{"id":38554,"date":"2019-10-31T22:24:30","date_gmt":"2019-10-31T19:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra\/"},"modified":"2019-10-31T22:24:30","modified_gmt":"2019-10-31T19:24:30","slug":"v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","title":{"rendered":"Patch-uri pentru limitarea accesului root la nucleul Linux 5.4 au fost acceptate.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linus Torvalds a acceptat<\/a><\/noindex> \u00een compunerea viitorului release al nucleului Linux 5.4 un set de patch-uri «lockdown<\/a><\/noindex>\u201e propus<\/a><\/noindex>\tde David Howells (care lucreaz\u0103 la Red Hat) \u0219i Matthew Garrett (Matthew Garrett<\/a><\/noindex>, care func\u021bioneaz\u0103 la Google) pentru a restric\u021biona accesul utilizatorului root la nucleu. Func\u021bionalitatea asociat\u0103 cu «lockdown» este scoas\u0103 \u00eentr-un modul LSM op\u021bional care poate fi \u00eenc\u0103rcat (Linux Security Module<\/a><\/noindex>), care stabile\u0219te o barier\u0103 \u00eentre UID 0 \u0219i nucleu, limit\u00e2nd anumite func\u021bionalit\u0103\u021bi de baz\u0103.<\/p>\n

Dac\u0103 un atacator reu\u0219e\u0219te s\u0103 execute cod cu drepturi de root \u00een urma unei atacuri, acesta poate rula codul s\u0103u \u0219i la nivelul nucleului, de exemplu, prin \u00eenlocuirea nucleului folosind kexec sau prin citirea\/scrierea memoriei prin \/dev\/kmem. Cel mai evident rezultat al unei astfel de activit\u0103\u021bi poate fi o ocolire<\/a><\/noindex> a UEFI Secure Boot sau extragerea de date confiden\u021biale stocate la nivelul nucleului.<\/p>\n

Ini\u021bial, func\u021biile de limitare a root-ului s-au dezvoltat \u00een contextul sporirii securit\u0103\u021bii boot-ului verificat, iar distribu\u021biile au folosit de mult timp patch-uri externe pentru a bloca ocolirea UEFI Secure Boot. Cu toate acestea, aceste limit\u0103ri nu au fost incluse \u00een nucleul principal din cauza disputelor<\/a><\/noindex> \u00een implementarea lor \u0219i temerile privind posibila afectare a func\u021bion\u0103rii sistemelor existente. Modulul «lockdown» a inclus patch-urile deja utilizate \u00een distribu\u021bii, care au fost reg\u00e2ndite sub forma unui subsistem separat, nez\u0103l\u021buit de UEFI Secure Boot. <\/p>\n

\u00cen modul lockdown, accesul la \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, modul de depanare kprobes, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), anumite interfe\u021be ACPI \u0219i registrele MSR ale CPU-ului este restric\u021bionat, apelurile kexec_file \u0219i kexec_load sunt blocate, trecerea \u00een modul de somn este interzis\u0103, utilizarea DMA pentru dispozitive PCI este limitat\u0103, importul codului ACPI din variabile EFI este interzis,
\nmanipul\u0103rile cu porturi de intrare\/ie\u0219ire nu sunt permise, inclusiv modificarea num\u0103rului de \u00eentrerupere \u0219i a portului de intrare\/ie\u0219ire pentru portul serial. <\/p>\n

\u00cen mod implicit, modulul lockdown nu este activ, se compileaz\u0103 prin specificarea op\u021biunii SECURITY_LOCKDOWN_LSM \u00een kconfig \u0219i se activeaz\u0103 prin parametrul nucleului «lockdown=», fi\u0219ierul de control «\/sys\/kernel\/security\/lockdown» sau op\u021biunile de compilare LOCK_DOWN_KERNEL_FORCE_*<\/a><\/noindex>, care pot accepta valorile «integrity» \u0219i «confidentiality». \u00cen primul caz, se blocheaz\u0103 posibilit\u0103\u021bile de a face modific\u0103ri \u00een nucleul activ din spa\u021biul utilizatorului, iar \u00een cel de-al doilea caz, pe l\u00e2ng\u0103 aceasta, se dezactiveaz\u0103 func\u021bionalitatea care ar putea fi folosit\u0103 pentru extragerea informa\u021biilor confiden\u021biale din nucleu.<\/p>\n

Este important de men\u021bionat c\u0103 lockdown-ul restric\u021bioneaz\u0103 doar capacit\u0103\u021bile standard de acces la nucleu, dar nu protejeaz\u0103 \u00eempotriva modific\u0103rilor rezultate din exploatarea vulnerabilit\u0103\u021bilor. Pentru a bloca modific\u0103rile \u00een nucleul \u00een execu\u021bie \u00een urma utiliz\u0103rii exploit-urilor, proiectul Openwall se dezvolt\u0103<\/a><\/noindex> modul separat LKRG<\/a><\/noindex> (Linux Kernel Runtime Guard).<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044f\u0434\u0440\u0430 Linux 5.4 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 «lockdown«, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0414\u044d\u0432\u0438\u0434\u043e\u043c \u0425\u043e\u0443\u044d\u043b\u043b\u0441\u043e\u043c (David Howells, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Red Hat) \u0438 \u041c\u044d\u0442\u044c\u044e \u0413\u0430\u0440\u0440\u0435\u0442\u043e\u043c (Matthew Garrett, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Google) \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443. \u0421\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 «lockdown» \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 LSM-\u043c\u043e\u0434\u0443\u043b\u044c (Linux Security Module), \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0431\u0430\u0440\u044c\u0435\u0440 \u043c\u0435\u0436\u0434\u0443 UID 0 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Patch-uri pentru restric\u021bionarea accesului root la interiorul nucleului au fost acceptate \u00een nucleul Linux 5.4 | ProHoster","description":"Linus Torvalds a acceptat \u00een viitoarea versiune.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u043e Linux 5.4 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 root \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:30+00:00","article:modified_time":"2019-10-31T19:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:07:39","updated":"2026-01-23 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=38554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=38554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=38554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=38554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}