Linus Torvalds tau pom zoo rau daim ntawv rau lub kernel uas piav qhia txog cov txheej txheem rau kev tswj cov kab laum ntsig txog kev ruaj ntseg, txhais cov qauv kev hem thawj, piav qhia meej txog cov kab laum kernel twg raug kho raws li qhov tsis muaj zog, thiab tham txog yuav ua li cas tswj cov kab laum uas tau txheeb xyuas siv AI. Daim ntawv no tau npaj los ntawm Willy Tarreau, tus sau ntawm HAProxy thiab tus tsim tawm kernel ntev. Linux, lub luag haujlwm rau kev tswj hwm ntau ceg kernel ruaj khov. Lub moj khaum yog raws li cov kev pom zoo tau ua tiav thaum lub sijhawm sib tham txog qhov tsis muaj zog tseem ceeb ntawm kernel (1, 2, 3, 4) uas tau tshaj tawm ua ntej cov kho tau tshaj tawm thiab rau qhov ntawd, ua tsaug rau AI, kev siv tsis raug cai tau tsim tam sim ntawd.
Feem ntau ntawm cov kab laum ntsig txog kev ruaj ntseg yuav tsum tau daws rau pej xeem kom ncav cuag cov neeg coob tshaj plaws thiab nrhiav kev daws teeb meem zoo tshaj plaws. Ib daim ntawv teev npe xa ntawv ntiag tug yuav tsum tau siv rau kev xa cov ntawv ceeb toom ceev ceev txog qhov tsis muaj zog uas yooj yim raug siv, ua rau muaj kev hem thawj rau ntau tus neeg siv, thiab tso cai rau kev tau txais cov cai lossis peev xwm txuas ntxiv.
Cov teeb meem uas pom tau los ntawm kev siv AI cov neeg pabcuam yeej ib txwm txhawb kom tham txog rau pej xeem, vim tias cov teeb meem no feem ntau pom tau tib lub sijhawm los ntawm ntau tus kws tshawb fawb. Txawm li cas los xij, qhov kev siv tsis raug cai nws tus kheej yuav tsum tsis txhob qhia tawm hauv daim ntawv tshaj tawm; tsuas yog hais txog nws qhov muaj thiab qhia nws tus kheej los teb rau tus neeg saib xyuas qhov kev thov yog txaus.
Cov cai rau kev xa cov ntawv qhia uas tsim los ntawm AI cov neeg pabcuam tau piav qhia cais. Cov ntawv qhia no tau xa ntau heev thiab qee zaum pab txheeb xyuas cov yuam kev hauv cov ntu tsis zoo ntawm cov lej, tab sis cov neeg saib xyuas feem ntau tsis quav ntsej lawv vim lawv qhov tsis zoo thiab tsis raug. Cov kev cai tseem ceeb rau cov ntawv qhia uas tsim los ntawm AI yog:
- Luv luv, tsis muaj lus piav qhia ntau, thiab nrog lub ntsiab lus tseem ceeb thiab cov ntsiab lus tseem ceeb tau hais thaum pib.
- Tsuas yog cov ntawv yooj yim xwb tsis muaj Markdown cim npe lossis kho kom zoo nkauj.
- Nkag siab txog tus qauv kev hem thawj thiab muab cov lus tseeb uas tuaj yeem txheeb xyuas tau (piv txwv li, "qhov kab laum tso cai rau txhua tus neeg siv kom tau txais CAP_NET_ADMIN") es tsis yog kev kwv yees thiab kev xav txog qhov tshwm sim ntawm qhov tsis muaj zog.
- Ua ntej xa daim ntawv qhia, nco ntsoov sim ua tib zoo saib seb qhov kev siv AI-generated exploit puas ua haujlwm tau zoo thiab xyuas kom meej tias qhov teeb meem no tuaj yeem rov tshwm sim dua.
- Koom tes nrog AI los tsim thiab sim kho qhov teeb meem uas tau txheeb xyuas.
Raws li cov ntaub ntawv ntawm tus tswj xyuas, feem ntau cov ntawv qhia txog kab laum uas xa tuaj raws li kev kho qhov tsis muaj zog tsis yog qhov tsis muaj zog thiab yuav tsum tau daws raws li cov kab laum ib txwm muaj. Ib qho qauv kev hem thawj kernel tau tsim los kom paub qhov txawv ntawm qhov tsis muaj zog thiab cov kab laum ib txwm muaj. LinuxNtawm cov peev xwm thiab kev lav phib xaub, qhov kev ua txhaum uas yuav raug suav hais tias yog qhov tsis muaj zog:
- Kev cais tawm ntawm tus neeg siv: kev nkag mus rau cov ntaub ntawv txwv rau tus tswv, lub cim xeeb txheej txheem tsis nkag mus rau lwm tus neeg siv, ptrace raug kaw rau lwm cov txheej txheem, IPC thiab kev sib txuas lus hauv network.
- Kev tiv thaiv raws li peev xwm: yog tsis muaj CAP_SYS_ADMIN koj tsis tuaj yeem hloov qhov kev teeb tsa kernel, lub cim xeeb, lossis lub xeev system; yog tsis muaj CAP_NET_ADMIN koj tsis tuaj yeem hloov chaw teeb tsa network lossis cuam tshuam tsheb khiav; yog tsis muaj CAP_SYS_PTRACE koj tsis tuaj yeem saib xyuas lwm tus neeg siv cov txheej txheem.
- Tus neeg siv ID namespace (CONFIG_USER_NS) tso cai rau cov neeg siv tsis muaj cai los tsim lawv tus kheej ib puag ncig cais tawm uas lawv tsis tuaj yeem cuam tshuam rau lub npe thoob ntiaj teb, xws li hloov lub sijhawm, thauj khoom modules, lossis mounting block devices.
- Cov kev sib txuas debugging (/proc/kmsg, perf, debugfs), uas cov ntaub ntawv zais cia tuaj yeem nkag mus tau, tsuas yog nkag tau tom qab tus thawj coj tau tso cai nkag mus rau qhov tseeb.
Cov yam ntxwv uas tsis suav tias yog qhov tsis muaj zog:
- Siv cov ceg ntoo kernel qub.
- Tsim nrog cov kev xaiv tsim tawm lossis cov kev xaiv txo kev ruaj ntseg qhib (piv txwv li CONFIG_NOMMU).
- Teeb tsa cov chaw teeb tsa sysctl tsis muaj kev nyab xeeb, cov kev xaiv kab hais kom ua, cov cai nkag mus rau hauv cov ntaub ntawv system, cov peev xwm, lossis tso cai rau cov neeg siv tsis muaj cai nkag mus rau cov interfaces tshwj xeeb (piv txwv li, sau ntawv nkag mus rau procfs thiab debugfs).
- Teeb meem hauv cov yam ntxwv uas tsuas yog siv rau kev tsim kho kernel thiab kev debugging, xws li LOCKDEP, KASAN, thiab FAULT_INJECTION, uas tsis yog siv rau hauv kev teeb tsa ntau lawm.
- Teeb meem hauv cov tsav tsheb, cov modules, thiab cov subsystems uas nyob hauv seem STAGING lossis cim tias yog kev sim, tsis muaj kev nyab xeeb, lossis tawg.
- Siv cov modules kernel sab nraud lossis cov forks kernel tsis raug cai.
- Yuav tsum tau muaj cai ntau dhau, xws li yuav tsum tau ua cov haujlwm ua tus hauv paus lossis los ntawm tus neeg siv uas muaj cov cai CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_RAWIO, thiab CAP_SYS_MODULE.
- Kev tawm tsam theoretical uas xav tau cov xwm txheej hauv chav kuaj, ntau txhiab lab qhov kev sim, kev ua kom zoo li qub lossis kev hloov kho kho vajtse, cov nqi tsis sib npaug, thiab kev teeb tsa tsis muaj tseeb (piv txwv li, cov kab ke nrog kaum tawm txhiab tus CPU cores).
- Tsis siv cov txheej txheem kev ruaj ntseg (xws li ASLR) yam tsis tau qhia txog kev siv tsis raug. Tsis muaj kev lees paub qhov kev sib cav thiab cov lej rov qab yuam kev uas tsis muaj qhov tshwm sim pom tseeb.
- Cov ntaub ntawv tsis tau npaj tseg uas tawm mus dhau qhov uas tus neeg tawm tsam tswj tau, xws li cov ntaub ntawv seem hauv cov lus yuam kev thiab qhov chaw nyob/pointer ntawm lub cim xeeb kernel uas tawm mus yam tsis muaj kev siv tsis raug.
- Yuam kev thaum mounting cov duab disk puas yog tias tus tsav tsheb tsis tau tshaj tawm tias tsim nyog rau kev siv nrog cov xov xwm tsis ntseeg siab. Cov teeb meem nrog cov duab disk tuaj yeem nrhiav tau thiab kho los ntawm kev khiav cov cuab yeej fsck.
- Kev tawm tsam uas xav tau kev nkag mus rau cov khoom siv kho vajtse, kev hloov kho khoom siv, lossis kev sib txuas ntawm cov khoom siv kho vajtse xws li DMA attack boards thiab logic analyzers tshwj tsis yog tias lub kaw lus tau teeb tsa tshwj xeeb los tiv thaiv cov kev tawm tsam zoo li no (IOMMU).
- Kev ua haujlwm thiab kev ua tau zoo rov qab los ntawm kev kho cov kev tso cai thiab kev txwv.
Tau qhov twg los: opennet.ru
