{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft pakkus Linuxi tuumale juurdep\u00e4\u00e4sukontrolli s\u00fcsteemi IPE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te esitas arutamiseks Linuxi tuumade arendajate postitusloendis LSM-mooduli koodi, mis \u0440\u0435\u0430\u043b\u0438\u0437uje IPE (Integrity Policy Enforcement) mehhanismi, mis laiendab olemasolevaid mandatide haldamise s\u00fcsteeme. IPE-s langetatakse otsus operatsiooni lubamise v\u00f5i keeldumise osas olemasolevate s\u00fcsteemi komponendi p\u00fcsivate omaduste p\u00f5hjal, millega operatsioon toimub, mitte ei seostata seda etikettide ja teedega. Moodul v\u00f5imaldab m\u00e4\u00e4rata kogu s\u00fcsteemi integriteedi poliitika, mis n\u00e4itab, millised operatsioonid on lubatud ja kuidas komponentide autentsust kontrollida. <\/p>\n

IPE eesm\u00e4rk on luua t\u00e4ielikult verifitseeritud s\u00fcsteeme, mille integriteet on kinnitatud algsest laadimisseadmest ja tuumast kuni l\u00f5ppfaile, konfiguratsioonide ja laadimisfailideni. N\u00e4iteks IPE abil saab m\u00e4\u00e4rata, milliseid t\u00e4itefailide on lubatud k\u00e4ivitada, v\u00f5ttes arvesse nende vastavust viidete versioonidele, mida pakuvad s\u00fcsteemid dm-verity. Faili muutmise v\u00f5i asendamise korral v\u00f5ib IPE operatsiooni blokeerida v\u00f5i logida integriteedi rikkumise fakti. <\/p>\n

Pakutud mehhanismi saab kasutada sisseehitatud seadmete p\u00fcsivormides, kus kogu tarkvara ja seaded kogutakse ja esitatakse spetsiaalselt omanikult, n\u00e4iteks Microsofti andmekeskustes kasutatakse seda seadmetes, mis on ette n\u00e4htud tulem\u00fc\u00fcride jaoks. Erinevalt teistest integriteedi kontrollimise s\u00fcsteemidest, nagu IMA, eristub IPE sellest, et see on s\u00f5ltumatu failis\u00fcsteemi metadata osas \u2014 k\u00f5ik omadused, mis m\u00e4\u00e4ratlevad operatsioonide lubatavuse, on salvestatud otse tuumale. <\/p>\n

Reeglid on esitatud tekstivormingus v\u00f5tme-v\u00e4\u00e4rtuse komplektidena. P\u00f5hiparameetriteks on 'op', mis m\u00e4\u00e4rab toimingu, millele reegel kehtib (n\u00e4iteks, op=EXECUTE aktiveerub t\u00e4itmise katsel) ja 'action', mis m\u00e4\u00e4rab tegevuse (n\u00e4iteks, 'action=DENY' blokeerimiseks). Reeglid on seotud omadustega, mida pakuvad v\u00e4lised alams\u00fcsteemid, nagu dm-verity ja fs-verity. <\/p>\n

N\u00e4iteks reeglid op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY lubavad ainult k\u00e4ivitamise kontrollitud partitsioonilt, keelavad failide k\u00e4ivitamise partitsioonidelt, mis ei oma dm-verity allkirju, ning valikuliselt keelavad faili t\u00e4itmise, mille hajutatud v\u00e4\u00e4rtus on '401fce\u20260dec146938'. <\/p>\n

Algne laadimisreeglite komplekt m\u00e4\u00e4ratakse SECURITY_IPE_BOOT_POLICY seadistamisega ja lisatakse s\u00fcdamiku koostisse, samas kui teised reeglid lisatakse vajadusel faili \/sys\/kernel\/security\/ipe\/new_policy kaudu. Edastatavad reeglid kr\u00fcpteeritakse SYSTEM_TRUSTED_KEYRINGis m\u00e4\u00e4ratud sertifikaadiga. <\/p>\n

\u00dcldkasutusega s\u00fcsteemides soovitatakse kasutada IPE-d koos Huawei arendatava DIGLIM mehhanismiga. DIGLIM on rakendatud eBPF-i kaudu ja v\u00f5imaldab h\u00f5lpsasti rakendada terviklikkuse kontrolli eraldi failide tasemel tavalistes distributsioonides, ilma et neid tuleks \u00fcmber t\u00f6\u00f6delda (tutvustatakse kui Secure Boot'i varianti, mis t\u00f6\u00f6tab rakenduslikul tasemel). DIGLIMi olemus seisneb kontrolli r\u00e4sim\u00e4rkide hoidmise s\u00fcsteemi s\u00e4ilitamises failide ja metaandmete jaoks ning juurdep\u00e4\u00e4su andmises k\u00e4ivitatavatele failidele ainult siis, kui nende r\u00e4sim\u00e4rk on olemas kontrollide hulgas. R\u00e4sim\u00e4rkide nimekirja saab saada RPM paketihaldurilt v\u00f5i genereerida kasutaja poolt k\u00e4sitsi.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043c\u0435\u0442\u043a\u0430\u043c \u0438 \u043f\u0443\u0442\u044f\u043c \u0432 IPE \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438\u043b\u0438 \u0437\u0430\u043f\u0440\u0435\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f. \u041c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u0431\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113980","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft pakkus Linuxi s\u00fcdamikule juurdep\u00e4\u00e4su haldamise s\u00fcsteemi IPE | ProHoster","description":"Ettev\u00f5te esitas Linuxi s\u00fcdamiku arendajate postitusloendi arutamiseks LSM-mooduli koodi IPE (Integrity Policy Enforcement) mehhanismi rakendamiseks, mis laiendab olemasolevaid mandaadi juurdep\u00e4\u00e4su haldamise s\u00fcsteeme.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IPE \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-29T16:25:59+00:00","article:modified_time":"2024-02-29T16:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113980\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}