{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"A Lockdown v\u00e9delem letilt\u00e1s\u00e1nak m\u00f3dszerei Ubuntu alatt a t\u00e1voli UEFI Secure Boot megker\u00fcl\u00e9shez","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrej Konovalov a Google-t\u00f3l k\u00f6zz\u00e9tett<\/a><\/noindex> a v\u00e9delem t\u00e1voli letilt\u00e1s\u00e1nak m\u00f3dja Lockdown<\/a><\/noindex>, amely a Linux kernelhez k\u00edn\u00e1lt csomagban tal\u00e1lhat\u00f3, amely az Ubuntu-ban \u00e9rkezik (elm\u00e9letileg javasolt m\u00f3dszerek kell<\/a><\/noindex> Fedora kernellel \u00e9s m\u00e1s disztrib\u00faci\u00f3kkal dolgozni, de ezek nincsenek letesztelve). <\/p>\n

A Lockdown korl\u00e1tozza a root felhaszn\u00e1l\u00f3 hozz\u00e1f\u00e9r\u00e9s\u00e9t a kernelhez, \u00e9s blokkolja az UEFI Secure Boot elker\u00fcl\u00e9s\u00e9nek m\u00f3djait. P\u00e9ld\u00e1ul a lockdown \u00fczemm\u00f3dban a hozz\u00e1f\u00e9r\u00e9s le van korl\u00e1tozva a \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobes, mmiotrace, tracefs, BPF, PCMCIA CIS (K\u00e1rtya Inform\u00e1ci\u00f3s Strukt\u00fara), n\u00e9h\u00e1ny ACPI interf\u00e9sz \u00e9s CPU MSR-regiszterekhez, blokkolj\u00e1k a kexec_file \u00e9s kexec_load h\u00edv\u00e1sokat, megtiltj\u00e1k az alv\u00f3 \u00fczemm\u00f3dba val\u00f3 v\u00e1lt\u00e1st, korl\u00e1tozz\u00e1k a DMA haszn\u00e1lat\u00e1t PCI-eszk\u00f6z\u00f6kn\u00e9l, megtiltj\u00e1k az ACPI k\u00f3d EFI v\u00e1ltoz\u00f3kb\u00f3l val\u00f3 import\u00e1l\u00e1s\u00e1t, nem enged\u00e9lyezik a portok bemeneti\/kimeneti manipul\u00e1ci\u00f3j\u00e1t, bele\u00e9rtve a megszak\u00edt\u00e1si sz\u00e1m \u00e9s a soros port bemeneti\/kimeneti port sz\u00e1m\u00e1nak megv\u00e1ltoztat\u00e1s\u00e1t.<\/p>\n

A Lockdown mechanizmus nemr\u00e9giben ker\u00fclt be a Linux kernel f\u0151 \u00f6sszetev\u0151ibe 5.4<\/a><\/noindex>, de a disztrib\u00faci\u00f3k kerneleiben tov\u00e1bbra is jav\u00edtott vagy patch-elt form\u00e1ban \u00e1ll rendelkez\u00e9sre. Az egyik k\u00fcl\u00f6nbs\u00e9g a disztrib\u00faci\u00f3kban k\u00edn\u00e1lt kiterjeszt\u00e9sek \u00e9s a kernelbe be\u00e9p\u00edtett megval\u00f3s\u00edt\u00e1s k\u00f6z\u00f6tt az, hogy a blokkol\u00e1s letilthat\u00f3, ha fizikai hozz\u00e1f\u00e9r\u00e9s \u00e1ll rendelkez\u00e9sre a rendszerhez. <\/p>\n

Az Ubuntu \u00e9s Fedora rendszerekben a Lockdown letilt\u00e1s\u00e1hoz az Alt+SysRq+X billenty\u0171kombin\u00e1ci\u00f3t lehet haszn\u00e1lni. Felt\u00e9telezhet\u0151, hogy az Alt+SysRq+X kombin\u00e1ci\u00f3t csak fizikai hozz\u00e1fer\u00e9s eset\u00e9n lehet haszn\u00e1lni, \u00e9s t\u00e1voli behatol\u00e1s eset\u00e9n, ha a t\u00e1mad\u00f3 root hozz\u00e1f\u00e9r\u00e9st nyer, nem tudja letiltani a Lockdownot, \u00e9s p\u00e9ld\u00e1ul nem tud nem al\u00e1\u00edrt digit\u00e1lis al\u00e1\u00edr\u00e1ssal ell\u00e1tott modult bet\u00f6lteni a kernelbe rootkittel. <\/p>\n

Andrej Konovalov megmutatta, hogy a billenty\u0171zet haszn\u00e1lat\u00e1val kapcsolatos m\u00f3dszerek nem hat\u00e9konyak a felhaszn\u00e1l\u00f3 fizikai jelenl\u00e9t\u00e9nek meger\u0151s\u00edt\u00e9s\u00e9re. A Lockdown letilt\u00e1s\u00e1nak legegyszer\u0171bb m\u00f3dja a szoftveres szimul\u00e1ci\u00f3<\/a><\/noindex> az Alt+SysRq+X lenyom\u00e1s\u00e1nak emul\u00e1l\u00e1s\u00e1ra a \/dev\/uinput-on kereszt\u00fcl, de ez a lehet\u0151s\u00e9g eredetileg blokkolva van. Ugyanakkor legal\u00e1bb m\u00e9g k\u00e9t m\u00f3dszert siker\u00fclt felfedezni az Alt+SysRq+X beilleszt\u00e9s\u00e9re. <\/p>\n

Az els\u0151 m\u00f3dszer a «sysrq-trigger» interf\u00e9sz haszn\u00e1lat\u00e1val kapcsolatos — el\u00e9g, ha ezt az interf\u00e9szt enged\u00e9lyezed, \u00e9s «1» \u00e9rt\u00e9ket \u00edrsz a \/proc\/sys\/kernel\/sysrq f\u00e1jlba, majd «x» \u00e9rt\u00e9ket a \/proc\/sysrq-trigger f\u00e1jlba. A megadott kiskapu eliminates<\/a><\/noindex> az Ubuntu kernel decemberi friss\u00edt\u00e9s\u00e9ben \u00e9s a Fedora 31-ben tal\u00e1lhat\u00f3. \u00c9rdekes, hogy a fejleszt\u0151k, mint a \/dev\/uinput eset\u00e9ben, eredetileg pr\u00f3b\u00e1lkoztak<\/a><\/noindex> blokkolja ezt a m\u00f3dszert, de a blokkol\u00e1s nem m\u0171k\u00f6d\u00f6tt a k\u00f6vetkez\u0151k miatt hiba<\/a><\/noindex> a k\u00f3dban.<\/p>\n

A m\u00e1sodik m\u00f3dszer a billenty\u0171zet emul\u00e1l\u00e1s\u00e1val kapcsolatos, USB\/IP<\/a><\/noindex> majd az Alt+SysRq+X sorozat virtu\u00e1lis billenty\u0171zetr\u0151l val\u00f3 elk\u00fcld\u00e9s\u00e9vel. Az Ubuntu-sz\u00e1ll\u00edtm\u00e1nyban az USB\/IP alap\u00e9rtelmez\u00e9s szerint enged\u00e9lyezve van (CONFIG_USBIP_VHCI_HCD=m \u00e9s CONFIG_USBIP_CORE=m), \u00e9s sz\u00fcks\u00e9ges, a digit\u00e1lis al\u00e1\u00edr\u00e1s \u00e1ltal hiteles\u00edtett usbip_core \u00e9s vhci_hcd modulok biztos\u00edtva vannak. A t\u00e1mad\u00f3 k\u00e9pes lehet l\u00e9trehozni<\/a><\/noindex> virtu\u00e1lis USB-eszk\u00f6z l\u00e9trehoz\u00e1s\u00e1ra, elind\u00edtva<\/a><\/noindex> a h\u00e1l\u00f3zati kezel\u0151t a loopback interf\u00e9szen, \u00e9s csatlakoztatva azt t\u00e1voli USB-eszk\u00f6zk\u00e9nt USB\/IP seg\u00edts\u00e9g\u00e9vel. A megadott m\u00f3dszerr\u0151l jelentettek<\/a><\/noindex> az Ubuntu fejleszt\u0151inek, de a jav\u00edt\u00e1s m\u00e9g nem ker\u00fclt kiad\u00e1sra.<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lockdown v\u00e9delem kikapcsol\u00e1s\u00e1nak m\u00f3dszerei Ubuntu alatt az UEFI Secure Boot t\u00e1voli megker\u00fcl\u00e9s\u00e9re | ProHoster","description":"Andrej Konovalov, a Google munkat\u00e1rsa k\u00f6zz\u00e9tette a v\u00e9delem t\u00e1voli kikapcsol\u00e1s\u00e1nak m\u00f3dj\u00e1t,","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b","og:url":"https:\/\/prohoster.info\/hu\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}