{"id":38554,"date":"2019-10-31T22:24:30","date_gmt":"2019-10-31T19:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra\/"},"modified":"2019-10-31T22:24:30","modified_gmt":"2019-10-31T19:24:30","slug":"v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","title":{"rendered":"Se han aceptado parches en el n\u00facleo de Linux 5.4 para restringir el acceso de root a las tripas del n\u00facleo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linus Torvalds ha aceptado<\/a><\/noindex> La futura versi\u00f3n del n\u00facleo Linux 5.4 incluir\u00e1 un conjunto de parches \u201clockdown<\/a><\/noindex>\u00ab, proporcionado<\/a><\/noindex>\tDavid Howells (quien trabaja en Red Hat) y Matthew Garrett (Matthew Garrett<\/a><\/noindex>que trabaja en Google) para restringir el acceso del usuario root al n\u00facleo. La funcionalidad relacionada con \u201clockdown\u201d se ha extra\u00eddo a un m\u00f3dulo LSM opcional que se carga (M\u00f3dulo de Seguridad de Linux<\/a><\/noindex>), que establece una barrera entre UID 0 y el n\u00facleo, limitando cierta funcionalidad de bajo nivel.<\/p>\n

Si un atacante consigue ejecutar c\u00f3digo con privilegios de root, puede ejecutar su c\u00f3digo tambi\u00e9n a nivel de n\u00facleo, por ejemplo, mediante la sustituci\u00f3n del n\u00facleo usando kexec o leyendo\/escribiendo memoria a trav\u00e9s de \/dev\/kmem. La consecuencia m\u00e1s obvia de tal actividad puede ser el eludir<\/a><\/noindex> UEFI Secure Boot o la extracci\u00f3n de datos confidenciales almacenados a nivel de n\u00facleo.<\/p>\n

Al principio, las funciones de limitaci\u00f3n de root se desarrollaron en el contexto de mejorar la protecci\u00f3n del arranque verificado, y las distribuciones ya han estado utilizando parches de terceros durante bastante tiempo para bloquear el eludir UEFI Secure Boot. Sin embargo, tales limitaciones no se incluyeron en el n\u00facleo principal debido a desacuerdos<\/a><\/noindex> en su implementaci\u00f3n y las preocupaciones sobre la interrupci\u00f3n de los sistemas existentes. El m\u00f3dulo \u201clockdown\u201d ha integrado ya parches utilizados en distribuciones, los cuales se han reestructurado en forma de un subsistema separado, no vinculado a UEFI Secure Boot. <\/p>\n

En modo lockdown se limita el acceso a \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, el modo de depuraci\u00f3n de kprobes, mmiotrace, tracefs, BPF, PCMCIA CIS (Estructura de Informaci\u00f3n de la Tarjeta), ciertas interfaces ACPI y registros MSR de CPU, se bloquean las llamadas kexec_file y kexec_load, se proh\u00edbe entrar en modo de suspensi\u00f3n, se limita el uso de DMA para dispositivos PCI, se proh\u00edbe la importaci\u00f3n de c\u00f3digo ACPI de variables EFI,
\nno se permiten manipulaciones con puertos de entrada\/salida, incluyendo el cambio de n\u00famero de interrupci\u00f3n y puerto de entrada\/salida para el puerto serie. <\/p>\n

Por defecto, el m\u00f3dulo lockdown no est\u00e1 activo, se compila al especificar en kconfig la opci\u00f3n SECURITY_LOCKDOWN_LSM y se activa a trav\u00e9s del par\u00e1metro del n\u00facleo \u201clockdown=\u201d, el archivo de gesti\u00f3n \u201c\/sys\/kernel\/security\/lockdown\u201d o las opciones de construcci\u00f3n LOCK_DOWN_KERNEL_FORCE_*<\/a><\/noindex>, que pueden tomar los valores \u201cintegrity\u201d y \u201cconfidentiality\u201d. En el primer caso, se bloquean las posibilidades de realizar cambios en el n\u00facleo en funcionamiento desde el espacio de usuario, y en el segundo caso, adem\u00e1s, se desactiva la funcionalidad que se puede utilizar para extraer informaci\u00f3n confidencial del n\u00facleo.<\/p>\n

Es importante se\u00f1alar que el lockdown solo limita las capacidades de acceso del n\u00facleo, pero no protege contra modificaciones resultantes de la explotaci\u00f3n de vulnerabilidades. Para bloquear los cambios en el n\u00facleo operativo al aplicar exploits, el proyecto Openwall se desarrolla<\/a><\/noindex> un m\u00f3dulo separado LKRG<\/a><\/noindex> (Linux Kernel Runtime Guard).<\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044f\u0434\u0440\u0430 Linux 5.4 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 «lockdown«, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0414\u044d\u0432\u0438\u0434\u043e\u043c \u0425\u043e\u0443\u044d\u043b\u043b\u0441\u043e\u043c (David Howells, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Red Hat) \u0438 \u041c\u044d\u0442\u044c\u044e \u0413\u0430\u0440\u0440\u0435\u0442\u043e\u043c (Matthew Garrett, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Google) \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443. \u0421\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 «lockdown» \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 LSM-\u043c\u043e\u0434\u0443\u043b\u044c (Linux Security Module), \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0431\u0430\u0440\u044c\u0435\u0440 \u043c\u0435\u0436\u0434\u0443 UID 0 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se han aceptado parches en el n\u00facleo de Linux 5.4 para limitar el acceso root a las entra\u00f1as del n\u00facleo | ProHoster","description":"Linus Torvalds ha incluido en la pr\u00f3xima versi\u00f3n.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u043e Linux 5.4 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 root \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:30+00:00","article:modified_time":"2019-10-31T19:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:07:39","updated":"2026-01-23 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/38554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=38554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/38554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=38554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=38554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=38554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}