{"id":38554,"date":"2019-10-31T22:24:30","date_gmt":"2019-10-31T19:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra\/"},"modified":"2019-10-31T22:24:30","modified_gmt":"2019-10-31T19:24:30","slug":"v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","title":{"rendered":"Linuxi kernelisse 5.4 on vastu v\u00f5etud plaastrid, mis piiravad root'i juurdep\u00e4\u00e4su kernel'i siseasjadele.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linus Torvalds heitis<\/a><\/noindex> Linux 5.4 tuleviku tuuma v\u00e4ljaande koosseisus on plaastrite komplekt \u201elockdown<\/a><\/noindex>\u201e pakutud<\/a><\/noindex>\tDavid Howells'iga (David Howells, t\u00f6\u00f6tab Red Hat'is) ja Matthew Garrett'iga (Matthew Garrett<\/a><\/noindex>, mis t\u00f6\u00f6tab Google'is, et piirata root-kasutaja juurdep\u00e4\u00e4su tuumale. Seotud funktsionaalsus \u201elockdown\u201d on eraldi laaditav LSM-moodul (Linux Security Module<\/a><\/noindex>), mis loob barj\u00e4\u00e4ri UID 0 ja tuuma vahel, piirates teatud madala taseme funktsionaalsust.<\/p>\n

Kui r\u00fcndaja suudab r\u00fcnnaku tulemusena k\u00e4ivitada koodi root'i \u00f5igustes, saab ta oma koodi k\u00e4ivitada ka tuuma tasemel, n\u00e4iteks tuuma asendamise kaudu kexec'iga v\u00f5i m\u00e4lu lugemise\/kirjutamise kaudu \/dev\/kmem. Sellise tegevuse k\u00f5ige ilmselgem tagaj\u00e4rg v\u00f5ib olla \u00fcmbers\u00f5it<\/a><\/noindex> UEFI Secure Boot'ist v\u00f5i konfidentsiaalsete andmete v\u00e4ljav\u00f5tmine, mis on salvestatud tuuma tasemel.<\/p>\n

Alguses arendati root'i piiramise funktsioone sertifitseeritud laadimise kaitse tugevdamise kontekstis ja jaotused on juba piisavalt kaua kasutanud kolmandate osapoolte plaastrite kombinatsioone, et takistada UEFI Secure Boot'i \u00fcmbers\u00f5itu. Sellegipoolest ei ole sellised piirangud p\u00f5hituuma hulka kaasatud erimeelsuste t\u00f5ttu<\/a><\/noindex> nende rakenduses ja muredest olemasolevate s\u00fcsteemide t\u00f6\u00f6s h\u00e4irete \u00fcle. Moodul \u201elockdown\u201d sisaldab juba jaotustes kasutatud plaastrite teostusi, mis on \u00fcmber t\u00f6\u00f6tatud eraldi alams\u00fcsteemiks, mis pole seotud UEFI Secure Bootiga. <\/p>\n

Lockdown-re\u017eiimis on piiratud juurdep\u00e4\u00e4s \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobesi silumisre\u017eiim, mmiotrace, tracefs, BPF, PCMCIA CIS (kaardi teabe struktuur), m\u00f5ned ACPI liidendid ja CPU MSR-registerid, blokeeritakse kexec_file ja kexec_load kutseid, keelatakse uinumisse minek, piiratakse DMA kasutamist PCI-seadmete jaoks, keelatakse ACPI koodi importimine EFI muutuja kaudu.
\nei lubata sisendi\/v\u00e4ljundi portidega manipuleerida, sealhulgas katkestuse numbri ja sisendi\/v\u00e4ljundi portaali muutmine j\u00e4rjestusporti jaoks. <\/p>\n

Tavaliselt ei ole lockdown-moodul aktiivne, see koostatakse, kui kconfigis on m\u00e4\u00e4ratud SECURITY_LOCKDOWN_LSM valik ja aktiveeritakse tuuma parameetri \u201elockdown=\u201d kaudu, juhtfail \u201e\/sys\/kernel\/security\/lockdown\u201d v\u00f5i koostamisvalikud LOCK_DOWN_KERNEL_FORCE_*<\/a><\/noindex>, mis v\u00f5ivad v\u00f5tta v\u00e4\u00e4rtusi \u201eintegrity\u201d ja \u201econfidentiality\u201d. Esimesel juhul blokeeritakse v\u00f5imalused, mis v\u00f5imaldavad tuumas t\u00f6\u00f6tavat keskkonda kasutajaruumi kaudu muuta, teisel juhul l\u00fclitatakse v\u00e4lja ka funktsionaalsus, mida saab kasutada konfidentsiaalse teabe v\u00e4ljav\u00f5tmiseks tuumast.<\/p>\n

Oluline on m\u00e4rkida, et lockdown piirdub ainult tuumale juurdep\u00e4\u00e4su tavap\u00e4raste v\u00f5imaluste piiramisega, kuid ei kaitse muudatuste eest, mis tulenevad haavatavuste \u00e4rakasutamisest. Muudatuste blokeerimiseks t\u00f6\u00f6tavas tuumas, kui kasutatakse eksploidijaid, saavad projekti Openwall arendatakse<\/a><\/noindex> eraldi moodul LKRG<\/a><\/noindex> (Linux Kernel Runtime Guard).<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044f\u0434\u0440\u0430 Linux 5.4 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 «lockdown«, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0414\u044d\u0432\u0438\u0434\u043e\u043c \u0425\u043e\u0443\u044d\u043b\u043b\u0441\u043e\u043c (David Howells, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Red Hat) \u0438 \u041c\u044d\u0442\u044c\u044e \u0413\u0430\u0440\u0440\u0435\u0442\u043e\u043c (Matthew Garrett, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Google) \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443. \u0421\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 «lockdown» \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 LSM-\u043c\u043e\u0434\u0443\u043b\u044c (Linux Security Module), \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0431\u0430\u0440\u044c\u0435\u0440 \u043c\u0435\u0436\u0434\u0443 UID 0 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38554","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Linuxi tuuma 5.4 on vastu v\u00f5etud patchid, et piirata root'i juurdep\u00e4\u00e4su tuuma sisemusele | ProHoster","description":"Linus Torvalds on vastu v\u00f5tnud Linuxi tuuma 5.4 tulevasse v\u00e4ljalaskesse lockdowni patchide komplekti, mille on esitanud David Howells (Red Hat) ja Matthew Garrett (Google), et piirata root-kasutaja juurdep\u00e4\u00e4su tuumale. Lockdowniga seotud funktsionaalsus on viidud valikuliselt laaditavasse LSM-moodulisse (Linuxi turbemoodul), mis loob takistuse UID 0 ja","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u043e Linux 5.4 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 root \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044f\u0434\u0440\u0430 Linux 5.4 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 "lockdown", \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0414\u044d\u0432\u0438\u0434\u043e\u043c \u0425\u043e\u0443\u044d\u043b\u043b\u0441\u043e\u043c (David Howells, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Red Hat) \u0438 \u041c\u044d\u0442\u044c\u044e \u0413\u0430\u0440\u0440\u0435\u0442\u043e\u043c (Matthew Garrett, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Google) \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443. \u0421\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 "lockdown" \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 LSM-\u043c\u043e\u0434\u0443\u043b\u044c (Linux Security Module), \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0431\u0430\u0440\u044c\u0435\u0440 \u043c\u0435\u0436\u0434\u0443 UID 0 \u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:30+00:00","article:modified_time":"2019-10-31T19:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:07:39","updated":"2026-01-23 22:31:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}