{"id":29880,"date":"2019-10-31T21:32:27","date_gmt":"2019-10-31T18:32:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\/"},"modified":"2019-10-31T21:32:27","modified_gmt":"2019-10-31T18:32:27","slug":"milliony-binarnikov-spustya-kak-ukreplyalsya-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","title":{"rendered":"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/bf51e5698530d4a6a44ff97f542a2a87.png\" style=\"display:block;margin: 0 auto;\" \/><b>TL;DR<\/b>. \u0160aj\u0101 rakst\u0101 m\u0113s p\u0113tniec\u012bbas aizsardz\u012bbas sh\u0113mas (hardening schemes), kas no jebkura par\u0101d\u0101s piecu popul\u0101ru Linux distrib\u016bciju. Katram m\u0113s \u0146\u0113m\u0101m noklus\u0113juma kodola konfigur\u0101ciju, instal\u0113j\u0101m visus pakotnes un analiz\u0113j\u0101m aizsardz\u012bbas sh\u0113mas iek\u0161\u0113jos bin\u0101ros failos. Apskat\u0101m distrib\u016bcijas OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 un 7, k\u0101 ar\u012b Ubuntu 14.04, 12.04 un 18.04 LTS. <\/p>\n<p>Rezult\u0101ti apstiprina, ka pat pamatsh\u0113mas, piem\u0113ram, st\u0101vu kan\u0101ri un poz\u012bcijas neatkar\u012bgas kodas, v\u0113l joproj\u0101m netiek pla\u0161i izmantotas. Situ\u0101cija ir v\u0113l slikt\u0101ka kompilatoriem, kad runa ir par aizsardz\u012bbu pret ievainojam\u012bb\u0101m, piem\u0113ram, steka sadursmi (stack clash), kas k\u013cuva aktu\u0101la janv\u0101r\u012b p\u0113c inform\u0101cijas public\u0113\u0161anas. <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">par ievainojam\u012bb\u0101m systemd.<\/a><\/noindex>. Bet ne viss ir tik bezcer\u012bgi. Liel\u0101 da\u013c\u0101 bin\u0101ro failu ir ieviesti pamata aizsardz\u012bbas metod\u0113m, un to skaits pieaug no versijas uz versiju. <\/p>\n<p>P\u0101rbaude par\u0101d\u012bja, ka visvair\u0101k aizsardz\u012bbas metodes ir ieviestas Ubuntu 18.04 oper\u0113t\u0101jsist\u0113mas un lietojumprogrammu l\u012bmen\u012b, p\u0113c tam seko Debian 9. Savuk\u0101rt, OpenSUSE 12.4, CentOS 7 un RHEL 7 ar\u012b ir ieviestas pamata aizsardz\u012bbas sh\u0113mas, bet aizsardz\u012bba pret steka sadursmi tiek izmantota v\u0113l pla\u0161\u0101k, \u0146emot v\u0113r\u0101 daudz liel\u0101ku noklus\u0113juma pakot\u0146u kopumu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Ievads<\/h1>\n<p>\nIr gr\u016bti nodro\u0161in\u0101t augstu programmat\u016bras kvalit\u0101ti. Neskatoties uz milz\u012bgo progres\u012bvo instrumentu skaitu statiskai koda anal\u012bzei un dinamiskai anal\u012bzei izpildes laik\u0101, k\u0101 ar\u012b iev\u0113rojamu progresu kompilatoru un programm\u0113\u0161anas valodu izstr\u0101d\u0113, m\u016bsdienu programmat\u016bra joproj\u0101m cie\u0161 no ievainojam\u012bb\u0101m, ko nep\u0101rtraukti izmanto uzbruc\u0113ji. Situ\u0101cija ir v\u0113l slikt\u0101ka ekosist\u0113m\u0101s, kas ietver novecoju\u0161u kodu. \u0160\u0101dos gad\u012bjumos m\u0113s ne tikai saskaramies ar m\u016b\u017e\u012bgu probl\u0113mu par iesp\u0113jam\u0101m izp\u0113tes k\u013c\u016bd\u0101m, bet ar\u012b esam ierobe\u017eoti stingros atpaka\u013c savienojam\u012bbas ietvaros, kas bie\u017ei prasa saglab\u0101t ierobe\u017eotu, un v\u0113l slikt\u0101k \u2014 ievainojamu vai k\u013c\u016bdainu kodu.<\/p>\n<p>\u0160eit sp\u0113l\u0113 iejaucas aizsardz\u012bbas vai pastiprin\u0101\u0161anas metodes (hardening). Da\u017eas k\u013c\u016bdas m\u0113s nevaram nov\u0113rst, ta\u010du m\u0113s varam apgr\u016btin\u0101t uzbruc\u0113jiem dz\u012bvi un da\u013c\u0113ji atrisin\u0101t probl\u0113mu, nov\u0113r\u0161ot vai trauc\u0113jot. <i>exploat\u0101cijai<\/i> \u0161\u012bs k\u013c\u016bdas. \u0160\u0101da aizsardz\u012bba tiek izmantota vis\u0101s modernaj\u0101s OS, tom\u0113r metodes \u013coti at\u0161\u0137iras p\u0113c sare\u017e\u0123\u012bt\u012bbas, efektivit\u0101tes un veiktsp\u0113jas: no steku kan\u0101rijiem (stack canaries) un <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Address_space_layout_randomization\">ASLR<\/a><\/noindex> l\u012bdz pilniem aizsardz\u012bbas meh\u0101nismiem <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Control-flow_integrity\">CFI<\/a><\/noindex> un <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Return-oriented_programming\">ROP<\/a><\/noindex>. \u0160aj\u0101 rakst\u0101 apl\u016bkosim, k\u0101di aizsardz\u012bbas pa\u0146\u0113mieni tiek izmantoti slaven\u0101kajos Linux izplat\u012bjumos noklus\u0113juma konfigur\u0101cij\u0101, k\u0101 ar\u012b izp\u0113t\u012bsim bin\u0101ro failu \u012bpa\u0161\u012bbas, kas tiek izplat\u012btas caur katra izplat\u012bjuma pakot\u0146u p\u0101rvald\u012bbas sist\u0113m\u0101m.<\/p>\n<h3>CVE un dro\u0161\u012bba<\/h3>\n<p>\nVisi m\u0113s esam redz\u0113ju\u0161i rakstus ar nosaukumiem, piem\u0113ram, \u00abGada neaizsarg\u0101t\u0101k\u0101s lietotnes\u00bb vai \u00abGada neaizsarg\u0101t\u0101k\u0101s oper\u0113t\u0101jsist\u0113mas\u00bb. Parasti tur ir statistika par kop\u0113jo neaizsarg\u0101t\u012bbu veidu skaitu <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/\">CVE (Common Vulnerability and Exposures)<\/a><\/noindex>, kas ieg\u016bta no <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/\">Nacion\u0101l\u0101s neaizsarg\u0101t\u012bbu datub\u0101zes (NVD)<\/a><\/noindex> no <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nist.gov\/\">NIST<\/a><\/noindex> un citiem avotiem. P\u0113c tam \u0161\u012bs lietotnes vai OS tiek rangotas p\u0113c CVE skaita. Diem\u017e\u0113l, lai gan CVE ir \u013coti noder\u012bgas probl\u0113mu izseko\u0161anai un pieg\u0101d\u0101t\u0101ju un lietot\u0101ju inform\u0113\u0161anai, t\u0101s maz nor\u0101da uz faktisk\u0101 programmat\u016bras dro\u0161\u012bbas l\u012bme\u0146a.<\/p>\n<p>Piem\u0113ram, apl\u016bkosim kop\u0113jo CVE skaitu p\u0113d\u0113jo \u010detru gadu laik\u0101 Linux kodolam un pieciem vispopul\u0101r\u0101kajiem servera izplat\u012bjumiem, proti, Ubuntu, Debian, Red Hat Enterprise Linux un OpenSUSE.<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/16d74634f010e340aedbce441513e3f8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Att\u0113ls 1<\/i><\/p>\n<p>Ko mums saka \u0161is grafiks? Vai liel\u0101ks CVE skaits noz\u012bm\u0113, ka viens izplat\u012bjums ir neaizsarg\u0101t\u0101ks nek\u0101 cits? Atbilde nav. Piem\u0113ram, \u0161aj\u0101 rakst\u0101 j\u016bs redz\u0113siet, ka Debian ir \u012bstenoti stingr\u0101ki aizsardz\u012bbas meh\u0101nismi sal\u012bdzin\u0101jum\u0101 ar, teiksim, OpenSUSE vai RedHat Linux, un tom\u0113r Debian ir vair\u0101k CVE. Tom\u0113r t\u0101s nenoz\u012bm\u0113 v\u0101j\u0101ku dro\u0161\u012bbu: pat CVE kl\u0101tb\u016btne nenor\u0101da uz to, vai neaizsarg\u0101t\u012bba <i>ir izmantojama<\/i>. Smaguma punkti sniedz priek\u0161statu par to, cik <i>iesp\u0113jama<\/i> neaizsarg\u0101t\u012bbas izmanto\u0161ana, tom\u0113r, galu gal\u0101, izmantojam\u012bba liel\u0101 m\u0113r\u0101 ir atkar\u012bga no aizsardz\u012bbas l\u012bdzek\u013ciem, kas ir attiec\u012bgaj\u0101s sist\u0113m\u0101s, k\u0101 ar\u012b no uzbruc\u0113ju resursiem un iesp\u0113j\u0101m. Turkl\u0101t CVE zi\u0146ojumu tr\u016bkums neko nesaka par cit\u0101m <i>neierakst\u012bt\u0101m vai nezin\u0101m\u0101m neaizsarg\u0101t\u012bb\u0101m<\/i> ievainojumos. At\u0161\u0137ir\u012bba CVE var tikt skaidrota nevis ar programmat\u016bras kvalit\u0101ti, bet ar citiem faktoriem, tostarp resursiem, kas pie\u0161\u0137irti test\u0113\u0161anai, vai izmantot\u0101ju b\u0101zes lielumu. M\u016bsu piem\u0113r\u0101 liel\u0101ks CVE skaits Debian var vienk\u0101r\u0161i liecin\u0101t par to, ka Debian pied\u0101v\u0101 vair\u0101k programmat\u016bras pakot\u0146u. <\/p>\n<p>Protams, CVE sist\u0113ma sniedz lietder\u012bgu inform\u0101ciju, kas \u013cauj izstr\u0101d\u0101t atbilsto\u0161us aizsardz\u012bbas meh\u0101nismus. Jo lab\u0101k m\u0113s saprotam programmat\u016bras av\u0101riju c\u0113lo\u0146us, jo viegl\u0101k ir noteikt iesp\u0113jamos izmanto\u0161anas veidus un izstr\u0101d\u0101t attiec\u012bgos meh\u0101nismus. <i>atkl\u0101\u0161anai un rea\u0123\u0113\u0161anai<\/i>. 2. att\u0113l\u0101 par\u0101d\u012btas ievainojam\u012bbas kategorijas visiem izplat\u012bjumiem p\u0113d\u0113jo \u010detru gadu laik\u0101 (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cvedetails.com\/top-50-products.php\">avots<\/a><\/noindex>). Uzreiz var redz\u0113t, ka liel\u0101k\u0101 da\u013ca CVE non\u0101k \u0161\u0101d\u0101s kategorij\u0101s: pakalpojuma atteik\u0161ana (DoS), koda izpilde, p\u0101rsniegums, atmi\u0146as boj\u0101jums, inform\u0101cijas nopl\u016bde (ekstrakcija) un privil\u0113\u0123iju eskal\u0101cija. Lai gan daudzas CVE tiek \u0146emtas v\u0113r\u0101 vair\u0101kas reizes da\u017e\u0101d\u0101s kategorij\u0101s, kopum\u0101 t\u0101s pa\u0161as probl\u0113mas saglab\u0101jas no gada uz gadu. N\u0101kamaj\u0101 raksta da\u013c\u0101 m\u0113s nov\u0113rt\u0113sim da\u017e\u0101du aizsardz\u012bbas sh\u0113mu izmanto\u0161anu, lai nov\u0113rstu \u0161o ievainojam\u012bbu izmanto\u0161anu.<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/45948bc64673540cfb3e1774c3247634.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Att. 2<\/i><\/p>\n<h3>Uzdevumi<\/h3>\n<p>\n\u0160aj\u0101 rakst\u0101 m\u0113s v\u0113lamies atbild\u0113t uz sekojo\u0161iem jaut\u0101jumiem:<\/p>\n<ul>\n<li>K\u0101da ir da\u017e\u0101du Linux izplat\u012bjumu dro\u0161\u012bba? K\u0101di aizsardz\u012bbas meh\u0101nismi past\u0101v kodol\u0101 un lietot\u0101ja telp\u0101?\n<\/li>\n<li>K\u0101 laika gait\u0101 ir main\u012bjusies aizsardz\u012bbas meh\u0101nismu pie\u0146em\u0161ana da\u017e\u0101d\u0101m izplat\u012bjumiem?\n<\/li>\n<li>K\u0101das ir katra izplat\u012bjuma paci\u0146u un bibliot\u0113ku vid\u0113j\u0101s atkar\u012bbas?\n<\/li>\n<li>K\u0101das aizsardz\u012bbas ir realiz\u0113tas katram bin\u0101rajam failam?<\/li>\n<\/ul>\n<p><\/p>\n<h3>Izplat\u012bjumu izv\u0113le<\/h3>\n<p>\nIzr\u0101d\u0101s, ir gr\u016bti atrast prec\u012bzu statistiku par izplat\u012bjumu uzst\u0101d\u0113m, jo \u200b\u200bvairum\u0101 gad\u012bjumu lejupiel\u0101\u017eu skaits nenor\u0101da uz re\u0101lo uzst\u0101d\u012bjumu skaitu. Tom\u0113r Unix varianti veido liel\u0101ko da\u013cu serveru sist\u0113mu (69,2% t\u012bmek\u013ca serveros, saska\u0146\u0101 ar W3techs un citiem avotiem), un to da\u013ca nep\u0101rtraukti pieaug. T\u0101d\u0113j\u0101di m\u016bsu p\u0113t\u012bjum\u0101 m\u0113s koncentr\u0113j\u0101mies uz izplat\u012bjumiem, kas pieejami \u0101rpus kastes uz platformas <noindex><a rel=\"nofollow\" href=\"https:\/\/w3techs.com\/technologies\/overview\/operating_system\/all\">statistiku<\/a><\/noindex> . \u012apa\u0161i m\u0113s izv\u0113l\u0113j\u0101mies \u0161\u0101das oper\u0113t\u0101jsist\u0113mas: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/\">Google Cloud<\/a><\/noindex>Izplat\u012bjums\/versija<\/p>\n<p>B\u016bvniec\u012bba<br \/>\nKodols<br \/>\nOpenSUSE 12.4<\/p>\n<p>4.12.14-95.3-default<br \/>\nDebian 9 (stretch)<br \/>\n#1 SMP Wed Dec 5 06:00:48 UTC 2018 (63a8d29)<\/p>\n<p>4.9.0-8-amd64<br \/>\nCentOS 6.10<br \/>\n#1 SMP Debian 4.9.130-2 (2018-10-27)<\/p>\n<p>2.6.32-754.10.1.el6.x86_64<br \/>\n3.10.0-957.5.1.el7.x86_64<br \/>\n#1 SMP Tue Jan 15 17:07:28 UTC 2019<\/p>\n<p>CentOS 7<br \/>\nRed Hat Enterprise Linux Server 6.10 (Santiago)<br \/>\n#1 SMP Fri Feb 1 14:54:57 UTC 2019<\/p>\n<p>2.6.32-754.9.1.el6.x86_64<br \/>\nRed Hat Enterprise Linux Server 7.6 (Maipo)<br \/>\n#1 SMP Wed Nov 21 15:08:21 EST 2018<\/p>\n<p>3.10.0-957.1.3.el7.x86_64<br \/>\n3.10.0-957.1.3.el7.x86_64<br \/>\n#1 SMP Thu Nov 15 17:36:42 UTC 2018<\/p>\n<p>Ubuntu 14.04 (Trusty Tahr)<br \/>\n4.4.0\u2013140-generic<br \/>\n <br \/>\n#166~14.04.1-Ubuntu SMP Sat Nov 17 01:52:43 UTC 20\u2026<\/p>\n<p>Ubuntu 16.04 (Xenial Xerus)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27~16.04.1-Ubuntu SMP Fri Dec 7 09:59:47 UTC 2018<\/p>\n<p>Ubuntu 18.04 (Bionic Beaver)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27-Ubuntu SMP Thu Dec 6 18:27:01 UTC 2018<\/p>\n<p><i>Tabula 1<\/i> <\/p>\n<h1>Anal\u012bze<\/h1>\n<p>\nP\u0101rl\u016bkosim noklus\u0113juma kodola konfigur\u0101ciju, k\u0101 ar\u012b pakot\u0146u \u012bpa\u0161\u012bbas, kas pieejamas caur katra izplat\u012bjuma iepriek\u0161 instal\u0113to pake\u0161u p\u0101rvaldnieku. T\u0101d\u0113j\u0101di m\u0113s apsveram tikai pakotnes no katra izplat\u012bjuma noklus\u0113juma spogu\u013ciem, ignor\u0113jot pakotnes no nestabilajiem repozitorijiem (piem\u0113ram, 'testing' spogu\u013ciem Debian) un tre\u0161o pu\u0161u pakotnes (piem\u0113ram, Nvidia pakotnes no standarta spogu\u013ciem). Turkl\u0101t m\u0113s neizskat\u0101m lietot\u0101ju kompil\u0101cijas kodolu vai konfigur\u0101cijas ar uzlabotu aizsardz\u012bbu.<\/p>\n<h3>Kodola konfigur\u0101cijas anal\u012bze<\/h3>\n<p>\nM\u0113s pielietoj\u0101m anal\u012bzes skriptu, kas balst\u012bts uz <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/a13xp0p0v\/kconfig-hardened-check\">br\u012bv\u0101 kconfig p\u0101rbaude<\/a><\/noindex>. Apsveram noklus\u0113juma aizsardz\u012bbas iestat\u012bjumus min\u0113tajos izplat\u012bjumos un sal\u012bdzin\u0101m tos ar sarakstu no <noindex><a rel=\"nofollow\" href=\"http:\/\/kernsec.org\/wiki\/index.php\/Kernel_Self_Protection_Project\/Recommended_Settings\">Kodola pa\u0161 aizsardz\u012bbas projekta<\/a><\/noindex> (KSPP). Katram konfigur\u0101cijas parametram tabul\u0101 2 tiek aprakst\u012bts v\u0113lamais iestat\u012bjums: atz\u012bme ir novietota izplat\u012bjumiem, kas atbilst KSSP ieteikumiem (termi\u0146u skaidrojums skat. <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/kernel-configuration-glossary\/\">\u0161eit<\/a><\/noindex>; n\u0101kamajos rakstos m\u0113s izst\u0101st\u012bsim, k\u0101 daudzas no \u0161\u012bm aizsardz\u012bbas metod\u0113m rad\u0101s un k\u0101 uzlauzt sist\u0113mu to tr\u016bkuma d\u0113\u013c).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/dx\/oh\/o0\/dxoho0z-lifjcybajszqb-aiirq.png\"><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/b1a42826f4afc78a2b25d158100b2ba4.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/2177579e65e4fe6bb320903756a04b9b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKopum\u0101 jaunajos kodolos ir stingr\u0101ki noklus\u0113juma iestat\u012bjumi. Piem\u0113ram, CentOS 6.10 un RHEL 6.10 ar kodolu 2.6.32 tr\u016bkst vairuma kritisko funkciju, kas ir ieviestas jaunajos kodolos, piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Supervisor_Mode_Access_Prevention\">SMAP<\/a><\/noindex>, stingras RWX at\u013caujas, adreses randomiz\u0101cija vai copy2usr aizsardz\u012bba. J\u0101atz\u012bm\u0113, ka daudzi no konfigur\u0101cijas variantiem tabul\u0101 nav pieejami vec\u0101k\u0101s kodola versij\u0101s un nav re\u0101li piem\u0113rojami - tabul\u0101 tas tom\u0113r nor\u0101d\u012bts k\u0101 nepietiekama aizsardz\u012bba. L\u012bdz\u012bgi, ja konfigur\u0101cijas parametrs nav pieejams \u0161aj\u0101 versij\u0101, bet \u0161\u012bs dro\u0161\u012bbas parametru j\u0101izsl\u0113dz, tas tiek uzskat\u012bts par sapr\u0101t\u012bgu konfigur\u0101ciju. <\/p>\n<p>V\u0113l viens aspekts rezult\u0101tu interpret\u0101cij\u0101: da\u017ei kodola konfigur\u0101cijas varianti, kas palielina uzbrukuma virsmu, var tikt izmantoti ar\u012b dro\u0161\u012bbai. \u0160\u0101di piem\u0113ri ir uprobes un kprobes, kodola modu\u013ci un BPF\/eBPF. M\u016bsu ieteikums ir izmantot iepriek\u0161 min\u0113tos meh\u0101nismus, lai nodro\u0161in\u0101tu re\u0101lu aizsardz\u012bbu, jo to izmanto\u0161ana nav vienk\u0101r\u0161a, un to ekspluat\u0101cija pie\u013cauj, ka \u013caunpr\u0101t\u012bgas personas jau ir iek\u013cuvu\u0161as sist\u0113m\u0101. Ta\u010du, ja \u0161ie parametri ir aktiviz\u0113ti, sist\u0113mas administratoram ir akt\u012bvi j\u0101kontrol\u0113 \u013caunpr\u0101t\u012bgas darb\u012bbas.<\/p>\n<p>Turpinot p\u0113t\u012bt 2. tabulas ierakstus, m\u0113s redzam, ka m\u016bsdienu kodoli pied\u0101v\u0101 vair\u0101kas iesp\u0113jas aizsardz\u012bbai pret t\u0101d\u0101m ievainojam\u012bb\u0101m k\u0101 inform\u0101cijas nopl\u016bde un steka\/kaudzes p\u0101rpl\u016bde. Tom\u0113r m\u0113s paman\u0101m, ka pat vissvar\u012bg\u0101kie popul\u0101rie izplat\u012bjumi v\u0113l nav \u012bstenoju\u0161i sare\u017e\u0123\u012bt\u0101kas aizsardz\u012bbas opcijas (piem\u0113ram, ar pl\u0101ksn\u0113m <noindex><a rel=\"nofollow\" href=\"https:\/\/grsecurity.net\/\">grsecurity<\/a><\/noindex>) vai modernu aizsardz\u012bbu pret koda atk\u0101rtotas izmanto\u0161anas uzbrukumiem (piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.columbia.edu\/~theofilos\/files\/slides\/krx.pdf\">kombin\u0113jot randomiz\u0101ciju ar R^X tipa sh\u0113m\u0101m koda<\/a><\/noindex>). V\u0113l slikt\u0101k, pat \u0161ie progres\u012bvie aizsardz\u012bbas l\u012bdzek\u013ci nepasarg\u0101 no pilnas uzbrukumu spektra. T\u0101d\u0113j\u0101di sist\u0113mas administratoriem ir \u0101rk\u0101rt\u012bgi svar\u012bgi papildin\u0101t sapr\u0101t\u012bgas konfigur\u0101cijas ar risin\u0101jumiem, kas pied\u0101v\u0101 eksploit\u0101ciju atkl\u0101\u0161anu un nov\u0113r\u0161anu izpildes laik\u0101.<\/p>\n<h3>Lietojumprogrammu anal\u012bze<\/h3>\n<p>\nNav p\u0101rsteidzo\u0161i, ka da\u017e\u0101diem izplat\u012bjumiem ir at\u0161\u0137ir\u012bgas paci\u0146u \u012bpa\u0161\u012bbas, kompil\u0101cijas opcijas, bibliot\u0113ku atkar\u012bbas u.tml. At\u0161\u0137ir\u012bbas past\u0101v pat <noindex><a rel=\"nofollow\" href=\"https:\/\/upload.wikimedia.org\/wikipedia\/commons\/1\/1b\/Linux_Distribution_Timeline.svg\">radniec\u012bg\u0101s<\/a><\/noindex> distrib\u016bcij\u0101s un paci\u0146\u0101s ar nelielu atkar\u012bbu skaitu (piem\u0113ram, coreutils Ubuntu vai Debian). Lai nov\u0113rt\u0113tu at\u0161\u0137ir\u012bbas, m\u0113s lejupiel\u0101d\u0113j\u0101m visas pieejam\u0101s pakas, izvilk\u0101m to saturu un analiz\u0113j\u0101m bin\u0101ros failus un atkar\u012bbas. Katram paket\u0113m m\u0113s izsekoj\u0101m citas paketes, no kur\u0101m t\u0101 atkar\u012bga, un katram bin\u0101rajam failam izsekoj\u0101m t\u0101 atkar\u012bbas. \u0160aj\u0101 sada\u013c\u0101 \u012bsi izkl\u0101st\u012bsim secin\u0101jumus.<\/p>\n<h4>Izplat\u012bjumi<\/h4>\n<p>\nKopum\u0101 m\u0113s esam iel\u0101d\u0113ju\u0161i 361 556 pakotnes vis\u0101m izplat\u012b\u0161anas versij\u0101m, izvelkot tikai pakotnes no noklus\u0113juma spogu\u013ciem. M\u0113s ignor\u0113j\u0101m pakotnes bez izpild\u0101miem ELF failiem, piem\u0113ram, avota kodus, fontus utt. P\u0113c filtr\u0113\u0161anas palika 129 569 pakotnes, kur\u0101s kop\u0101 ir 584 457 bin\u0101rie faili. Pakot\u0146u un failu sadal\u012bjums pa izplat\u012b\u0161anas versij\u0101m ir par\u0101d\u012bts 3. att\u0113l\u0101.<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/a24975fba7413ac8069c07412e5476cc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Att. 3<\/i><\/p>\n<p>Var nov\u0113rot, ka jo m\u016bsdien\u012bg\u0101ka ir izplat\u012b\u0161anas versija, jo vair\u0101k taj\u0101 ir pakot\u0146u un bin\u0101ro failu, kas ir lo\u0123iski. Taj\u0101 pa\u0161\u0101 laik\u0101 Ubuntu un Debian pakotnes ietver daudz vair\u0101k bin\u0101ro failu (gan izpild\u0101mu, gan dinamisku modu\u013cu un bibliot\u0113ku), sal\u012bdzinot ar CentOS, SUSE un RHEL, kas potenci\u0101li ietekm\u0113 Ubuntu un Debian uzbrukuma virsmu (j\u0101atz\u012bm\u0113, ka skait\u013ci atspogu\u013co visus bin\u0101ros failus no vis\u0101m pakot\u0146u versij\u0101m, t.i., da\u017ei faili tiek analiz\u0113ti vair\u0101kas reizes). Tas ir \u012bpa\u0161i svar\u012bgi, \u0146emot v\u0113r\u0101 atkar\u012bbas starp pakotn\u0113m. T\u0101d\u0113j\u0101di ievainojam\u012bba k\u0101da pakotnes bin\u0101r\u0101 fail\u0101 var ietekm\u0113t daudzus ekosist\u0113mas aspektus, jo ievainojama bibliot\u0113ka var ietekm\u0113t visus bin\u0101ros failus, kas to import\u0113. Par atsauci apl\u016bkosim atkar\u012bbu skaita sadal\u012bjumu pa pakotn\u0113m da\u017e\u0101d\u0101s OS:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ii\/e3\/e5\/iie3e5-ei26ezg5yvcyvtzqzl80.png\"><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/c6570e643d92103c87659e61f5d395a6.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Att. 4<\/i> <\/p>\n<p>Gandr\u012bz vis\u0101s izplat\u012b\u0161anas versij\u0101s 60% pakot\u0146u ir vismaz 10 atkar\u012bbu. Turkl\u0101t da\u017eu pakot\u0146u atkar\u012bbu skaits ir iev\u0113rojami liel\u0101ks (vair\u0101k par 100). Tas pats attiecas ar\u012b uz pakot\u0146u pret\u0113j\u0101m atkar\u012bb\u0101m: k\u0101 gaid\u012bts, daudzas pakotnes izmanto vair\u0101kas citas pakotnes izplat\u012b\u0161an\u0101, t\u0101p\u0113c ievainojam\u012bbas \u0161ajos nedaudzajos izv\u0113l\u0113tajos rada augstu risku. Piem\u0113ram, n\u0101kamaj\u0101 tabul\u0101 ir uzskait\u012btas 20 pakotnes ar maksim\u0101lo skaitu pret\u0113jo atkar\u012bbu SLES, CentOS 7, Debian 9 un Ubuntu 18.04 (katr\u0101 \u0161\u016bn\u0101 nor\u0101d\u012bts pakotnes nosaukums un atkar\u012bbu skaits).<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/0aa544db8be1af7bffe21b6314537e18.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabula 3<\/i><\/p>\n<p>Interesants fakts. Lai gan visas analiz\u0113t\u0101s OS ir veidotas x86_64 arhitekt\u016brai, un liel\u0101kajai da\u013cai pakot\u0146u arhitekt\u016bra ir defin\u0113ta k\u0101 x86_64 un x86, tom\u0113r pakotnes bie\u017ei satur bin\u0101ros failus cit\u0101m arhitekt\u016br\u0101m, k\u0101 par\u0101d\u012bts 5. att\u0113l\u0101.<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/b40f607e0c2f169bd1df21bd9994de8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Att\u0113ls 5<\/i><\/p>\n<p>N\u0101kamaj\u0101 noda\u013c\u0101 detaliz\u0113ti apl\u016bkosim analiz\u0113to bin\u0101ro failu raksturojumu.<\/p>\n<h4>Bin\u0101ro failu aizsardz\u012bbas statistika<\/h4>\n<p>\nK\u0101 absol\u016btais minimums, j\u0101iepaz\u012bstas ar pamata aizsardz\u012bbas variantiem eso\u0161ajiem bin\u0101rajiem failiem. Da\u017ei Linux sadal\u012bjumi n\u0101k ar skriptiem, kas veic \u0161\u0101das p\u0101rbaudes. Piem\u0113ram, Debian\/Ubuntu ir \u0161\u0101ds skripts. L\u016bk, piem\u0113rs t\u0101 darb\u012bbai:<\/p>\n<pre><code class=\"bash\">$ hardening-check $(which docker)\n\/usr\/bin\/docker:\n Poz\u012bciju neatkar\u012bgs izpild\u0101mais: j\u0101\n Steks aizsarg\u0101ts: j\u0101\n Fortify Source funkcijas: n\u0113, atrastas tikai neaizsarg\u0101tas funkcijas!\n Las\u0101mas reloc\u0101cijas: j\u0101\n Nekav\u0113jo\u0161a saist\u012b\u0161ana: j\u0101<\/code><\/pre>\n<p>\nSkripts p\u0101rbauda piecas <noindex><a rel=\"nofollow\" href=\"http:\/\/manpages.ubuntu.com\/manpages\/trusty\/man1\/hardening-check.1.html\">aizsardz\u012bbas funkcijas<\/a><\/noindex>:<\/p>\n<ul>\n<li>Poz\u012bciju neatkar\u012bgs izpild\u0101mais (PIE): nosaka, vai programmas teksta sekciju var p\u0101rvietot atmi\u0146\u0101, lai pan\u0101ktu randomiz\u0101ciju, ja kodol\u0101 ir aktiviz\u0113ta ASLR.\n<\/li>\n<li>Steka aizsardz\u012bba: vai ir iek\u013cautas steka kan\u0101la aizsardz\u012bbas metodes, lai pasarg\u0101tu no steka sadursm\u0113m.\n<\/li>\n<li>Fortify Source: vai tiek aizst\u0101tas nedro\u0161\u0101s funkcijas (piem\u0113ram, strcpy) ar to dro\u0161\u0101kaj\u0101m analo\u0123ij\u0101m, bet p\u0101rbaud\u012bt\u0101s izsaukuma izsaukumi izpild\u0113 - ar neaizsarg\u0101taj\u0101m, piem\u0113ram, memcpy viet\u0101 __memcpy_chk.\n<\/li>\n<li>Las\u0101mas reloc\u0101cijas (RELRO): vai reloc\u0101cijas tabulas ieraksti ir mar\u0137\u0113ti k\u0101 'tikai las\u0101mi', ja tie darboj\u0101s pirms izpildes s\u0101kuma.\n<\/li>\n<li>Nekav\u0113jo\u0161a saist\u012b\u0161ana: vai izpildes kompilators at\u013cauj visus p\u0101rvietojumus pirms programmas izpildes s\u0101kuma (tas ir ekvivalents pilnam RELRO).<\/li>\n<\/ul>\n<p>\nVai min\u0113to meh\u0101nismu ir pietiekami? Diem\u017e\u0113l n\u0113. Ir zin\u0101mi veidi, k\u0101 apiet visas iepriek\u0161 min\u0113t\u0101s aizsardz\u012bbas, bet jo stingr\u0101ka ir aizsardz\u012bba, jo augst\u0101ka ir robe\u017ea uzbruc\u0113jiem. Piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity15\/sec15-paper-di-frederico.pdf\">RELRO apiet<\/a><\/noindex> ir gr\u016bt\u0101k lietojami, ja darbojas PIE un nekav\u0113jo\u0161a saist\u012b\u0161ana. L\u012bdz\u012bgi, pilna ASLR prasa papildu p\u016bles, lai izveidotu funkcion\u0113jo\u0161u eksploitu. Tom\u0113r izsmalcin\u0101ti uzbruc\u0113ji jau ir gatavi tikties ar \u0161\u0101d\u0101m aizsardz\u012bb\u0101m: to tr\u016bkums b\u016bt\u012bb\u0101 pa\u0101trin\u0101s uzbrukumu. T\u0101p\u0113c ir \u0101rk\u0101rt\u012bgi svar\u012bgi, lai \u0161os pas\u0101kumus uzskat\u012btu par nepiecie\u0161amiem. <i>minim\u0101li<\/i>. <\/p>\n<p>M\u0113s v\u0113l\u0113j\u0101mies izp\u0113t\u012bt, cik daudz bin\u0101ro failu apl\u016bkotajos sadal\u012bjumos ir aizsarg\u0101ti ar \u0161iem, k\u0101 ar\u012b trim citiem pa\u0146\u0113mieniem:<\/p>\n<ul>\n<li>Neizpild\u0101m\u0101 biti (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Executable_space_protection\">NX<\/a><\/noindex>) nov\u0113r\u0161 izpildi jebkur\u0101 re\u0123ion\u0101, kas nedr\u012bkst b\u016bt izpild\u0101ms, piem\u0113ram, steka kaudz\u0113 utt.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rpath\">RPATH\/RUNPATH<\/a><\/noindex> apz\u012bm\u0113 izpildes ce\u013cu, ko izmanto dinamisks iel\u0101d\u0113t\u0101js, lai atrastu atbilsto\u0161\u0101s bibliot\u0113kas. Pirmais ir <i>oblig\u0101ts<\/i> jebkura m\u016bsdienu sist\u0113ma: t\u0101 tr\u016bkums \u013cauj uzbruc\u0113jiem br\u012bvi ierakst\u012bt slodzi atmi\u0146\u0101 un izpild\u012bt to t\u0101du, k\u0101da t\u0101 ir. Otraj\u0101 gad\u012bjum\u0101 nepareizas izpildes ce\u013cu konfigur\u0101cijas veicina maz\u0101k uzticama koda ievieto\u0161anu, kas var izrais\u012bt virkni probl\u0113mu (piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nth-dimension.org.uk\/pub\/BTL.pdf\">privile\u0123iju paaugstin\u0101\u0161ana<\/a><\/noindex>, k\u0101 ar\u012b <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.debian.org\/RpathIssue\">citas probl\u0113mas<\/a><\/noindex>).<\/li>\n<li>Steka sadursmes aizsardz\u012bba nodro\u0161ina aizsardz\u012bbu pret uzbrukumiem, kas liek stekam p\u0101rkl\u0101t citas atmi\u0146as jomas (piem\u0113ram, kaudzi). \u0145emot v\u0113r\u0101 nesenos eksplotus, kas izmanto <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">sist\u0113masd v\u0101jsp\u0113jas kaudzes sadursm\u0113<\/a><\/noindex>, m\u0113s uzskat\u012bj\u0101m, ka ir sapr\u0101t\u012bgi iek\u013caut \u0161o meh\u0101nismu m\u016bsu datu kop\u0101.<\/li>\n<\/ul>\n<p>\nT\u0101tad, bez papildu ceremonij\u0101m, p\u0101riesim pie skait\u013ciem. Tabul\u0101s 4 un 5 ir apkopo\u0161ana par izpild\u0101majiem failiem un bibliot\u0113k\u0101m da\u017e\u0101diem distribut\u012bviem attiec\u012bgi.<\/p>\n<ul>\n<li>K\u0101 var paman\u012bt, NX aizsardz\u012bba ir ieviesta visur ar da\u017eiem iz\u0146\u0113mumiem. \u012apa\u0161i varat iev\u0113rot nedaudz zem\u0101ku t\u0101s izmanto\u0161anu Ubuntu un Debian distribut\u012bvos sal\u012bdzin\u0101jum\u0101 ar CentOS, RHEL un OpenSUSE.\n<\/li>\n<li>Steka kan\u0101rijas daudzos gad\u012bjumos tr\u016bkst, it \u012bpa\u0161i distribut\u012bvos ar vec\u0101m kodolvien\u012bb\u0101m. Da\u017eas progresu nov\u0113rojam p\u0113d\u0113j\u0101 Centos, RHEL, Debian un Ubuntu distribut\u012bvu izlaidumos.\n<\/li>\n<li>Iz\u0146emot Debian un Ubuntu 18.04, liel\u0101kaj\u0101 da\u013c\u0101 distribut\u012bvu ir v\u0101ja PIE atbalsts.\n<\/li>\n<li>Steka sadursmes aizsardz\u012bba ir v\u0101ji \u012bstenota OpenSUSE, Centos 7 un RHEL 7 un praktiski nepast\u0101v p\u0101r\u0113jiem.\n<\/li>\n<li>Visi distribut\u012bvi ar m\u016bsdienu kodoliem ir k\u0101da RELRO atbalsta, ar vad\u012bbu ie\u0146emot Ubuntu 18.04, bet otro vietu ie\u0146em Debian.<\/li>\n<\/ul>\n<p>\nK\u0101 jau tika min\u0113ts, \u0161aj\u0101 tabul\u0101 iek\u013caut\u0101s metrisk\u0101s v\u0113rt\u012bbas ir vid\u0113j\u0101s vis\u0101m bin\u0101r\u0101 faila versij\u0101m. Ja apl\u016bkojam tikai jaun\u0101k\u0101s failu versijas, skait\u013ci b\u016bs citi (piem\u0113ram, skat. <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">Debian progress PIE ievie\u0161an\u0101<\/a><\/noindex>). Turkl\u0101t liel\u0101k\u0101 da\u013ca distribut\u012bvu parasti, apr\u0113\u0137inot statistiku, p\u0101rbauda aizsardz\u012bbu tikai da\u017e\u0101m funkcij\u0101m bin\u0101raj\u0101 kod\u0101, bet m\u016bsu anal\u012bz\u0113 ir nor\u0101d\u012bts patiesais nostiprin\u0101to funkciju procents. T\u0101p\u0113c, ja bin\u0101r\u0101 fail\u0101 ir aizsarg\u0101tas 5 no 50 funkcij\u0101m, m\u0113s pie\u0161\u0137irsim tam nov\u0113rt\u0113jumu 0,1, kas atbilst 10% nostiprin\u0101tu funkciju.<\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/82e881c5ba2a3911f3a0ffae1a3475f4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabula 4. Aizsardz\u012bbas raksturojumi izpild\u0101maj\u0101m fail\u0101m, kas par\u0101d\u012btas att\u0113l\u0101 3 (atbilsto\u0161o funkciju \u012bsteno\u0161ana procentos no kop\u0113j\u0101 izpild\u0101mo failu skaita)<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/57c8e67be7a57341105262c6e956594c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabula 5. Aizsardz\u012bbas \u012bpa\u0161\u012bbas bibliot\u0113k\u0101m, kas par\u0101d\u012btas att\u0113l\u0101 3 (atbilsto\u0161o funkciju \u012bsteno\u0161ana procentos no kop\u0113j\u0101 bibliot\u0113ku skaita)<\/i><\/p>\n<p>Vai ir progress? Noteikti ir: to pier\u0101da statistika par atsevi\u0161\u0137iem izplat\u012bjumiem (piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">Debian<\/a><\/noindex>), k\u0101 ar\u012b augst\u0101k min\u0113t\u0101s tabulas. K\u0101 piem\u0113ru att\u0113l\u0101 6 ir par\u0101d\u012bta aizsargmeh\u0101nismu ievie\u0161ana tr\u012bs sec\u012bgiem Ubuntu LTS 5 izplat\u012bjumiem (m\u0113s neiek\u013c\u0101v\u0101m steka sadursmju aizsardz\u012bbas statistiku). M\u0113s nov\u0113rojam, ka no versijas uz versiju arvien vair\u0101k failu atbalsta steka canaries, k\u0101 ar\u012b pak\u0101peniski arvien vair\u0101k bin\u0101ro failu tiek pieg\u0101d\u0101ti ar pilnu RELRO aizsardz\u012bbu.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/d1\/ni\/or\/d1niordj1hmiklmg2-w5rsk6dla.png\"><img decoding=\"async\" alt=\"Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 nostiprin\u0101j\u0101s Linux\" src=\"\/wp-content\/uploads\/2019\/03\/9130099db6d59106da8f0a0fc760410e.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Att\u0113ls 6<\/i><\/p>\n<p>Diem\u017e\u0113l vair\u0101kas izpild\u0101mas faila versijas da\u017e\u0101dos izplat\u012bjumos joproj\u0101m neietver nevienu no iepriek\u0161 min\u0113taj\u0101m aizsardz\u012bb\u0101m. Piem\u0113ram, apl\u016bkojot Ubuntu 18.04, var paman\u012bt bin\u0101ro failu ngetty (getty aizvietot\u0101js), k\u0101 ar\u012b shell mksh un lksh, picolisp interpreteris, nvidia-cuda-toolkit paketi (popul\u0101ra pakete lietotn\u0113m ar GPU pa\u0101trin\u0101jumu, piem\u0113ram, ma\u0161\u012bnm\u0101c\u012b\u0161an\u0101s ietvari) un klibc-utils. L\u012bdz\u012bgi, bin\u0101rais fails mandos-client (administrat\u012bvs r\u012bks, kas \u013cauj autom\u0101tiski restart\u0113t ma\u0161\u012bnas ar \u0161ifr\u0113t\u0101m failu sist\u0113m\u0101m) un rsh-redone-client (rsh un rlogin atk\u0101rtota \u012bsteno\u0161ana) tiek pieg\u0101d\u0101ti bez NX aizsardz\u012bbas, lai gan tiem ir SUID ties\u012bbas :(. Turkl\u0101t da\u017eos suid bin\u0101rajos failos nav pamata aizsardz\u012bbas, piem\u0113ram, steka canaries (piem\u0113ram, bin\u0101rais fails Xorg.wrap no Xorg paketes).<\/p>\n<h1>Kopsavilkums un secin\u0101jumi<\/h1>\n<p>\n\u0160aj\u0101 rakst\u0101 m\u0113s izc\u0113l\u0101m vair\u0101kas m\u016bsdienu Linux izplat\u012bjumu dro\u0161\u012bbas \u012bpa\u0161\u012bbas. Anal\u012bze par\u0101d\u012bja, ka jaun\u0101kaj\u0101 Ubuntu LTS (18.04) izplat\u012bjum\u0101 vid\u0113ji ir visstingr\u0101k\u0101 oper\u0113t\u0101jsist\u0113mas un lietot\u0146u l\u012bme\u0146a dro\u0161\u012bba starp izplat\u012bjumiem ar sam\u0113r\u0101 jaun\u0101m kodolversij\u0101m, piem\u0113ram, Ubuntu 14.04, 12.04 un Debian 9. Tom\u0113r apskat\u012btie izplat\u012bjumi CentOS, RHEL un OpenSUSE m\u016bsu datu kop\u0101 noklus\u0113jum\u0101 nodro\u0161ina bl\u012bv\u0101ku pakot\u0146u komplektu, un p\u0113d\u0113j\u0101s versij\u0101s (CentOS un RHEL) ir augst\u0101ks aizsardz\u012bbas pret steka sadursm\u0113m \u012bpatsvars, sal\u012bdzinot ar Debian balst\u012btajiem konkurentiem (Debian un Ubuntu). Sal\u012bdzinot CentOS un RedHat versijas, m\u0113s nov\u0113rojam b\u016btiskus uzlabojumus steka kan\u0101riju un RELRO ievie\u0161an\u0101 no versij\u0101m 6 l\u012bdz 7, ta\u010du vid\u0113ji CentOS ir \u012bstenots vair\u0101k funkciju nek\u0101 RHEL. Kopum\u0101 visiem izplat\u012bjumiem j\u0101piev\u0113r\u0161 \u012bpa\u0161a uzman\u012bba PIE dro\u0161\u012bbai, kas, iz\u0146emot Debian 9 un Ubuntu 18.04, ir \u012bstenota maz\u0101k nek\u0101 10% bin\u0101ro failu m\u016bsu datu kop\u0101. <\/p>\n<p>Visbeidzot, j\u0101atz\u012bm\u0113: lai gan m\u0113s veic\u0101m p\u0113t\u012bjumu manu\u0101li, ir pieejami daudzi dro\u0161\u012bbas r\u012bki (piem\u0113ram, <noindex><a rel=\"nofollow\" href=\"https:\/\/cisofy.com\/lynis\/\">Lynis<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nongnu.org\/tiger\/\">Tiger<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hubblestack\/hubble\">Hubble<\/a><\/noindex>), kas veic anal\u012bzi un pal\u012bdz izvair\u012bties no nedro\u0161\u0101m konfigur\u0101cij\u0101m. Diem\u017e\u0113l pat sp\u0113c\u012bga aizsardz\u012bba sapr\u0101t\u012bg\u0101s konfigur\u0101cij\u0101s negarant\u0113 eksploit\u0101ciju tr\u016bkumu. T\u0101p\u0113c m\u0113s stingri uzskat\u0101m, ka ir vit\u0101li svar\u012bgi nodro\u0161in\u0101t <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">uzticamu uzraudz\u012bbu un uzbrukumu nov\u0113r\u0161anu re\u0101laj\u0101 laik\u0101<\/a><\/noindex>, koncentr\u0113joties uz ekspluat\u0101cijas mode\u013ciem un nov\u0113r\u0161ot to ra\u0161anos.<\/p>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444418\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>TL;DR. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u0441\u0445\u0435\u043c\u044b (hardening schemes), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043f\u044f\u0442\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux. \u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043c\u044b \u0432\u0437\u044f\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u044f\u0434\u0440\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0438 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0445\u0435\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 \u0438 7, \u0430 \u0442\u0430\u043a\u0436\u0435 Ubuntu 14.04, 12.04 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29880","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"TL;DR.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"TL;DR.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Miljoni bin\u0101ro failu v\u0113l\u0101k. K\u0101 tika pastiprin\u0101ts Linux | ProHoster","description":"TL;DR.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster","og:description":"TL;DR.","og:url":"https:\/\/prohoster.info\/lv\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:27+00:00","article:modified_time":"2019-10-31T18:32:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29880","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 22:50:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:46:28","updated":"2026-01-20 22:50:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/29880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=29880"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/29880\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=29880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=29880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=29880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}