{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"Lockdown kaitse keelamise meetodid Ubuntu's UEFI Secure Boot'i kaugrikkumise jaoks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Konovalov from Google avalikustas<\/a><\/noindex> viis kaitse kaugv\u00e4ljal\u00fclitamiseks Lockdown<\/a><\/noindex>, mida pakutakse koos Ubuntu tarnitava Linuxi tuumaga (teoreetiliselt peaksid pakutud meetodid peate<\/a><\/noindex> toimima ka Fedora tuuma ja teiste distributsioonidega, kuid neid ei ole testitud). <\/p>\n

Lockdown piirab root-kasutaja juurdep\u00e4\u00e4su tuumale ja blokeerib UEFI Secure Booti \u00fcmbers\u00f5iduteed. N\u00e4iteks on lockdown-re\u017eiimis piiratud juurdep\u00e4\u00e4sule \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs-ile, kprobesi silumisre\u017eiimile, mmiotrace'ile, tracefs-ile, BPF-ile, PCMCIA CIS-ile (Card Information Structure), m\u00f5nele ACPI liidesele ja CPU MSR-registritele, blokeeritakse kexec_file- ja kexec_load-kutsed, keelatakse unere\u017eiimi minek, piiratakse DMA kasutamist PCI-seadmete jaoks, keelatakse ACPI-koodi import EFI muutujatest ning ei lubata sisend-\/v\u00e4ljundportidega manipuleerimist, sealhulgas katkestuse numbri ja jadapordi sisend-\/v\u00e4ljundpordi muutmist.<\/p>\n

Lockdowni mehhanism lisati hiljuti Linuxi tuuma p\u00f5hikoosseisu 5.4<\/a><\/noindex>, kuid distributsioonidega kaasas olevates tuumades on see endiselt rakendatud paikadena v\u00f5i t\u00e4iendatud paikadega. \u00dcks distributsioonides pakutavate lisakihtide erinevusi v\u00f5rreldes tuuma sisseehitatud teostusega on v\u00f5imalus olemasolev lukustus f\u00fc\u00fcsilise juurdep\u00e4\u00e4su korral s\u00fcsteemile v\u00e4lja l\u00fclitada. <\/p>\n

Ubuntus ja Fedoras on Lockdowni v\u00e4ljal\u00fclitamiseks ette n\u00e4htud klahvikombinatsioon Alt+SysRq+X. Eeldatakse, et kombinatsiooni Alt+SysRq+X saab kasutada ainult f\u00fc\u00fcsilise juurdep\u00e4\u00e4su korral seadmele ning kaugmurde ja root-\u00f5iguste saamise puhul ei saa r\u00fcndaja Lockdowni v\u00e4lja l\u00fclitada ega n\u00e4iteks laadida tuuma digitaalselt allkirjastamata rootkit'iga moodulit. <\/p>\n

Andrei Konovalov n\u00e4itas, et klaviatuuri kasutamisega seotud meetodid kasutaja f\u00fc\u00fcsilise kohalolu kinnitamiseks ei ole t\u00f5husad. K\u00f5ige lihtsam viis Lockdowni v\u00e4ljal\u00fclitamiseks oleks tarkvaraline simuleerimine<\/a><\/noindex> klahvivajutusest Alt+SysRq+X l\u00e4bi \/dev\/uinputi, kuid see variant on algselt blokeeritud. Seejuures \u00f5nnestus tuvastada v\u00e4hemalt veel kaks viisi Alt+SysRq+X sisestuse j\u00e4ljendamiseks. <\/p>\n

Esimene meetod on seotud «sysrq-trigger» liidese kasutamisega — simulatsiooni tekitamiseks piisab, kui aktiveerida see liides, kirjutades «1» faili \/proc\/sys\/kernel\/sysrq ja seej\u00e4rel kirjutada «x» faili \/proc\/sysrq-trigger. Antud taganemine on k\u00f5rvaldatud<\/a><\/noindex> detsembrikuises Ubuntu tuuma uuenduses ja Fedora 31-s. T\u00e4helepanuv\u00e4\u00e4rne on see, et arendajad, nagu ka \/dev\/uinputi puhul, algselt p\u00fc\u00fcdsid<\/a><\/noindex> selle meetodile blokeeringut rakendada, kuid blokeerimine ei t\u00f6\u00f6tanud vead<\/a><\/noindex> koodis oleva vea t\u00f5ttu.<\/p>\n

Teine meetod on seotud klaviatuuri emuleerimisega USB\/IP<\/a><\/noindex> abil ja seej\u00e4rel j\u00e4rjestuse Alt+SysRq+X saatmisega virtuaalselt klaviatuurilt. Ubuntu tarnitavas tuumas on USB\/IP vaikimisi lubatud (CONFIG_USBIP_VHCI_HCD=m ja CONFIG_USBIP_CORE=m) ning olemas on t\u00f6\u00f6ks vajalikud digitaalselt allkirjastatud moodulid usbip_core ja vhci_hcd. R\u00fcndaja saab luua<\/a><\/noindex> virtuaalse USB-seadme luua, k\u00e4ivitades<\/a><\/noindex> v\u00f5rguk\u00e4sitleja loopback-liidesel ja \u00fchendades selle USB\/IP abil kaug-USB-seadmena. Sellest meetodist teatati<\/a><\/noindex> Ubuntu arendajatele, kuid parandust pole veel v\u00e4lja antud.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ubuntu Lockdown-kaitse v\u00e4ljal\u00fclitamise meetodid UEFI Secure Booti kaugr\u00fcndeks | ProHoster","description":"Google'i t\u00f6\u00f6taja Andrey Konovalov avaldas meetodi kaitse kaugelt v\u00e4ljal\u00fclitamiseks","canonical_url":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b","og:url":"https:\/\/prohoster.info\/et\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}