Moni nonse! Makamaka ophunzira maphunziro Takonzekera kumasulira kwa FAQ yovomerezeka ya polojekiti ya SELinux. Zikuwoneka kwa ife kuti kumasuliraku kungakhale kothandiza osati kwa ophunzira okha, kotero tikugawana nanu.
Tayesera kuyankha ena mwamafunso omwe amafunsidwa pafupipafupi za polojekiti ya SELinux. Panopa, mafunso agawidwa m’magulu awiri. Mafunso onse ndi mayankho amaperekedwa .
mwachidule
mwachidule
- Kodi Security Enhanced Linux ndi chiyani?
Linux yopititsa patsogolo chitetezo (SELinux) ndikuwonetsa kukhazikitsidwa kwachitetezo cha Flask kuti chiwongoleredwe, chokhazikika. Idapangidwa kuti iwonetse phindu la njira zowongolera zofikira komanso momwe njira zotere zingawonjezeredwere panjira yogwirira ntchito. Zomangamanga za Flask pambuyo pake zidaphatikizidwa ku Linux ndikutumizidwa kuzinthu zina zingapo, kuphatikiza makina opangira a Solaris, makina opangira a FreeBSD, ndi Darwin kernel, zomwe zidayambitsa ntchito zosiyanasiyana. Zomangamanga za Flask zimapereka chithandizo chanthawi zonse pakugwiritsa ntchito mitundu yambiri ya njira zowongolera zolowera, kuphatikiza zomwe zimachokera pamalingaliro a Type Enforcement, Role-based Access Control, ndi Multi-level Security. - Kodi Linux yowonjezera chitetezo imapereka chiyani kuti Linux wamba sangathe?
Linux kernel yopititsa patsogolo chitetezo imayika mfundo zowongolera zofikira zomwe zimachepetsa mapulogalamu a ogwiritsa ntchito ndi maseva adongosolo kuti akhale ndi mwayi wochepera womwe amafunikira kuti agwire ntchito zawo. Ndi malire awa, kuthekera kwa mapulogalamu ogwiritsira ntchito ndi ma daemon adongosolo kuvulaza ngati kusokonezedwa (mwachitsanzo, ndi kusefukira kwa bafa kapena kusasinthika) kumachepetsedwa kapena kuthetsedwa. Njira yoletsa iyi imagwira ntchito mosadalira njira zachikhalidwe zoyendetsera Linux. Ilibe lingaliro la superuser "root" ndipo samagawana zofooka zodziwika bwino zamakina achitetezo a Linux (mwachitsanzo, kudalira setuid/setgid binaries).
Chitetezo cha dongosolo la Linux losasinthidwa zimatengera kulondola kwa kernel, ntchito zonse zamwayi, ndi masinthidwe ake aliwonse. Vuto lililonse mwazinthu izi likhoza kupangitsa kuti dongosolo lonse liwonongeke. Mosiyana ndi izi, chitetezo cha makina osinthidwa kutengera chitetezo cha Linux kernel chimadalira makamaka kulondola kwa kernel ndi kasinthidwe kake ka chitetezo. Ngakhale kulondola kwa pulogalamu kapena zovuta za kasinthidwe zitha kuloleza kusokoneza pang'ono kwa mapulogalamu amunthu aliyense ndi ma daemoni adongosolo, siziyika chiwopsezo chachitetezo ku mapulogalamu ena ogwiritsa ntchito ndi ma daemoni adongosolo kapena chitetezo chadongosolo lonse. - Ndi yabwino kwa chiyani?
Zatsopano za Linux zokhala ndi chitetezo chokhazikika zidapangidwa kuti zitsimikizire kulekanitsa zidziwitso kutengera chinsinsi komanso kukhulupirika. Amapangidwa kuti alepheretse njira zowerengera deta ndi mapulogalamu, kusokoneza deta ndi mapulogalamu, kudutsa njira zotetezera zogwiritsira ntchito, kuchita mapulogalamu osadalirika, kapena kusokoneza njira zina zosemphana ndi ndondomeko zachitetezo. Zimathandizanso kuchepetsa kuwonongeka komwe kungabwere chifukwa cha pulogalamu yaumbanda kapena pulogalamu yaumbanda. Ayeneranso kukhala othandiza powonetsetsa kuti ogwiritsa ntchito omwe ali ndi zilolezo zosiyana zachitetezo atha kugwiritsa ntchito njira yomweyo kuti apeze mitundu yosiyanasiyana yazidziwitso ndi zofunikira zosiyanasiyana zachitetezo popanda kuphwanya zofunikirazo. - Kodi ndingapeze bwanji kope?
Zogawa zambiri za Linux zimaphatikizanso chithandizo cha SELinux, mwina chomangidwa ngati chokhazikika kapena ngati phukusi losankha. Nambala yayikulu ya SELinux userland ikupezeka pa . Ogwiritsa ntchito nthawi zambiri amayenera kugwiritsa ntchito mapaketi omwe amaperekedwa pogawa. - Ndi chiyani chomwe mwatulutsa?
Kutulutsidwa kwa NSA SELinux kumaphatikizapo chinsinsi cha SELinux userland code. Thandizo la SELinux likuphatikizidwa kale mu Linux 2.6 kernel, yomwe ikupezeka pa kernel.org. Mfundo yaikulu ya SELinux userland code imakhala ndi laibulale yogwiritsira ntchito ndondomeko zamabina (libsepol), wolemba ndondomeko (checkpolicy), laibulale ya ntchito zachitetezo (libselinux), laibulale ya zida zoyendetsera ndondomeko (libsemanage), ndi zofunikira zingapo zokhudzana ndi ndondomeko ( ndondomeko zoyambira).
Kuphatikiza pa kernel yothandizidwa ndi SELinux ndi code yoyambira ya ogwiritsa ntchito, mudzafunika ndondomeko ndi ma phukusi ena a SELinux-patched userspace kuti mugwiritse ntchito SELinux. Ndondomekoyi ingapezeke kuchokera . - Kodi ndingathe kukhazikitsa Linux Yowuma pa Linux yomwe ilipo?
Inde, mutha kukhazikitsa zosintha za SELinux zokha pa Linux yomwe ilipo, kapena mutha kukhazikitsa kugawa kwa Linux komwe kumaphatikizapo thandizo la SELinux. SELinux imakhala ndi kernel ya Linux yokhala ndi chithandizo cha SELinux, malo oyambira a library ndi zofunikira, ma phukusi ena osinthidwa, ndi kasinthidwe ka mfundo. Kuti muyike pa Linux yomwe ilipo yomwe ilibe thandizo la SELinux, muyenera kutha kupanga pulogalamuyo komanso kukhala ndi phukusi lina lofunikira. Ngati kugawa kwanu kwa Linux kumaphatikizapo thandizo la SELinux, simuyenera kupanga kapena kukhazikitsa kutulutsidwa kwa NSA kwa SELinux. - Kodi Security Enhanced Linux imagwirizana bwanji ndi Linux yosasinthidwa?
Security Enhanced Linux imapereka kuyanjana kwa binary ndi mapulogalamu omwe alipo a Linux komanso ma module a Linux kernel, koma ma module a kernel angafunike kusinthidwa kuti agwirizane bwino ndi SELinux. Magulu awiriwa a kuyanjana akukambidwa mwatsatanetsatane pansipa:- Kugwiritsa Ntchito
SELinux imapereka kuyanjana kwa binary ndi mapulogalamu omwe alipo. Tawonjezera zida za kernel kuti ziphatikizepo zachitetezo chatsopano ndikuwonjezera mafoni atsopano a API achitetezo. Komabe, sitinasinthe mawonekedwe a data omwe amawonekera kapena kusintha mawonekedwe a mafoni aliwonse omwe alipo kale, kotero kuti mapulogalamu omwe alipo amatha kugwira ntchito popanda kusinthidwa ngati ndondomeko yachitetezo iwalola kuti azigwira ntchito. - Kugwirizana kwa Kernel Module
Poyambirira, SELinux idapereka kuyanjana kwachilengedwe kokha kwa ma module a kernel omwe analipo; kunali kofunikira kukonzanso ma module oterowo motsutsana ndi mitu ya kernel yosinthidwa kuti mutenge magawo atsopano otetezedwa omwe adawonjezedwa kuzinthu za data za kernel. Popeza LSM ndi SELinux tsopano zaphatikizidwa mu kernel yayikulu ya Linux 2.6, SELinux tsopano imapereka kuyanjana kwa binary ndi ma module omwe alipo. Komabe, ma module a kernel sangagwirizane bwino ndi SELinux popanda kusinthidwa. Mwachitsanzo, ngati kernel module igawa mwachindunji ndikuyika chinthu popanda kugwiritsa ntchito zoyambira zoyambira, ndiye kuti chinthu cha kernel sichingakhale ndi chidziwitso choyenera chachitetezo. Ma module ena a kernel angakhalenso opanda zowongolera zoyenera pa ntchito zawo; Kuyimba kulikonse komwe kulipo ku ntchito za kernel kapena ntchito za zilolezo kudzayambitsanso cheke cha chilolezo cha SELinux, koma zowongolera zambiri kapena zowonjezera zitha kufunikira kuti mukhazikitse mfundo za MAC.
Linux yowonjezera chitetezo sayenera kuyambitsa mavuto osagwirizana ndi machitidwe a Linux wamba malinga ngati ntchito zonse zofunika zikuloledwa ndi kasinthidwe ka chitetezo.
- Kugwiritsa Ntchito
- Kodi zolinga za chitsanzo cha kasinthidwe ka chitetezo ndi chiyani?
Pamwambamwamba, cholinga chake ndi kusonyeza kusinthasintha ndi chitetezo cha maulamuliro ovomerezeka ovomerezeka ndi kupereka njira yosavuta yogwirira ntchito ndi kusintha kochepa kwa mapulogalamu. Pansi pake, ndondomeko ili ndi zolinga zingapo zomwe zafotokozedwa muzolemba za ndondomeko. Zolinga izi zikuphatikiza kuwongolera kupezeka kwa data yaiwisi, kuteteza kukhulupirika kwa kernel, pulogalamu yamapulogalamu, zidziwitso zamasinthidwe adongosolo ndi zolemba zamakina, kuchepetsa kuwonongeka komwe kungabwere chifukwa chogwiritsa ntchito chiwopsezo panjira yomwe imafunikira mwayi, kuteteza njira zamwayi kuti zisamachite zoyipa. khodi, kuteteza udindo wa oyang'anira ndi domeni kuti zisalowe popanda kutsimikizika kwa wogwiritsa ntchito, kuletsa njira zanthawi zonse za ogwiritsa ntchito kuti zisokoneze machitidwe adongosolo kapena ma admin, komanso kuteteza ogwiritsa ntchito ndi ma admin kuti asagwiritse ntchito msakatuli wawo pogwiritsa ntchito nambala yoyipa ya foni yam'manja. - Chifukwa chiyani Linux idasankhidwa kukhala nsanja yoyambira?
Linux idasankhidwa kukhala nsanja yoyambira kukhazikitsidwa kwa ntchitoyi chifukwa chakukula bwino komanso chitukuko chotseguka. Linux imapereka mpata wabwino kwambiri wowonetsa kuti izi zitha kukhala zopambana pamakina ogwiritsira ntchito komanso, nthawi yomweyo, zimathandizira pachitetezo cha machitidwe omwe amagwiritsidwa ntchito kwambiri. Pulatifomu ya Linux imaperekanso mwayi wabwino kwambiri kuti ntchitoyi ipeze chiwongolero chambiri chotheka ndipo itha kukhala maziko a kafukufuku wowonjezera wachitetezo ndi ena okonda. - N’chifukwa chiyani munagwira ntchito imeneyi?
National Security Agency ili ndi udindo wofufuza ndi chitukuko chapamwamba cha matekinoloje ofunikira kuti NSA ipereke mayankho achitetezo pazidziwitso, zogulitsa, ndi ntchito zachidziwitso chofunikira kwambiri pachitetezo cha dziko la US.
Kupanga njira yogwirira ntchito, yotetezeka kumakhalabe vuto lalikulu lofufuza. Cholinga chathu ndi kupanga zomanga bwino zomwe zimapereka chithandizo chofunikira chachitetezo, kuyendetsa mapulogalamu m'njira yowonekera bwino kwa wogwiritsa ntchito, komanso yokopa kwa ogulitsa. Tikukhulupirira kuti gawo lofunikira pakukwaniritsa cholingachi ndikuwonetsa momwe njira zowongolera zolumikizira zogwiritsidwira ntchito zingaphatikizidwe bwino munjira yoyendetsera ntchito. - Kodi izi zikugwirizana bwanji ndi kafukufuku wakale wa NSA OS?
Ofufuza ku NSA's National Information Assurance Research Laboratory and Secure Computing Corporation (SCC) apanga njira zowongolera zolowera zamphamvu komanso zosinthika motengera Type Enforcement, njira yomwe idapangidwa koyamba panjira ya LOCK. NSA ndi SCC apanga zomanga ziwiri za Mach: DTMach ndi DTOS (). NSA ndi SCC ndiye adagwira ntchito ndi gulu lofufuza la Flux ku Yunivesite ya Utah kuti azitha kuyika zomanga ku kachitidwe ka kafukufuku wa Fluke. Panthawi yakusamukaku, zomangazo zidakonzedwanso kuti zithandizire bwino mfundo zachitetezo champhamvu. Zomangamanga zabwinozi zimatchedwa Flask (). Tsopano NSA yaphatikiza kapangidwe ka Flask mu kachitidwe ka Linux kuti abweretse ukadaulo ku gulu lalikulu la opanga ndi ogwiritsa ntchito. - Kodi Linux yowonjezera chitetezo ndi njira yodalirika yogwiritsira ntchito?
Mawu akuti "Trusted Operating System" nthawi zambiri amatanthauza makina ogwiritsira ntchito omwe amapereka chithandizo chokwanira chamagulu angapo achitetezo ndi umboni wamalingaliro kuti akwaniritse zofunikira za boma. Security-Enhanced Linux imaphatikizapo malingaliro othandiza kuchokera kumakinawa, koma imayang'ana pakulimbikitsa kuwongolera mwayi. Cholinga choyamba chokhazikitsa Linux yowonjezera chitetezo chinali kupanga ntchito zothandiza zomwe zimapereka chitetezo chowoneka bwino m'malo osiyanasiyana enieni kuti asonyeze luso lamakono. SELinux palokha si njira yodalirika yogwiritsira ntchito, koma imapereka gawo lofunikira lachitetezo - kukakamiza kuwongolera mwayi - kofunikira ndi makina odalirika ogwiritsira ntchito. SELinux yaphatikizidwa mu magawo a Linux omwe adavotera malinga ndi Mbiri Yotetezedwa Yachitetezo. Zambiri zazinthu zoyesedwa ndi zotsimikiziridwa zitha kupezeka pa . - Kodi iye watetezedwadi?
Lingaliro la dongosolo lotetezedwa limaphatikizapo zinthu zambiri (mwachitsanzo, chitetezo chathupi, chitetezo cha ogwira ntchito, ndi zina), ndi Linux yokhala ndi maadiresi otetezedwa omwe ali ndi magawo ochepa kwambiri a izi (ndiko kuti, kuwongolera kolowera mumayendedwe opangira) . Mwa kuyankhula kwina, "dongosolo lotetezedwa" limatanthauza chitetezo chokwanira kuti chiteteze chidziwitso china m'dziko lenileni kuchokera kwa mdani weniweni yemwe mwiniwake ndi / kapena wogwiritsa ntchito chidziwitsocho akuchenjezedwa. Security Enhanced Linux idapangidwa kuti iwonetse zowongolera zomwe zimafunikira pamakina amakono monga Linux, motero sizingakwaniritse tanthauzo lililonse losangalatsa la dongosolo lotetezedwa palokha. Tikukhulupirira kuti ukadaulo womwe ukuwonetsedwa mu Linux yolimbikitsa chitetezo udzakhala wothandiza kwa anthu omwe amamanga makina otetezeka. - Kodi mwachita chiyani kuti muwonjezere chitsimikizo?
Cholinga cha polojekitiyi chinali kuwonjezera maulamuliro okakamiza ndi kusintha kochepa ku Linux. Cholinga chomalizachi chimachepetsa kwambiri zomwe zingatheke kuti zitsimikizidwe, choncho sipanakhalepo ntchito yomwe ikufuna kukonza chitsimikizo cha Linux. Kumbali inayi, zosinthazi zimakhazikika pa ntchito yam'mbuyomu yopangira zomangamanga zotsimikizika kwambiri, ndipo zambiri mwamapangidwewa zimaperekedwa ku Linux ndi chitetezo chokhazikika. - Kodi CCEVS idzayesa Linux ndi chitetezo chowonjezereka?
Security-Enhanced Linux yokha siinapangidwe kuti ikwaniritse zonse zachitetezo zomwe zimaperekedwa ndi mbiri yachitetezo. Ngakhale zingatheke kuwunika momwe ntchito yake ikugwiritsidwira ntchito panopa, tikukhulupirira kuti kuwunika koteroko kungakhale kocheperako. Komabe, tagwira ntchito ndi ena kuti tiphatikize ukadaulo uwu pamagawidwe a Linux omwe adawunikidwa ndikugawa komwe kukuwunikidwa. Zambiri pazinthu zoyesedwa ndi zotsimikiziridwa zitha kupezeka pa . - Kodi mwayeserapo kukonza zofooka zilizonse?
Ayi, sitinayang'ane kapena kupeza zofooka zilizonse panthawi ya ntchito yathu. Tangochita zochepa chabe kuti tiwonjezere njira zathu zatsopano. - Kodi dongosololi ndilololedwa kugwiritsidwa ntchito ndi boma?
Linux yowonjezera chitetezo ilibe chilolezo chapadera kapena chowonjezera kuti chigwiritsidwe ntchito ndi boma pamtundu wina uliwonse wa Linux. - Kodi izi zikusiyana bwanji ndi zochitika zina?
Security-Enhanced Linux ili ndi zomangidwe zomveka bwino zowongolera zowongolera, zomwe zatsimikiziridwa moyesera pogwiritsa ntchito ma prototype angapo (DTMach, DTOS, Flask). Maphunziro atsatanetsatane apangidwa pa luso la zomangamanga kuthandizira ndondomeko zambiri zachitetezo ndipo akupezeka mu и .
Zomangamangazi zimapereka chiwongolero chabwino pazambiri zambiri za kernel ndi ntchito zomwe sizimayendetsedwa ndi machitidwe ena. Zina mwazosiyanitsa za dongosolo la Linux lomwe lili ndi chitetezo chokhazikika ndi:- Kulekanitsa koyera kwa ndondomeko ndi ufulu wofunsira
- Zofotokozedwa bwino za ndondomeko
- Kudziyimira pawokha kuchokera ku ndondomeko ndi zilankhulo zapadera
- Kudziyimira pawokha kwa mawonekedwe ndi zomwe zili mkati
- Patulani zilembo ndi maulamuliro a zinthu za kernel ndi ntchito
- Kusunga zisankho zofikira kuti zitheke
- Thandizo la kusintha kwa ndondomeko
- Kuwongolera pakuyambitsa ndondomeko ndi cholowa cha pulogalamu ndi kukhazikitsa
- Sinthani machitidwe a mafayilo, maulalo, mafayilo ndi mafotokozedwe otsegula
- Kuwongolera ma sockets, mauthenga ndi ma network
- Kuwongolera kugwiritsa ntchito "Mwayi"
- Kodi zoletsa ziphaso za dongosololi ndi zotani?
Nambala yonse yoyambira idapezeka patsamba , kugawidwa pansi pa mawu ofanana ndi code source code. Mwachitsanzo, zigamba za Linux kernel ndi zigamba zazinthu zambiri zomwe zilipo pano zimatulutsidwa motsatira mfundo za . - Kodi pali zowongolera kunja?
Linux yokhala ndi Chitetezo Chowonjezera ilibe zowongolera zotumizira kunja poyerekeza ndi mtundu wina uliwonse wa Linux. - Kodi NSA ikukonzekera kugwiritsa ntchito kunyumba?
Pazifukwa zodziwikiratu, NSA sinenapo kanthu pakugwiritsa ntchito ntchito. - Kodi Statement of Assurance by Secure Computing Corporation ya pa July 26, 2002 imasintha momwe NSA imayendera kuti SELinux inaperekedwa pansi pa GNU General Public License?
Udindo wa NSA sunasinthe. NSA ikupitiriza kukhulupirira kuti mfundo ndi zikhalidwe za GNU General Public License zimayendetsa kagwiritsidwe ntchito, kukopera, kugawa, ndi kusinthidwa kwa SELinux. Cm. . - Kodi NSA imathandizira pulogalamu yotseguka?
Njira zoyendetsera chitetezo cha mapulogalamu a NSA zimakhudzana ndi mapulogalamu a eni ake komanso otsegula, ndipo tagwiritsa ntchito bwino anthu omwe ali ndi mwayi komanso wotsegula pochita kafukufuku wathu. Ntchito ya NSA yopititsa patsogolo chitetezo cha mapulogalamu imalimbikitsidwa ndi lingaliro limodzi losavuta: kugwiritsa ntchito chuma chathu kuti tipatse makasitomala a NSA njira zabwino kwambiri zotetezera pazogulitsa zomwe zimagwiritsidwa ntchito kwambiri. Cholinga cha pulogalamu ya kafukufuku wa NSA ndikupanga kupita patsogolo kwaukadaulo komwe kungagawidwe ndi gulu lachitukuko cha mapulogalamu kudzera munjira zosiyanasiyana zoperekera. NSA siyivomereza kapena kulimbikitsa pulogalamu iliyonse kapena mtundu wabizinesi. M'malo mwake, NSA ikulimbikitsa chitetezo. - Kodi NSA imathandizira Linux?
Monga tafotokozera pamwambapa, NSA sichirikiza kapena kulimbikitsa pulogalamu iliyonse kapena nsanja; NSA imangothandiza kukonza chitetezo. Zomangamanga za Flask zomwe zawonetsedwa pakukhazikitsa kwa SELinux zidatumizidwa kuzinthu zina zingapo zogwirira ntchito, kuphatikiza Solaris, FreeBSD, ndi Darwin, zojambulidwa ku Xen hypervisor, ndikuzigwiritsa ntchito ngati X Window System, GConf, D-BUS, ndi PostgreSQL. Malingaliro omanga mabotolo amagwiritsidwa ntchito kwambiri pamakina ndi malo osiyanasiyana.
Mgwirizano
- Kodi timakonzekera bwanji kuyanjana ndi gulu la Linux?
Ife tiri , yomwe ikhala njira yathu yoyamba yofalitsira zambiri za Linux ndi chitetezo chokhazikika. Ngati mukufuna Linux yopititsa patsogolo chitetezo, tikukulimbikitsani kuti mulowe nawo mndandanda wamakalata okonza, onaninso kachidindo, ndikupereka ndemanga zanu (kapena code). Kuti mulowe nawo mndandanda wamakalata opanga, onani . - Ndani angathandize?
SELinux tsopano imathandizidwa ndikupangidwa ndi gulu lotseguka la Linux software. - Kodi NSA ikupereka ndalama pa ntchito yotsatila?
NSA pakali pano ikulingalira malingaliro owonjezera ntchito. - Ndi chithandizo chanji chomwe chilipo?
Tikufuna kuthetsa mavuto kudzera pamndandanda wamakalata [imelo ndiotetezedwa], koma sitingathe kuyankha mafunso onse okhudzana ndi tsamba linalake. - Ndani anathandiza? Kodi iwo anachita chiyani?
Chitsanzo cha Linux cholimbikitsa chitetezo chidapangidwa ndi NSA ndi ochita kafukufuku NAI Labs, Secure Computing Corporation (SCC), ndi MITER Corporation. Pambuyo pa kutulutsidwa koyamba kwa anthu, zida zina zambiri zidatsatira. . - Kodi ndingapeze bwanji zambiri?
Tikukulimbikitsani kuti muyende pamasamba athu, kuwerenga zolemba ndi zolemba zakale, ndikutenga nawo mbali pamndandanda wathu wamakalata [imelo ndiotetezedwa]
Kodi zomasulirazo mukuona kuti n'zothandiza? Lembani ndemanga!
Source: www.habr.com