{"id":108845,"date":"2023-06-05T15:10:26","date_gmt":"2023-06-05T13:10:26","guid":{"rendered":"https:\/\/prohoster.info\/?p=108845"},"modified":"2023-06-05T17:18:04","modified_gmt":"2023-06-05T15:18:04","slug":"obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","title":{"rendered":"Evitare le restrizioni di SELinux relative al caricamento dei moduli del kernel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata dimostrata la possibilit\u00e0 di aggirare il divieto di caricamento dei moduli del kernel, implementato nelle regole SELinux mirate su uno dei dispositivi analizzati (non viene specificato di quale dispositivo si tratti e quanto il problema riguardi le norme SELinux nei firmware e nelle distribuzioni). Il blocco dei moduli nelle regole SELinux coinvolte si basava su una restrizione dell'accesso alla chiamata di sistema finit_module, che consente di caricare un modulo da un file e viene utilizzata in strumenti come insmod. Le regole SELinux non consideravano, per\u00f2, la chiamata di sistema init_module, che pu\u00f2 anche essere utilizzata per caricare i moduli del kernel direttamente da un buffer in memoria. <\/p>\n

Per dimostrare il metodo \u00e8 stato preparato un prototipo di exploit, che consente di eseguire codice a livello di kernel caricando il proprio modulo e disabilitando completamente la protezione SELinux, in presenza di un accesso root limitato tramite SELinux al sistema.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 targeted-\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 (\u043d\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u0435\u0442\u0441\u044f, \u043e \u043a\u0430\u043a\u043e\u043c \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0440\u0435\u0447\u044c \u0438 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 SELinux \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445). \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c\u0443 \u0432\u044b\u0437\u043e\u0432\u0443 finit_module, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108845","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aggiramento delle restrizioni di SELinux relative al caricamento dei moduli del kernel | ProHoster","description":"\u00c8 stata dimostrata la possibilit\u00e0 di aggirare il divieto di caricamento dei moduli del kernel, implementato nelle regole targeted di SELinux su uno dei dispositivi studiati (non viene specificato quale dispositivo e quanto il problema influisca sulle regole SELinux nei firmware e nelle distribuzioni). Il blocco dei moduli nelle regole SELinux in uso si basava su una restrizione dell'accesso alla chiamata di sistema finit_module, che consente di caricare un modulo da un file e viene applicata in","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u0445\u043e\u0434 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 SELinux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 targeted-\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 (\u043d\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u0435\u0442\u0441\u044f, \u043e \u043a\u0430\u043a\u043e\u043c \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0440\u0435\u0447\u044c \u0438 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 SELinux \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445). \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 SELinux \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c\u0443 \u0432\u044b\u0437\u043e\u0432\u0443 finit_module, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obhod-ogranichenij-selinux-svyazannyh-s-zagruzkoj-modulej-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-05T13:10:26+00:00","article:modified_time":"2023-06-05T15:18:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/108845","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=108845"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/108845\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=108845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=108845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=108845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}