{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"Lockdown kaitse keelamise meetodid Ubuntu's EEFI Secure Boot'i kaug\u00fclesehitamiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Konovalov Google'ist avaldas<\/a><\/noindex> kaugjuhtimise kaitse v\u00e4ljal\u00fclitamise meetod Lockdown<\/a><\/noindex>, mis on saadaval koos Ubuntusse pakitud Linuxi k\u00e4rgiga (teoreetiliselt v\u00f5ib kasutada ka Fedore ja muid distributsioonide mudeleid, kuid need pole testitud). peavad<\/a><\/noindex> t\u00f6\u00f6tada Fedora tuumaga ja teiste jaotustega, kuid neid ei ole testitud). <\/p>\n

Lockdown piirab root-kasutaja juurdep\u00e4\u00e4su k\u00e4rjele ja blokeerib UEFI Secure Boot l\u00e4biviimisv\u00f5imalused. N\u00e4iteks Lockdown re\u017eiimis piiratakse juurdep\u00e4\u00e4su \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobes'i silumisre\u017eiimile, mmiotrace'ile, tracefs'ile, BPF'ile, PCMCIA CIS (kaarditeabe struktuur), m\u00f5ned ACPI liidesed ja CPU MSR registrid, blokeeritakse kexec_file ja kexec_load \u00fclekutsed, on keelatud j\u00f5ustumine unere\u017eiimi, piiratakse DMA kasutamist PCI seadmetele, keelatakse ACPI koodi importimine EFI muutujatest, sisendi\/v\u00e4ljundi portidega manipuleerimine, sealhulgas katkemise arvu ja sisendi\/v\u00e4ljundi pordi muutmine j\u00e4rjestusporti.<\/p>\n

Lockdown mehhanism lisati hiljuti Linuxi k\u00e4rude p\u00f5hikoosseisu. 5.4<\/a><\/noindex>, kuid jaotistes tarnitavates s\u00fcdamikes on see siiski rakendatud pat\u0161itena v\u00f5i t\u00e4iendatud pat\u0161idega. \u00dcheks eristavaks n\u00e4iteks jaotistes pakutavate lisade ja s\u00fcdametekstide rakenduse vahel on v\u00f5imalus blokeeringut v\u00e4lja l\u00fclitada f\u00fc\u00fcsilise juurdep\u00e4\u00e4su olemasolul s\u00fcsteemile. <\/p>\n

Ubuntu ja Fedora puhul on Lockdowni keelamiseks ette n\u00e4htud klahvikombinatsioon Alt+SysRq+X. Eeldatakse, et klahvikombinatsiooni Alt+SysRq+X saab kasutada ainult f\u00fc\u00fcsilise juurdep\u00e4\u00e4su korral seadmele, ja juhul, kui toimub kaugplatvormi r\u00fcndamine ja saavutatakse root-juurdep\u00e4\u00e4s, ei saa r\u00fcndaja Lockdowni v\u00e4lja l\u00fclitada ning n\u00e4iteks laadida s\u00fcdamikku allkirjata digitaalsete allkirjade moodulit koos rootkit'iga. <\/p>\n

Andrei Konovalov n\u00e4itas, et klaviatuuri kasutamisega seotud meetodid kasutaja f\u00fc\u00fcsilise kohaloleku kinnitamiseks on ebat\u00f5husad. Lihtsaim viis Lockdowni keelamiseks oleks programmiline simuleerimine<\/a><\/noindex> Alt+SysRq+X vajutamise kaudu \/dev\/uinput, kuid see variant on algselt blokeeritud. Samas suudeti tuvastada v\u00e4hemalt kaks muud meetodit Alt+SysRq+X asendamiseks. <\/p>\n

Esimene meetod on seotud «sysrq-trigger» liidese kasutamisega — simuleerimiseks on piisav see liides aktiveerida, kirjutades «1» failisse \/proc\/sys\/kernel\/sysrq, ja seej\u00e4rel kirjutada «x» failisse \/proc\/sysrq-trigger. Antud tagavara eemaldatud<\/a><\/noindex> on seotud Ubuntu tuuma detsembrikuu v\u00e4rskendusega ja Fedora 31-ga. M\u00e4rkimisv\u00e4\u00e4rne on see, et arendajad, nagu juhtum \/dev\/uinput, algselt p\u00fc\u00fcdsid<\/a><\/noindex> seda meetodit blokeerida, kuid blokeerimine ei t\u00f6\u00f6tanud vigade t\u00f5ttu<\/a><\/noindex> koodis.<\/p>\n

Teine meetod on seotud klaviatuuri emuleerimisega l\u00e4bi USB\/IP<\/a><\/noindex> ja j\u00e4rgneva Alt+SysRq+X j\u00e4rjestuse saatmisega virtuaalsest klaviatuurist. Ubuntu tuumas on USB\/IP vaikimisi aktiveeritud (CONFIG_USBIP_VHCI_HCD=m ja CONFIG_USBIP_CORE=m) ning on saadaval vajalikud t\u00f6\u00f6tavate moodulite digitaalselt allkirjastatud versioonid usbip_core ja vhci_hcd. R\u00fcndaja v\u00f5ib luua<\/a><\/noindex> loomine virtuaalne USB-seade, k\u00e4ivitades<\/a><\/noindex> v\u00f5rgufunktsionaalsuse loopback-liidese kaudu ja \u00fchendades selle eemaloleva USB-seadmest USB\/IP abil. Antud meetodist on teatatud<\/a><\/noindex> Ubuntu arendajatele, kuid parandust pole veel v\u00e4lja antud.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Lockdown protection bypass methods in Ubuntu for remote UEFI Secure Boot circumvention | ProHoster","description":"Andrei Konovalov from Google has published a method for remotely disabling the Lockdown protection included in the Linux kernel package provided in Ubuntu (the proposed methods are theoretically applicable to the kernels of Fedora and other distributions, but they have not been tested). Lockdown restricts root user access to the kernel and blocks pathways to bypass UEFI Secure Boot. For example, access is limited in lockdown mode.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f","og:url":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}