{"id":34721,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","title":{"rendered":"Plaani W^X kaitse mehhanismi tugevdamiseks OpenBSD-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Theo de Raadt <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-tech&#038;m=155899373514678&#038;w=2\">videosid, kus ta n\u00e4itas XQEMU emulaatori (emuleerib originaal Xbox konsooli) k\u00e4ivitamist Nintendo Switch'il. Samuti demonstreeris Voxel9, et s\u00fcsteem suudab k\u00e4ivitada mitmeid m\u00e4nge, sealhulgas Halo: Combat Evolved.<\/a><\/noindex> plaanidest m\u00e4lu kaitsemehhanismi W^X (Write XOR Execute) tugevdamiseks. Mehhanismi sisuks on see, et protsessi m\u00e4lulehed ei saa olla samaaegselt kirjutamiseks ja t\u00e4itmiseks k\u00e4ttesaadavad. Seega saab koodi t\u00e4itmist teha alles p\u00e4rast kirjutamise keelamist, ja kirjutamine m\u00e4lulehte on v\u00f5imalik alles p\u00e4rast t\u00e4itmise keelamist. W^X mehhanism aitab kaitsta kasutajaruumi rakendusi t\u00fc\u00fcpiliste r\u00fcnnakute eest, mida teostatakse m\u00e4lu \u00fclevoolu kaudu, sealhulgas virna \u00fclevoolude eest ja on aktiivne OpenBSD-s. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44506\">vaikimisi<\/a><\/noindex>.<\/p>\n<p>W^X-i t\u00f6\u00f6de algusest oli selge, et see on pikk tee, kuna on olemas m\u00e4rkimisv\u00e4\u00e4rne hulk rakendusi, mis kasutavad JIT-i. JITi rakendusi saab jagada kolme kategooriasse:<\/p>\n<ul>\n<li class=\"l\"> Vahetades m\u00e4lu W ja X olekute vahel, leppides kokku s\u00fcsteemi k\u00f5ne \"hinnaga\". <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/mprotect.2\">mprotect<\/a><\/noindex>.\n<li class=\"l\"> Loovad pseudon\u00fc\u00fcmid sama m\u00e4lu W ja X kaardistuste paarile.\n<li class=\"l\"> K\u00f5ige \"mustem\" variant \u2014 n\u00f5udvad W|X m\u00e4lu mudelid, mis v\u00f5imaldavad samal ajal kirjutamist ja k\u00e4ivitamist.\n<\/ul>\n<p>Praeguseks on m\u00e4rgatavalt v\u00e4hem programme, mis kasutavad kolmandat varianti ning rohkem neid, mis kasutavad esimest ja teist. Sellegipoolest, kuna oli vajalik k\u00e4ivitada ka W|X JIT programme (peamiselt Chromium ja Iridium), lisati failis\u00fcsteemi mountimise valik \"wxallowed\", mis lubas kasutada m\u00e4lu samaaegselt kirjutamiseks ja k\u00e4ivitamiseks, tingimusel et t\u00e4idetav ELF-fail on m\u00e4rgistatud \"wxneeded\" markeriga, ning need rakendused oli t\u00e4iendavalt kaitstud mehhanismide abil. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43295\">pledge<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49042\">unveil<\/a><\/noindex> s\u00fcsteemikutsude ja rakendusele saadaval olevate failis\u00fcsteemi osade nimekirja piiramiseks vastavalt.<\/p>\n<p>Vulnerabiliteedi \u00e4rakasutamise veelgi keerukamaks muutmiseks taheti t\u00e4iendada mehhanismi. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48243\">MAP_STACK<\/a><\/noindex>, mis kontrollib, kas s\u00fcsteemikutse toimub kirjutamises oleva m\u00e4lu lehelt. Kui leht on kirjutamiseks k\u00e4ttesaadav, l\u00f5petatakse protsess sundlikult. Nii ei saa kurjategija kasutada s\u00fcsteemikutsesid ja peab proovima leida vajalikud seadmed JIT rakenduse teostuses v\u00f5i isegi tegema keerulisemat t\u00f6\u00f6d, et tuvastada s\u00fcsteemikutsede silumisvahendeid otse. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44320\">juhuslikult seotud libc<\/a><\/noindex>. <\/p>\n<p>Chrome'i\/Iridiumi protsessid on piisavalt turvalised, kasutades pledge ja unveil, kuid s\u00fcsteemik\u00f5ne write(2) kasutamise v\u00f5imaluse piiramine annab r\u00fcndajale ilmselgelt m\u00f5ningaid eeliseid, kuna loob t\u00e4iendavaid raskusi. Siiski v\u00f5ivad raskused tekkida ka juhul, kui JIT realiseerimine kasutab natiivseid s\u00fcsteemik\u00f5nesid W|X m\u00e4lust. Siiski on p\u00f5hjust loota, et sellise olukorraga ei pea kokku puutuma, kuna ABI on korduvalt muutunud, kuid keegi ei ole kunagi teatatud probleemidest.<\/p>\n<p>Muutused on juba saadaval regulaarsetes OpenBSD-Current harude snapshots, k\u00f5ik huvilised on kutsutud katsetama.<\/p>\n<p>Teo sai eraldi kommentaari seoses Chrome'i\/Iridiumi re\u017eiimi ilmumise uudistega <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50559\">JITless<\/a><\/noindex>Selle vaatenurgast on see teatud kasutusmudelite jaoks vastuv\u00f5etav, kuid t\u00f5en\u00e4oliselt mitte k\u00f5igi jaoks, kuna sel moel suureneb ilmselgelt protsessori koormus. Praegu t\u00f6\u00f6tab Chrome peamiselt, kui \"wxallowed\" on v\u00e4lja l\u00fclitatud \/usr\/local, kuigi m\u00f5ned laiendustega v\u00f5ivad tekkida probleemid (n\u00e4iteks ghostery). Igatahes loodab Theo, et JITless re\u017eiimis t\u00f6\u00f6tamine j\u00f5uab varsti t\u00e4ieliku toimimiseni.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50763\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute). \u0421\u0443\u0442\u044c \u043c\u0435\u0445\u043d\u0438\u0437\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c W^X \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plaanid W^X kaitse tugevdamiseks OpenBSD-s | ProHoster","description":"Teo De Raadt jagas plaane W^X (Write XOR Execute) m\u00e4lukaitse mehhanismi tugevdamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster","og:description":"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34721","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34721"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34721\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}