{"id":118544,"date":"2024-07-29T09:43:08","date_gmt":"2024-07-29T07:43:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii"},"modified":"2024-07-29T09:43:08","modified_gmt":"2024-07-29T07:43:08","slug":"oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","title":{"rendered":"A flaw in the Landlock LSM module allowed previously dropped privileges to be regained.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jann Horn del team Google Project Zero, che in passato ha scoperto vulnerabilit\u00e0 come Spectre e Meltdown, ha trovato un errore logico nell'implementazione del modulo di sicurezza Linux (LSM) Landlock, che permette a un programma di riottenere privilegi gi\u00e0 ridotti, nel caso in cui il programma abbia accesso a chiamate di sistema come fork() e keyctl(). <\/p>\n

Il meccanismo Landlock consente ai programmi non privilegiati di rimuovere privilegi non necessari per il loro funzionamento, limitando volontariamente il loro accesso al sistema per migliorare la sicurezza, ad esempio, per proteggersi in caso di tentativi di sfruttamento delle vulnerabilit\u00e0 nel programma. Ad esempio, un programma pu\u00f2 vietare a se stesso l'accesso a file al di fuori della propria directory di lavoro. <\/p>\n

Come ha scoperto un ingegnere di Google, alcune situazioni non erano state previste dagli sviluppatori del modulo, permettendo al programma di riottenere privilegi rimossi in determinate condizioni. Questo errore esiste in tutte le versioni del kernel con il modulo LSM Landlock, poich\u00e9 \u00e8 presente nell'implementazione originale di questo modulo. Una correzione per risolvere questo problema \u00e8 inclusa nell'attuale versione di test del kernel 6.11-rc1, ma non \u00e8 ancora stata trasferita nei rami stabili.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f\u043d\u043d \u0425\u043e\u0440\u043d (Jann Horn) \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero, \u0432 \u0441\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Spectre \u0438 Meltdown, \u043d\u0430\u0448\u0451\u043b \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux (LSM) Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0443\u0436\u0435 \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u0430\u043c fork() \u0438 keyctl(). \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c Landlock \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435\u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-118544","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Errore nel modulo LSM Landlock che permetteva di riottenere privilegi rimossi | ProHoster","description":"Jann Horn del team Google Project Zero, che in passato ha scoperto vulnerabilit\u00e0 come Spectre e Meltdown, ha trovato un errore logico nell'implementazione del modulo di sicurezza Linux (LSM) Landlock, permettendo a un programma di riottenere privilegi gi\u00e0 ridotti, nel caso in cui il programma abbia accesso a chiamate di sistema come fork() e keyctl(). Il meccanismo Landlock consente ai programmi non privilegiati di rimuovere privilegi non necessari per il loro funzionamento.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 LSM-\u043c\u043e\u0434\u0443\u043b\u0435 Landlock \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u0430\u043d\u043e\u0432\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u042f\u043d\u043d \u0425\u043e\u0440\u043d (Jann Horn) \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero, \u0432 \u0441\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Spectre \u0438 Meltdown, \u043d\u0430\u0448\u0451\u043b \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux (LSM) Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0443\u0436\u0435 \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u0430\u043c fork() \u0438 keyctl(). \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c Landlock \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435\u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-29T07:43:08+00:00","article:modified_time":"2024-07-29T07:43:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"118544","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 05:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:02:19","updated":"2026-01-23 05:02:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/118544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=118544"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/118544\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=118544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=118544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=118544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}