{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"Metoder til at deaktivere Lockdown-beskyttelsen i Ubuntu for fjernomg\u00e5else af UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrey Konovalov from Google udgav<\/a><\/noindex> metode til fjernafbrydelse af beskyttelse Lockdown<\/a><\/noindex>, der tilbydes i pakken med Linux-kernen, leveret i Ubuntu (teoretisk foresl\u00e5ede metoder skal<\/a><\/noindex> kan arbejde med kernen i Fedora og andre distributioner, men de er ikke testet). <\/p>\n

Lockdown begr\u00e6nser root-brugerens adgang til kernen og blokerer omg\u00e5elsesveje for UEFI Secure Boot. For eksempel begr\u00e6nser lockdown-tilstanden adgangen til \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobes debugtilstand, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), nogle ACPI-interface og CPU MSR-registre, blokerer kaldene til kexec_file og kexec_load, forbyder overgang til dvaletilstand, begr\u00e6nser brugen af DMA til PCI-enheder, forbyder import af ACPI-kode fra EFI-variabler, tillader ikke manipulation af input\/output-porte, herunder \u00e6ndring af afbrydernummer og input\/output-port for den serielle port.<\/p>\n

Lockdown-mekanismen er for nylig blevet tilf\u00f8jet til hovedkomponenten i Linux-kernen 5.4<\/a><\/noindex>, men i de distributioner, der leveres med kerner, er den stadig implementeret i form af patches eller suppleret med patches. Et af de s\u00e6rpr\u00e6g, der tilbydes i distributionens tilf\u00f8jelser i forhold til den indbyggede kernenimplementering, er muligheden for at deaktivere den givne blokering ved fysisk adgang til systemet. <\/p>\n

I Ubuntu og Fedora er der en tastaturkombination for at deaktivere Lockdown, nemlig Alt+SysRq+X. Det antages, at kombinationen Alt+SysRq+X kun kan bruges med fysisk adgang til enheden, og i tilf\u00e6lde af fjernangreb og opn\u00e5else af root-adgang vil angriberen ikke kunne deaktivere Lockdown og for eksempel indl\u00e6se et modul med rootkit uden godkendt digital signatur. <\/p>\n

Andrey Konovalov har vist, at de metoder, der relaterer sig til brug af tastaturet til at bekr\u00e6fte brugerens fysiske tilstedev\u00e6relse, er ineffektive. Den enkleste m\u00e5de at deaktivere Lockdown p\u00e5 ville v\u00e6re en softwarem\u00e6ssig simulering<\/a><\/noindex> af tryk p\u00e5 Alt+SysRq+X gennem \/dev\/uinput, men denne mulighed er oprindeligt blokeret. Samtidig er det muligt at identificere mindst to andre m\u00e5der at inds\u00e6tte Alt+SysRq+X. <\/p>\n

Den f\u00f8rste metode omhandler brugen af gr\u00e6nsefladen «sysrq-trigger» — for at simulere, skal du blot aktivere denne gr\u00e6nseflade ved at skrive «1» i \/proc\/sys\/kernel\/sysrq, og derefter skrive «x» i \/proc\/sysrq-trigger. Den n\u00e6vnte genvej er blevet l\u00f8st<\/a><\/noindex> blev opdaget i decemberopdateringen af Ubuntu-kernen og i Fedora 31. Bem\u00e6rkelsesv\u00e6rdigt er, at udviklerne, som i tilf\u00e6lde af \/dev\/uinput, oprindeligt fors\u00f8gte<\/a><\/noindex> blokere denne metode, men blokeringen fungerede ikke p\u00e5 grund af fejlen<\/a><\/noindex> i koden.<\/p>\n

Den anden metode er relateret til simulering af tastatur via USB\/IP<\/a><\/noindex> og efterf\u00f8lgende sending af sekvensen Alt+SysRq+X med det virtuelle tastatur. I den medf\u00f8lgende Ubuntu-kerne er USB\/IP som standard aktiveret (CONFIG_USBIP_VHCI_HCD=m og CONFIG_USBIP_CORE=m) og de n\u00f8dvendige signeret moduler usbip_core og vhci_hcd er tilg\u00e6ngelige for brug. Angriberen kan oprette<\/a><\/noindex> et virtuelt USB-enhed, klare<\/a><\/noindex> netv\u00e6rksbehandleren p\u00e5 loopback-interfacet og forbinde den som en fjern USB-enhed ved hj\u00e6lp af USB\/IP. Om den n\u00e6vnte metode er rapporteret<\/a><\/noindex> til udviklerne af Ubuntu, men en rettelse er endnu ikke blevet udgivet.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Metoder til at deaktivere Lockdown-beskyttelsen i Ubuntu for fjernomg\u00e5else af UEFI Secure Boot | ProHoster","description":"Andrei Konovalov fra Google har offentliggjort en metode til fjernafkobling af beskyttelse","canonical_url":"https:\/\/prohoster.info\/da\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b","og:url":"https:\/\/prohoster.info\/da\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}