\u00ed implementovat, pokud je aktivn\u00ed PIE a ihned vazba. Podobn\u011b pln\u00e9 ASLR vy\u017eaduje dodate\u010dnou pr\u00e1ci pro vytvo\u0159en\u00ed funk\u010dn\u00edho exploit. Nicm\u00e9n\u011b rafinovan\u00ed \u00fato\u010dn\u00edci jsou ji\u017e p\u0159ipraveni tyto ochrany p\u0159ekonat: jejich absence v podstat\u011b urychl\u00ed prolomen\u00ed. Proto je nesm\u00edrn\u011b d\u016fle\u017eit\u00e9, aby byly tyto opat\u0159en\u00ed pova\u017eov\u00e1ny za nezbytn\u00e9. <i>minimum<\/i>. <\/p>\n<p>Cht\u011bli jsme prozkoumat, kolik bin\u00e1rn\u00edch soubor\u016f v posuzovan\u00fdch distribuc\u00edch je chr\u00e1n\u011bno t\u011bmito a dal\u0161\u00edmi t\u0159emi metodami:<\/p>\n<ul>\n<li>Nepou\u017eiteln\u00fd bit (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Executable_space_protection\">NX<\/a><\/noindex>) zabra\u0148uje vykon\u00e1v\u00e1n\u00ed v jak\u00e9koli oblasti, kter\u00e1 nem\u00e1 b\u00fdt vykon\u00e1van\u00e1, nap\u0159\u00edklad na hald\u011b z\u00e1sobn\u00edku atd.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rpath\">RPATH\/RUNPATH<\/a><\/noindex> ozna\u010duje cestu vykon\u00e1v\u00e1n\u00ed, kterou pou\u017e\u00edv\u00e1 dynamick\u00fd na\u010d\u00edta\u010d k nalezen\u00ed odpov\u00eddaj\u00edc\u00edch knihoven. Prvn\u00ed z nich je <i>povinn\u00fd<\/i> pro v\u0161echny modern\u00ed syst\u00e9my: jeho absence umo\u017e\u0148uje \u00fato\u010dn\u00edk\u016fm n\u00e1hodn\u011b zapisovat payload do pam\u011bti a vykon\u00e1vat jej tak, jak je. Co se t\u00fd\u010de druh\u00e9ho, nespr\u00e1vn\u00e9 konfigurace prov\u00e1d\u011bc\u00edch cest pom\u00e1haj\u00ed zav\u00e9st nespolehliv\u00fd k\u00f3d, kter\u00fd m\u016f\u017ee v\u00e9st k \u0159ad\u011b probl\u00e9m\u016f (nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nth-dimension.org.uk\/pub\/BTL.pdf\">eskalace privilegi\u00ed<\/a><\/noindex>, a tak\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.debian.org\/RpathIssue\">dal\u0161\u00ed probl\u00e9my<\/a><\/noindex>).<\/li>\n<li>Ochrana p\u0159ed koliz\u00ed z\u00e1sobn\u00edku zabezpe\u010duje ochranu proti \u00fatok\u016fm, kter\u00e9 nut\u00ed z\u00e1sobn\u00edk p\u0159ekr\u00fdt jin\u00e9 oblasti pam\u011bti (nap\u0159. hromadu). Vzhledem k ned\u00e1vn\u00fdm exploit\u016fm zneu\u017e\u00edvaj\u00edc\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">zranitelnosti kolize hromady v systemd<\/a><\/noindex>, pova\u017eovali jsme za vhodn\u00e9 zahrnout tento mechanismus do na\u0161\u00ed datov\u00e9 sady.<\/li>\n<\/ul>\n<p>\nTak\u017ee bez dal\u0161\u00edch formalit p\u0159ejdeme k \u010d\u00edsl\u016fm. Tabulky 4 a 5 obsahuj\u00ed shrnut\u00ed anal\u00fdzy spustiteln\u00fdch soubor\u016f a knihoven r\u016fzn\u00fdch distribuc\u00ed.<\/p>\n<ul>\n<li>Jak vidno, ochrana NX je implementov\u00e1na v\u0161ude, s v\u00fdjimkou n\u011bkolika m\u00e1lo. Zvl\u00e1\u0161\u0165 lze poznamenat jej\u00ed o n\u011bco ni\u017e\u0161\u00ed pou\u017eit\u00ed v distribuc\u00edch Ubuntu a Debian ve srovn\u00e1n\u00ed s CentOS, RHEL a OpenSUSE.\n<\/li>\n<li>Z\u00e1sobn\u00edkov\u00e9 kan\u00e1rky jsou na mnoha m\u00edstech nedostate\u010dn\u00e9, zejm\u00e9na ve star\u0161\u00edch j\u00e1drech distribuc\u00ed. N\u011bjak\u00fd pokrok je vid\u011bt v posledn\u00edch distribuc\u00edch CentOS, RHEL, Debian a Ubuntu.\n<\/li>\n<li>S v\u00fdjimkou Debianu a Ubuntu 18.04 je v v\u011bt\u0161in\u011b distribuc\u00ed \u0161patn\u00e1 podpora PIE.\n<\/li>\n<li>Ochrana proti koliz\u00edm z\u00e1sobn\u00edku je slab\u011b implementov\u00e1na v OpenSUSE, CentOS 7 a RHEL 7 a prakticky chyb\u00ed v ostatn\u00edch.\n<\/li>\n<li>V\u0161echny distribuce s modern\u00edmi j\u00e1dry maj\u00ed ur\u010ditou podporu RELRO, p\u0159i\u010dem\u017e vedouc\u00ed je Ubuntu 18.04 a na druh\u00e9m m\u00edst\u011b Debian.<\/li>\n<\/ul>\n<p>\nJak ji\u017e bylo zm\u00edn\u011bno, metriky v t\u00e9to tabulce jsou pr\u016fm\u011bry p\u0159es v\u0161echny verze bin\u00e1rn\u00edho souboru. Pokud se zam\u011b\u0159\u00edme pouze na posledn\u00ed verze soubor\u016f, \u010d\u00edsla budou jin\u00e1 (nap\u0159. viz <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">pokrok Debianu s implementac\u00ed PIE<\/a><\/noindex>). Krom\u011b toho v\u011bt\u0161ina distribuc\u00ed obvykle p\u0159i v\u00fdpo\u010dtu statistik kontroluje ochranu pouze n\u011bkolika funkc\u00ed v bin\u00e1rn\u00edm k\u00f3du, zat\u00edmco v na\u0161\u00ed anal\u00fdze je uvedeno skute\u010dn\u00e9 procento zpevnili funkc\u00ed. Proto, pokud je v bin\u00e1rn\u00edm souboru chr\u00e1n\u011bno 5 z 50 funkc\u00ed, uvedeme mu hodnocen\u00ed 0,1, co\u017e odpov\u00edd\u00e1 10% zpevn\u011bn\u00fdch funkc\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/82e881c5ba2a3911f3a0ffae1a3475f4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabulka 4. Vlastnosti ochrany pro spustiteln\u00e9 soubory zobrazen\u00e9 na obr. 3 (implementace odpov\u00eddaj\u00edc\u00edch funkc\u00ed v procentech z celkov\u00e9ho po\u010dtu spustiteln\u00fdch soubor\u016f)<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/57c8e67be7a57341105262c6e956594c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabulka 5. Vlastnosti ochrany pro knihovny zobrazen\u00e9 na obr. 3 (implementace odpov\u00eddaj\u00edc\u00edch funkc\u00ed v procentech z celkov\u00e9ho po\u010dtu knihoven)<\/i><\/p>\n<p>Tak\u017ee pokrok je? Ur\u010dit\u011b je: to je vid\u011bt ze statistik k jednotliv\u00fdm distribuc\u00edm (nap\u0159., <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">Debian<\/a><\/noindex>), a tak\u00e9 z v\u00fd\u0161e uveden\u00fdch tabulek. Jako p\u0159\u00edklad na obr. 6 je zobrazeno zav\u00e1d\u011bn\u00ed ochrann\u00fdch mechanism\u016f ve t\u0159ech po sob\u011b jdouc\u00edch distribuc\u00edch Ubuntu LTS 5 (vynechali jsme statistiku ochrany p\u0159ed p\u0159ete\u010den\u00edm z\u00e1sobn\u00edku). Zaznamen\u00e1v\u00e1me, \u017ee s ka\u017edou verz\u00ed v\u00edce soubor\u016f podporuje z\u00e1sobn\u00edkov\u00e9 kan\u00e1rky a tak\u00e9 se postupn\u011b st\u00e1le v\u00edce bin\u00e1rn\u00edch soubor\u016f dod\u00e1v\u00e1 s plnou ochranou RELRO.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/d1\/ni\/or\/d1niordj1hmiklmg2-w5rsk6dla.png\"><img decoding=\"async\" alt=\"Miliony bin\u00e1rek pot\u00e9. Jak se Linux upevnil\" src=\"\/wp-content\/uploads\/2019\/03\/9130099db6d59106da8f0a0fc760410e.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Obr. 6<\/i><\/p>\n<p>Bohu\u017eel, \u0159ada spustiteln\u00fdch soubor\u016f v r\u016fzn\u00fdch distribuc\u00edch st\u00e1le nem\u00e1 \u017e\u00e1dnou z v\u00fd\u0161e uveden\u00fdch ochran. Nap\u0159\u00edklad u Ubuntu 18.04 lze pozorovat bin\u00e1rn\u00ed soubor ngetty (n\u00e1hrada getty), stejn\u011b jako shell mksh a lksh, interpretr picolisp, bal\u00ed\u010dky nvidia-cuda-toolkit (popul\u00e1rn\u00ed bal\u00ed\u010dek pro aplikace s GPU akcelerac\u00ed, jako jsou frameworky strojov\u00e9ho u\u010den\u00ed) a klibc-utils. Podobn\u011b, bin\u00e1rn\u00ed soubor mandos-client (administra\u010dn\u00ed n\u00e1stroj umo\u017e\u0148uj\u00edc\u00ed automatick\u00e9 restartov\u00e1n\u00ed stroj\u016f s \u0161ifrovan\u00fdmi souborov\u00fdmi syst\u00e9my), stejn\u011b jako rsh-redone-client (nov\u00e1 implementace rsh a rlogin) jsou dod\u00e1v\u00e1ny bez ochrany NX, a\u010dkoliv maj\u00ed opr\u00e1vn\u011bn\u00ed SUID :(. Krom\u011b toho u n\u011bkolika suid-bin\u00e1rn\u00edch soubor\u016f chyb\u00ed z\u00e1kladn\u00ed ochrana, jako nap\u0159\u00edklad z\u00e1sobn\u00edkov\u00e9 kan\u00e1rky (nap\u0159\u00edklad bin\u00e1rn\u00ed soubor Xorg.wrap z bal\u00ed\u010dku Xorg).<\/p>\n<h1>Shrnut\u00ed a z\u00e1v\u011bre\u010dn\u00e1 pozn\u00e1mka<\/h1>\n<p>\nV tomto \u010dl\u00e1nku jsme vyzdvihli n\u011bkolik bezpe\u010dnostn\u00edch vlastnost\u00ed modern\u00edch distribuc\u00ed Linuxu. Anal\u00fdza uk\u00e1zala, \u017ee v posledn\u00ed distribuci Ubuntu LTS (18.04) se pr\u016fm\u011brn\u011b implementuje nejsiln\u011bj\u0161\u00ed ochrana na \u00farovni OS a aplikac\u00ed mezi distribucemi s relativn\u011b nov\u00fdmi j\u00e1dry, jako jsou Ubuntu 14.04, 12.04 a Debian 9. Nicm\u00e9n\u011b zva\u017eovan\u00e9 distribuce CentOS, RHEL a OpenSUSE v na\u0161em datov\u00e9m souboru standardn\u011b dod\u00e1vaj\u00ed hust\u0161\u00ed sadu bal\u00ed\u010dk\u016f, a v posledn\u00edch verz\u00edch (CentOS a RHEL) maj\u00ed vy\u0161\u0161\u00ed procento implementace ochrany proti p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku ve srovn\u00e1n\u00ed se sv\u00fdmi konkurenty na b\u00e1zi Debianu (Debian a Ubuntu). Porovn\u00e1n\u00edm verz\u00ed CentOS a RedHat si v\u0161\u00edm\u00e1me v\u00fdrazn\u00fdch zlep\u0161en\u00ed v zaveden\u00ed z\u00e1sobn\u00edkov\u00fdch kan\u00e1rk\u016f a RELRO z verz\u00ed 6 na 7, ale pr\u016fm\u011brn\u011b m\u00e1 CentOS v\u00edce funkc\u00ed ne\u017e RHEL. Celkov\u011b by v\u0161em distribuc\u00edm m\u011bla b\u00fdt v\u011bnov\u00e1na zvl\u00e1\u0161tn\u00ed pozornost ochran\u011b PIE, kter\u00e1, s v\u00fdjimkou Debianu 9 a Ubuntu 18.04, byla implementov\u00e1na v m\u00e9n\u011b ne\u017e 10 % bin\u00e1rn\u00edch soubor\u016f z na\u0161eho datov\u00e9ho souboru. <\/p>\n<p>Nakonec je t\u0159eba poznamenat: a\u010dkoliv jsme prov\u00e1d\u011bli v\u00fdzkum ru\u010dn\u011b, existuje mnoho bezpe\u010dnostn\u00edch n\u00e1stroj\u016f (nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/cisofy.com\/lynis\/\">Lynis<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nongnu.org\/tiger\/\">Tiger<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hubblestack\/hubble\">Hubble<\/a><\/noindex>), kter\u00e9 prov\u00e1d\u011bj\u00ed anal\u00fdzu a pom\u00e1haj\u00ed se vyhnout nebezpe\u010dn\u00fdm konfigurac\u00edm. Bohu\u017eel ani siln\u00e1 ochrana v rozumn\u00fdch konfigurac\u00edch nezaru\u010duje absenci exploitu. Proto jsme pevn\u011b p\u0159esv\u011bd\u010deni, \u017ee je \u017eivotn\u011b d\u016fle\u017eit\u00e9 zajistit <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">spolehliv\u00fd monitoring a prevenci \u00fatok\u016f v re\u00e1ln\u00e9m \u010dase<\/a><\/noindex>, zam\u011b\u0159en\u00edm se na vzory exploatace a jejich p\u0159edch\u00e1zen\u00ed.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444418\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>TL;DR. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u0441\u0445\u0435\u043c\u044b (hardening schemes), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043f\u044f\u0442\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux. \u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043c\u044b \u0432\u0437\u044f\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u044f\u0434\u0440\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0438 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0445\u0435\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 \u0438 7, \u0430 \u0442\u0430\u043a\u0436\u0435 Ubuntu 14.04, 12.04 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29880","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"TL;DR.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"TL;DR.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Miliony bin\u00e1rek pozd\u011bji. Jak se Linux pos\u00edlil | ProHoster","description":"TL;DR.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster","og:description":"TL;DR.","og:url":"https:\/\/prohoster.info\/cs\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:27+00:00","article:modified_time":"2019-10-31T18:32:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29880","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 22:50:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:46:28","updated":"2026-01-20 22:50:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/29880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=29880"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/29880\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=29880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=29880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=29880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}