{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft a propus un sistem de gestionare a accesului IPE pentru nucleul Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania a propus \u00een discu\u021bie pe lista de distribu\u021bie a dezvoltatorilor nucleului Linux codul modulului LSM cu implementarea mecanismului IPE (Integrity Policy Enforcement), care extinde sistemele existente de management de acces mandatar. \u00cen loc de a se lega de etichete \u0219i c\u0103i, \u00een IPE, decizia de a permite sau a interzice o opera\u021biune se bazeaz\u0103 pe propriet\u0103\u021bile permanente ale componentelor sistemului cu care se efectueaz\u0103 opera\u021biunea. Modulul permite definirea unei politici generale de asigurare a integrit\u0103\u021bii pentru \u00eentreaga sistem, indic\u00e2nd ce opera\u021biuni sunt acceptabile \u0219i cum ar trebui s\u0103 se verifice autenticitatea componentelor. <\/p>\n

IPE vizeaz\u0103 crearea de sisteme complet verificabile, a c\u0103ror integritate este confirmat\u0103 de la bootloader-ul ini\u021bial \u0219i nucleu p\u00e2n\u0103 la fi\u0219ierele executabile finale, configur\u0103ri \u0219i fi\u0219iere \u00eenc\u0103rcate. De exemplu, utiliz\u00e2nd IPE, se pot specifica care fi\u0219iere executabile sunt permise s\u0103 fie lansate \u00een func\u021bie de verificarea conformit\u0103\u021bii lor cu versiunea de referin\u021b\u0103 folosind hash-uri criptografice furnizate de sistemul dm-verity. \u00cen caz de modificare sau \u00eenlocuire a fi\u0219ierului, IPE poate bloca opera\u021biunea sau \u00eenregistra faptul \u00eenc\u0103lc\u0103rii integrit\u0103\u021bii. <\/p>\n

Mecanismul propus poate fi aplicat \u00een firmware-urile pentru dispozitive \u00eencorporate, \u00een care tot software-ul \u0219i set\u0103rile sunt special compilate \u0219i furnizate de proprietar, de exemplu, \u00een centrele de date Microsoft IPE, acesta este utilizat \u00een echipamentele pentru firewall-uri. Spre deosebire de alte sisteme de verificare a integrit\u0103\u021bii, cum ar fi IMA, IPE se distinge prin independen\u021ba fa\u021b\u0103 de metadatele din FS - toate propriet\u0103\u021bile care determin\u0103 acceptabilitatea opera\u021biunilor sunt stocate direct \u00een nucleu. <\/p>\n

Regulile sunt definite \u00eentr-o form\u0103 text \u0219i folosesc seturi de cheie-valoare. \u00cent\u00e2lnim cheia \u201eop\u201d, care define\u0219te opera\u021bia la care se aplic\u0103 regula (de exemplu, op=EXECUTE va fi activat la \u00eencercarea de execu\u021bie) \u0219i \u201eaction\u201d, care define\u0219te ac\u021biunea (de exemplu, \u201eaction=DENY\u201d pentru blocare). Regulile sunt legate de propriet\u0103\u021bi furnizate de subsisteme externe, cum ar fi dm-verity \u0219i fs-verity. <\/p>\n

De exemplu, regulile op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY vor permite doar \u00eenc\u0103rcarea de pe o parti\u021bie verificat\u0103, vor interzice executarea fi\u0219ierelor de pe parti\u021biile care nu au semn\u0103turi \u00een dm-verity, precum \u0219i vor interzice selectiv executarea fi\u0219ierului cu hash-ul \u201e401fce\u20260dec146938\u201d. <\/p>\n

Setul ini\u021bial de reguli de \u00eenc\u0103rcare este definit prin configura\u021bia SECURITY_IPE_BOOT_POLICY \u0219i este inclus \u00een construc\u021bia nucleului, iar celelalte reguli sunt ad\u0103ugate dup\u0103 cum este necesar prin fi\u0219ierul \/sys\/kernel\/security\/ipe\/new_policy. Regulele transmise sunt criptate folosind certificatul definit \u00een SYSTEM_TRUSTED_KEYRING. <\/p>\n

Pe sistemele de uz general, se recomand\u0103 utilizarea IPE \u00een combina\u021bie cu mecanismul DIGLIM, dezvoltat de compania Huawei. DIGLIM este implementat prin eBPF \u0219i permite implementarea u\u0219oar\u0103 a controlului integrit\u0103\u021bii la nivelul fi\u0219ierelor individuale \u00een distribu\u021bii conven\u021bionale, f\u0103r\u0103 a necesita reprocesarea lor (se prezint\u0103 ca o variant\u0103 de Secure Boot, care func\u021bioneaz\u0103 la nivel aplica\u021bie). Esen\u021ba DIGLIM const\u0103 \u00een men\u021binerea unui pool de hash-uri de verificare pentru fi\u0219iere \u0219i metadate \u0219i oferirea accesului la fi\u0219ierele executabile doar dac\u0103 hash-ul acestora este prezent \u00een pool. Lista hash-urilor poate fi ob\u021binut\u0103 de la managerul de pachete RPM sau generat\u0103 manual de utilizator.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043c\u0435\u0442\u043a\u0430\u043c \u0438 \u043f\u0443\u0442\u044f\u043c \u0432 IPE \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438\u043b\u0438 \u0437\u0430\u043f\u0440\u0435\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f. \u041c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u0431\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113980","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft a propus un sistem de gestionare a accesului IPE pentru nucleul Linux | ProHoster","description":"Compania a pus \u00een discu\u021bie pe lista de coresponden\u021b\u0103 a dezvoltatorilor nucleului Linux codul modulului LSM cu implementarea mecanismului IPE (Integrity Policy Enforcement), care extinde sistemele existente de control al accesului mandat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IPE \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-29T16:25:59+00:00","article:modified_time":"2024-02-29T16:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=113980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113980\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=113980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=113980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=113980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}