{"id":108845,"date":"2023-06-05T15:10:26","date_gmt":"2023-06-05T13:10:26","guid":{"rendered":"https:\/\/prohoster.info\/?p=108845"},"modified":"2023-06-05T17:18:04","modified_gmt":"2023-06-05T15:18:04","slug":"obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","title":{"rendered":"SELinux'i piirangute \u00fcmbersuunamine, mis on seotud Kernel'i moodulite laadimisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00e4idatud on v\u00f5imalikus tuvastamine SELinuxi targeted-reeglite kohandamisest tuuma Mooduli laadimise keelamiseks, mis on rakendatav \u00fchel uuritud seadmel (seadmest ei t\u00e4psustata, milline see on ja kui ulatuslikult see probleem m\u00f5jutab SELinuxi reegleid firmware'is ja jaotustes). Moodulite blokeerimine nimetatud SELinuxi reeglite kohaselt p\u00f5hines juurdep\u00e4\u00e4sul\u00f5ikamisel s\u00fcsteemikutsest finit_module, mis v\u00f5imaldab laadida mooduli failist ning mida kasutatakse sellistes utiliitides nagu insmod. SELinuxi reeglid ei k\u00e4sitlenud s\u00fcsteemikutsumist init_module, mida saab samuti kasutada tuuma moodulite laadimiseks otse m\u00e4lubufferist. <\/p>\n

Meetodi demonstreerimiseks on valmistatud protot\u00fc\u00fcp eksploit, mis v\u00f5imaldab t\u00e4ita koodi tuuma tasemel, laadides oma mooduli ja t\u00e4ielikult keelates SELinuxi kaitse, kui SELinuxi abil on piiratud root-juurdep\u00e4\u00e4s s\u00fcsteemile.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 targeted-\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 (\u043d\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u0435\u0442\u0441\u044f, \u043e \u043a\u0430\u043a\u043e\u043c \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0440\u0435\u0447\u044c \u0438 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 SELinux \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445). \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c\u0443 \u0432\u044b\u0437\u043e\u0432\u0443 finit_module, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108845","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SELinuxi piirangute \u00fcletamine, mis on seotud tuuma moodulite laadimisega | ProHoster","description":"N\u00e4idatud on v\u00f5imalikus tuvastamine SELinuxi targeted-reeglite kohandamisest tuuma Mooduli laadimise keelamiseks, mis on rakendatav \u00fchel uuritud seadmel (seadmest ei t\u00e4psustata, milline see on ja kui ulatuslikult see probleem m\u00f5jutab SELinuxi reegleid firmware'is ja jaotustes). Moodulite blokeerimine nimetatud SELinuxi reeglite kohaselt p\u00f5hines juurdep\u00e4\u00e4sul\u00f5ikamisel s\u00fcsteemikutsest finit_module, mis v\u00f5imaldab laadida mooduli failist ja mida kasutatakse","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u0445\u043e\u0434 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 SELinux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 targeted-\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 (\u043d\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u0435\u0442\u0441\u044f, \u043e \u043a\u0430\u043a\u043e\u043c \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0440\u0435\u0447\u044c \u0438 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 SELinux \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445). \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c\u0443 \u0432\u044b\u0437\u043e\u0432\u0443 finit_module, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-05T13:10:26+00:00","article:modified_time":"2023-06-05T15:18:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108845","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108845"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108845\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}