{"id":29880,"date":"2019-10-31T21:32:27","date_gmt":"2019-10-31T18:32:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\/"},"modified":"2019-10-31T21:32:27","modified_gmt":"2019-10-31T18:32:27","slug":"milliony-binarnikov-spustya-kak-ukreplyalsya-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","title":{"rendered":"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/bf51e5698530d4a6a44ff97f542a2a87.png\" style=\"display:block;margin: 0 auto;\" \/><b>TL;DR<\/b>. V tomto \u010dl\u00e1nku presk\u00famame ochrann\u00e9 sch\u00e9my (hardening schemes), ktor\u00e9 funguj\u00fa priamo v piatich popul\u00e1rnych distrib\u00faci\u00e1ch Linuxu. Pre ka\u017ed\u00fa sme vzali predvolen\u00fa konfigur\u00e1ciu jadra, nain\u0161talovali v\u0161etky bal\u00edky a analyzovali sch\u00e9my ochrany vo vnoren\u00fdch bin\u00e1rnych s\u00faboroch. Zoh\u013ead\u0148ujeme distrib\u00facie OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 a 7, ako aj Ubuntu 14.04, 12.04 a 18.04 LTS. <\/p>\n<p>V\u00fdsledky potvrdzuj\u00fa, \u017ee aj z\u00e1kladn\u00e9 sch\u00e9my, ako s\u00fa z\u00e1sobn\u00edkov\u00e9 kan\u00e1riky a k\u00f3d nez\u00e1visl\u00fd od poz\u00edcie, e\u0161te nie s\u00fa vo v\u0161etk\u00fdch pou\u017e\u00edvan\u00e9. Situ\u00e1cia je e\u0161te hor\u0161ia pri kompil\u00e1toroch, pokia\u013e ide o ochranu pred zranite\u013enos\u0165ami, ako s\u00fa kol\u00edzie z\u00e1sobn\u00edka (stack clash), ktor\u00e9 sa dostali do centra pozornosti v janu\u00e1ri po zverejnen\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">inform\u00e1ci\u00ed o zranite\u013enostiach v systemd<\/a><\/noindex>. Ale nie je v\u0161etko bezn\u00e1dejne. Vo v\u00fdznamnej \u010dasti bin\u00e1rnych s\u00faborov s\u00fa implementovan\u00e9 z\u00e1kladn\u00e9 met\u00f3dy ochrany a ich po\u010det rastie z verzie na verziu. <\/p>\n<p>Kontrola uk\u00e1zala, \u017ee najv\u00e4\u010d\u0161\u00ed po\u010det met\u00f3d ochrany je implementovan\u00fd v Ubuntu 18.04 na \u00farovni OS a aplik\u00e1ci\u00ed, nasleduje Debian 9. Na druhej strane, v OpenSUSE 12.4, CentOS 7 a RHEL 7 s\u00fa tie\u017e implementovan\u00e9 z\u00e1kladn\u00e9 sch\u00e9my ochrany, pri\u010dom ochrana pred kol\u00edziou z\u00e1sobn\u00edka je aplikovan\u00e1 e\u0161te \u0161ir\u0161ie pri ove\u013ea hustej\u0161om s\u00fabore bal\u00edkov pod\u013ea predvolen\u00e9ho nastavenia.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>\u00davod<\/h1>\n<p>\nZabezpe\u010di\u0165 vysok\u00fa kvalitu softv\u00e9ru je \u0165a\u017ek\u00e9. Napriek obrovsk\u00e9mu mno\u017estvu pokro\u010dil\u00fdch n\u00e1strojov na statick\u00fa anal\u00fdzu k\u00f3du a dynamick\u00fa anal\u00fdzu po\u010das behu, ako aj v\u00fdznamn\u00e9mu pokroku v v\u00fdvoji kompil\u00e1torov a programovac\u00edch jazykov, modern\u00fd softv\u00e9r st\u00e1le trp\u00ed zranite\u013enos\u0165ami, ktor\u00e9 nepretr\u017eite zneu\u017e\u00edvaj\u00fa \u00fato\u010dn\u00edci. Situ\u00e1cia je e\u0161te hor\u0161ia v ekosyst\u00e9moch, ktor\u00e9 zah\u0155\u0148aj\u00fa zastaran\u00fd k\u00f3d. V tak\u00fdchto pr\u00edpadoch sa nielen\u017ee stret\u00e1vame s ve\u010dn\u00fdm probl\u00e9mom vyh\u013ead\u00e1vania mo\u017en\u00fdch zneu\u017e\u00edvan\u00fdch ch\u00fdb, ale sme aj obmedzen\u00ed pr\u00edsnymi r\u00e1mcami sp\u00e4tnej kompatibility, ktor\u00e9 \u010dasto vy\u017eaduj\u00fa zachova\u0165 obmedzen\u00fd, e\u0161te hor\u0161ie zranite\u013en\u00fd alebo chybov\u00fd k\u00f3d.<\/p>\n<p>Tu prich\u00e1dzaj\u00fa do hry met\u00f3dy ochrany alebo zosilnenia softv\u00e9ru (hardening). Niektor\u00e9 typy ch\u00fdb nem\u00f4\u017eeme zabr\u00e1ni\u0165, ale m\u00f4\u017eeme skomplikova\u0165 \u017eivot \u00fato\u010dn\u00edka a \u010diasto\u010dne vyrie\u0161i\u0165 probl\u00e9m, zabr\u00e1nen\u00edm alebo prek\u00e1\u017ean\u00edm. <i>vyu\u017eit\u00ed<\/i> t\u00fdchto ch\u00fdb. Tak\u00e1to ochrana sa pou\u017e\u00edva vo v\u0161etk\u00fdch modern\u00fdch opera\u010dn\u00fdch syst\u00e9moch, av\u0161ak met\u00f3dy sa v\u00fdrazne l\u00ed\u0161ia zlo\u017eitosti, efekt\u00edvnosti a v\u00fdkonu: od z\u00e1sobn\u00edkov\u00fdch kan\u00e1rikov (stack canaries) a <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Address_space_layout_randomization\">ASLR<\/a><\/noindex> a\u017e po plnohodnotn\u00e9 ochrany <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Control-flow_integrity\">CFI<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Return-oriented_programming\">ROP<\/a><\/noindex>. V tomto \u010dl\u00e1nku sa pozrieme na to, ak\u00e9 met\u00f3dy ochrany s\u00fa aplikovan\u00e9 v najpopul\u00e1rnej\u0161\u00edch distrib\u00faci\u00e1ch Linuxu v predvolenej konfigur\u00e1cii, ako aj na vlastnosti bin\u00e1rnych s\u00faborov distribuovan\u00fdch prostredn\u00edctvom syst\u00e9mov spr\u00e1vy bal\u00edkov ka\u017ed\u00e9ho distrib\u00facie.<\/p>\n<h3>CVE a bezpe\u010dnos\u0165<\/h3>\n<p>\nV\u0161etci sme videli \u010dl\u00e1nky s n\u00e1zvami ako \u201eNajzranite\u013enej\u0161ie aplik\u00e1cie roka\u201c alebo \u201eNajzranite\u013enej\u0161ie opera\u010dn\u00e9 syst\u00e9my\u201c. Zvy\u010dajne tam uv\u00e1dzaj\u00fa \u0161tatistiky t\u00fdkaj\u00face sa celkov\u00e9ho po\u010dtu z\u00e1znamov o zranite\u013enostiach typu <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/\">CVE (Common Vulnerability and Exposures)<\/a><\/noindex>, z\u00edskan\u00e9 z <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/\">N\u00e1rodnej datab\u00e1zy zranite\u013enost\u00ed (NVD)<\/a><\/noindex> od <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nist.gov\/\">NIST<\/a><\/noindex> a \u010fal\u0161\u00edch zdrojov. N\u00e1sledne s\u00fa tieto aplik\u00e1cie alebo OS hodnoten\u00e9 pod\u013ea po\u010dtu CVE. Bohu\u017eia\u013e, aj ke\u010f s\u00fa CVE ve\u013emi u\u017eito\u010dn\u00e9 na sledovanie probl\u00e9mov a informovanie dod\u00e1vate\u013eov a pou\u017e\u00edvate\u013eov, m\u00e1lo toho hovor\u00ed o re\u00e1lnej bezpe\u010dnosti softv\u00e9ru.<\/p>\n<p>Pre pr\u00edklad si vezmime celkov\u00fd po\u010det CVE za posledn\u00e9 \u0161tyri roky pre jadro Linuxu a p\u00e4\u0165 najpopul\u00e1rnej\u0161\u00edch serverov\u00fdch distrib\u00faci\u00ed, konkr\u00e9tne Ubuntu, Debian, Red Hat Enterprise Linux a OpenSUSE.<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/16d74634f010e340aedbce441513e3f8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 1<\/i><\/p>\n<p>\u010co n\u00e1m hovor\u00ed tento graf? Znamen\u00e1 v\u00e4\u010d\u0161\u00ed po\u010det CVE, \u017ee jeden distrib\u00facia je zranite\u013enej\u0161ia ako in\u00e1? Odpove\u010f je nie. Napr\u00edklad v tomto \u010dl\u00e1nku uvid\u00edte, \u017ee v Debiane s\u00fa implementovan\u00e9 pr\u00edsnej\u0161ie ochrann\u00e9 mechanizmy v porovnan\u00ed s OpenSUSE alebo RedHat Linux, a predsa m\u00e1 Debian viac CVE. Tieto v\u0161ak nemusia nevyhnutne znamena\u0165 oslaben\u00fa bezpe\u010dnos\u0165: aj pr\u00edtomnos\u0165 CVE nehovor\u00ed, \u010di je zranite\u013enos\u0165 <i>exploatovate\u013en\u00e1<\/i>. Sk\u00f3re z\u00e1va\u017enosti poskytuje predstavu o tom, ak\u00e1 <i>pravdepodobnos\u0165<\/i> vyu\u017eitia zranite\u013enosti, ale nakoniec exploatovate\u013enos\u0165 z ve\u013ekej \u010dasti z\u00e1vis\u00ed od ochrany pr\u00edtomnej v dotknut\u00fdch syst\u00e9moch, ako aj od zdrojov a schopnost\u00ed \u00fato\u010dn\u00edkov. Navy\u0161e, absencia spr\u00e1v CVE ni\u010d nehovor\u00ed o in\u00fdch <i>nezaregistrovan\u00fdch alebo nezn\u00e1mych<\/i> zranite\u013enost\u00ed. Rozdiel v CVE m\u00f4\u017ee by\u0165 vysvetlen\u00fd nie kvalitou softv\u00e9ru, ale in\u00fdmi faktormi, vr\u00e1tane zdrojov vy\u010dlenen\u00fdch na testovanie alebo ve\u013ekosti pou\u017e\u00edvate\u013eskej z\u00e1kladne. V na\u0161om pr\u00edklade v\u00e4\u010d\u0161\u00ed po\u010det CVE pre Debian m\u00f4\u017ee jednoducho nazna\u010dova\u0165, \u017ee Debian poskytuje viac bal\u00edkov softv\u00e9ru. <\/p>\n<p>Samozrejme, syst\u00e9m CVE poskytuje u\u017eito\u010dn\u00e9 inform\u00e1cie, ktor\u00e9 umo\u017e\u0148uj\u00fa vytv\u00e1ra\u0165 pr\u00edslu\u0161n\u00e9 ochrany. \u010c\u00edm lep\u0161ie rozumieme pr\u00ed\u010din\u00e1m zlyhania programu, t\u00fdm jednoduch\u0161ie je ur\u010di\u0165 mo\u017en\u00e9 sp\u00f4soby exploit\u00e1cie a vyvin\u00fa\u0165 pr\u00edslu\u0161n\u00e9 mechanizmy <i>detekcie a reakcie<\/i>. Na obr.\u00a02 s\u00fa zobrazen\u00e9 kateg\u00f3rie zranite\u013enost\u00ed pre v\u0161etky distrib\u00facie za posledn\u00e9 \u0161tyri roky (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cvedetails.com\/top-50-products.php\">zdroj<\/a><\/noindex>). Hne\u010f je jasn\u00e9, \u017ee v\u00e4\u010d\u0161ina CVE patr\u00ed do nasleduj\u00facich kateg\u00f3ri\u00ed: odmietnutie slu\u017eby (DoS), vykonanie k\u00f3du, prete\u010denie, po\u0161kodenie pam\u00e4te, \u00fanik (exfiltr\u00e1cia) inform\u00e1ci\u00ed a eskal\u00e1cia opr\u00e1vnen\u00ed. Hoci mnoho CVE je zaznamenan\u00fdch nieko\u013ekokr\u00e1t v r\u00f4znych kateg\u00f3ri\u00e1ch, vo v\u0161eobecnosti sa rovnak\u00e9 probl\u00e9my opakuj\u00fa rok \u010do rok. V nasleduj\u00facej \u010dasti \u010dl\u00e1nku zhodnot\u00edme pou\u017eitie r\u00f4znych ochrann\u00fdch sch\u00e9m na zabr\u00e1nenie exploit\u00e1cii uveden\u00fdch zranite\u013enost\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/45948bc64673540cfb3e1774c3247634.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 2<\/i><\/p>\n<h3>\u00dalohy<\/h3>\n<p>\nV tomto \u010dl\u00e1nku sa zam\u00fd\u0161\u013eame odpoveda\u0165 na nasleduj\u00face ot\u00e1zky:<\/p>\n<ul>\n<li>Ak\u00e1 je bezpe\u010dnos\u0165 r\u00f4znych distrib\u00faci\u00ed Linuxu? Ak\u00e9 ochrann\u00e9 mechanizmy existuj\u00fa v jadre a aplik\u00e1ci\u00e1ch pou\u017e\u00edvate\u013esk\u00e9ho priestoru?\n<\/li>\n<li>Ako sa \u010dasom zmenilo prijatie ochrann\u00fdch mechanizmov pre r\u00f4zne distrib\u00facie?\n<\/li>\n<li>Ak\u00e9 s\u00fa priemern\u00e9 z\u00e1vislosti bal\u00edkov a kni\u017en\u00edc pre ka\u017ed\u00fa distrib\u00faciu?\n<\/li>\n<li>Ak\u00e9 ochrany s\u00fa implementovan\u00e9 pre ka\u017ed\u00fd bin\u00e1rny s\u00fabor?<\/li>\n<\/ul>\n<p><\/p>\n<h3>V\u00fdber distrib\u00faci\u00ed<\/h3>\n<p>\nZd\u00e1 sa, \u017ee \u0165a\u017eko sa h\u013ead\u00e1 presn\u00e1 \u0161tatistika o in\u0161tal\u00e1ci\u00e1ch distrib\u00faci\u00ed, preto\u017ee vo v\u00e4\u010d\u0161ine pr\u00edpadov po\u010det stiahnut\u00ed neozna\u010duje po\u010det skuto\u010dn\u00fdch in\u0161tal\u00e1ci\u00ed. Napriek tomu varianty Unix tvoria v\u00e4\u010d\u0161inu serverov\u00fdch syst\u00e9mov (na webov\u00fdch serveroch 69,2%, pod\u013ea <noindex><a rel=\"nofollow\" href=\"https:\/\/w3techs.com\/technologies\/overview\/operating_system\/all\">\u0161tatistiky<\/a><\/noindex> W3techs a in\u00fdch zdrojov), a ich podiel neust\u00e1le rastie. Preto sme sa v na\u0161om v\u00fdskume zamerali na distrib\u00facie, ktor\u00e9 s\u00fa dostupn\u00e9 \u201eout of the box\u201c na platforme <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/\">Google Cloud<\/a><\/noindex>. Konkr\u00e9tne sme si vybrali nasleduj\u00face OS:<\/p>\n<p>Distrib\u00facia\/verzia<br \/>\nJadro<br \/>\nBuild<\/p>\n<p>OpenSUSE 12.4<br \/>\n4.12.14-95.3-default<br \/>\n#1 SMP Wed Dec 5 06:00:48 UTC 2018 (63a8d29)<\/p>\n<p>Debian 9 (stretch)<br \/>\n4.9.0-8-amd64<br \/>\n#1 SMP Debian 4.9.130-2 (2018-10-27)<\/p>\n<p>CentOS 6.10<br \/>\n2.6.32-754.10.1.el6.x86_64<br \/>\n#1 SMP Tue Jan 15 17:07:28 UTC 2019<\/p>\n<p>CentOS 7<br \/>\n3.10.0-957.5.1.el7.x86_64<br \/>\n#1 SMP Fri Feb 1 14:54:57 UTC 2019<\/p>\n<p>Red Hat Enterprise Linux Server 6.10 (Santiago)<br \/>\n2.6.32-754.9.1.el6.x86_64<br \/>\n#1 SMP Wed Nov 21 15:08:21 EST 2018<\/p>\n<p>Red Hat Enterprise Linux Server 7.6 (Maipo)<br \/>\n3.10.0-957.1.3.el7.x86_64<br \/>\n#1 SMP Thu Nov 15 17:36:42 UTC 2018<\/p>\n<p>Ubuntu 14.04 (Trusty Tahr)<br \/>\n4.4.0\u2013140-generic<br \/>\n <br \/>\n#166~14.04.1-Ubuntu SMP Sat Nov 17 01:52:43 UTC 20\u2026<\/p>\n<p>Ubuntu 16.04 (Xenial Xerus)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27~16.04.1-Ubuntu SMP Fri Dec 7 09:59:47 UTC 2018<\/p>\n<p>Ubuntu 18.04 (Bionic Beaver)<br \/>\n4.15.0\u20131026-gcp<br \/>\n#27-Ubuntu SMP Thu Dec 6 18:27:01 UTC 2018<\/p>\n<p><i>Tabu\u013eka 1<\/i> <\/p>\n<h1>Anal\u00fdza<\/h1>\n<p>\nPresk\u00famame predvolen\u00fa konfigur\u00e1ciu jadra a vlastnosti bal\u00edkov dostupn\u00fdch prostredn\u00edctvom spr\u00e1vcu bal\u00edkov ka\u017ed\u00e9ho distrib\u00facie. Takto zva\u017eujeme iba bal\u00edky z predvolen\u00fdch zrkadiel ka\u017ed\u00e9ho distrib\u00facie a ignorujeme bal\u00edky z nestabiln\u00fdch repozit\u00e1rov (napr\u00edklad zrkadl\u00e1 'testing' v Debian) a extern\u00e9 bal\u00edky (napr\u00edklad bal\u00edky Nvidia z predvolen\u00fdch zrkadiel). Okrem toho sa nezameriavame na pou\u017e\u00edvate\u013esk\u00e9 kompil\u00e1cie jadra alebo konfigur\u00e1cie s vy\u0161\u0161ou ochranou.<\/p>\n<h3>Anal\u00fdza konfigur\u00e1cie jadra<\/h3>\n<p>\nNa anal\u00fdzu sme pou\u017eili skript zalo\u017een\u00fd na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/a13xp0p0v\/kconfig-hardened-check\">otvorenom kontrol\u00f3ri kconfig<\/a><\/noindex>. Zoh\u013ead\u0148ujeme predvolen\u00e9 mo\u017enosti ochrany u uveden\u00fdch distrib\u00faci\u00ed a porovn\u00e1vame ich so zoznamom od <noindex><a rel=\"nofollow\" href=\"http:\/\/kernsec.org\/wiki\/index.php\/Kernel_Self_Protection_Project\/Recommended_Settings\">Projektu samoochrany jadra<\/a><\/noindex> (KSPP). Pre ka\u017ed\u00fa konfigur\u00e1ciu tabulka 2 popisuje po\u017eadovan\u00fa nastavenie: ihla je umiestnen\u00e1 pre distrib\u00facie, ktor\u00e9 zodpovedaj\u00fa odpor\u00fa\u010daniam KSSP (vysvetlenie pojmov pozri <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/kernel-configuration-glossary\/\">tu<\/a><\/noindex>; v bud\u00facich \u010dl\u00e1nkoch sa podrobne dozviete, ako sa mnoh\u00e9 z t\u00fdchto met\u00f3d ochrany objavili a ako hackn\u00fa\u0165 syst\u00e9m v ich nepr\u00edtomnosti).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/dx\/oh\/o0\/dxoho0z-lifjcybajszqb-aiirq.png\"><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/b1a42826f4afc78a2b25d158100b2ba4.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/2177579e65e4fe6bb320903756a04b9b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVo v\u0161eobecnosti maj\u00fa nov\u00e9 jadr\u00e1 pr\u00edsnej\u0161ie nastavenia hne\u010f \u201ez krabice\u201c. Napr\u00edklad CentOS 6.10 a RHEL 6.10 na jadre 2.6.32 nemaj\u00fa v\u00e4\u010d\u0161inu kritick\u00fdch funkci\u00ed implementovan\u00fdch v nov\u00fdch jadr\u00e1ch, ako s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Supervisor_Mode_Access_Prevention\">SMAP<\/a><\/noindex>, pr\u00edsne povolenia RWX, n\u00e1hodn\u00e1 adres\u00e1cia alebo ochrana copy2usr. Je d\u00f4le\u017eit\u00e9 poznamena\u0165, \u017ee mnoh\u00e9 z mo\u017enost\u00ed konfigur\u00e1cie v tabu\u013eke ch\u00fdbaj\u00fa v star\u0161\u00edch verzi\u00e1ch jadra a nie s\u00fa v skuto\u010dnosti pou\u017eite\u013en\u00e9 \u2014 v tabu\u013eke je to st\u00e1le uveden\u00e9 ako absencia potrebnej ochrany. Podobne, ak parameter konfigur\u00e1cie ch\u00fdba v tejto verzii, a pre bezpe\u010dnos\u0165 by mal by\u0165 tento parameter zak\u00e1zan\u00fd, pova\u017euje sa to za rozumn\u00fa konfigur\u00e1ciu. <\/p>\n<p>E\u0161te jeden aspekt pri interpret\u00e1cii v\u00fdsledkov: niektor\u00e9 konfigur\u00e1cie jadra, ktor\u00e9 zvy\u0161uj\u00fa plochu \u00fatoku, m\u00f4\u017eu s\u00fa\u010dasne sl\u00fa\u017ei\u0165 aj na zabezpe\u010denie. Tak\u00e9to pr\u00edklady zah\u0155\u0148aj\u00fa uprobes a kprobes, jadrov\u00e9 moduly a BPF\/eBPF. Na\u0161a odpor\u00fa\u010danie je pou\u017e\u00edva\u0165 vy\u0161\u0161ie uveden\u00e9 mechanizmy na zabezpe\u010denie skuto\u010dnej ochrany, preto\u017ee nie s\u00fa trivi\u00e1lne na pou\u017eitie a ich vyu\u017eitie predpoklad\u00e1, \u017ee \u0161kodliv\u00e9 subjekty s\u00fa u\u017e zaveden\u00e9 v syst\u00e9me. Av\u0161ak ak s\u00fa tieto mo\u017enosti povolen\u00e9, spr\u00e1vca syst\u00e9mu by mal akt\u00edvne sledova\u0165 zneu\u017eitia.<\/p>\n<p>Pri \u010fal\u0161om sk\u00faman\u00ed z\u00e1znamov tabu\u013eky 2 vid\u00edme, \u017ee modern\u00e9 jadr\u00e1 poskytuj\u00fa nieko\u013eko mo\u017enost\u00ed na ochranu pred zneu\u017eit\u00edm tak\u00fdch zranite\u013enost\u00ed, ako s\u00fa \u00faniky inform\u00e1ci\u00ed a preplnenie z\u00e1sobn\u00edka\/hromady. Av\u0161ak si v\u0161\u00edmame, \u017ee aj najnov\u0161ie popul\u00e1rne distrib\u00facie e\u0161te neimplementovali zlo\u017eitej\u0161iu ochranu (napr\u00edklad s pr\u00edstupmi <noindex><a rel=\"nofollow\" href=\"https:\/\/grsecurity.net\/\">grsecurity<\/a><\/noindex>) alebo modern\u00fa ochranu proti \u00fatokom na op\u00e4tovn\u00e9 vyu\u017eitie k\u00f3du (napr\u00edklad <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.columbia.edu\/~theofilos\/files\/slides\/krx.pdf\">kombin\u00e1cia randomiz\u00e1cie so sch\u00e9mami typu R^X pre k\u00f3d<\/a><\/noindex>). \u010co je e\u0161te hor\u0161ie, aj tieto pokro\u010dil\u00e9 ochrann\u00e9 prostriedky neposkytuj\u00fa ochranu pred cel\u00fdm spektrom \u00fatokov. T\u00fdm p\u00e1dom je pre spr\u00e1vcov syst\u00e9mov mimoriadne d\u00f4le\u017eit\u00e9 dop\u013a\u0148a\u0165 rozumn\u00e9 konfigur\u00e1cie rie\u0161eniami, ktor\u00e9 pon\u00fakaj\u00fa detekciu a prevenciu exploitov v re\u00e1lnom \u010dase.<\/p>\n<h3>Anal\u00fdza aplik\u00e1ci\u00ed<\/h3>\n<p>\nNie je prekvapen\u00edm, \u017ee r\u00f4zne distrib\u00facie maj\u00fa r\u00f4zne charakteristiky bal\u00edkov, nastavenia kompil\u00e1cie, z\u00e1vislosti kni\u017en\u00edc at\u010f. Rozdiely existuj\u00fa dokonca aj pre <noindex><a rel=\"nofollow\" href=\"https:\/\/upload.wikimedia.org\/wikipedia\/commons\/1\/1b\/Linux_Distribution_Timeline.svg\">pr\u00edbuzn\u00e9<\/a><\/noindex> distrib\u00facie a bal\u00edky s mal\u00fdm po\u010dtom z\u00e1vislost\u00ed (napr\u00edklad coreutils v Ubuntu alebo Debian). Aby sme vyhodnotili rozdiely, stiahli sme v\u0161etky dostupn\u00e9 bal\u00edky, extrahovali sme ich obsah a analyzovali bin\u00e1rne s\u00fabory a z\u00e1vislosti. Pre ka\u017ed\u00fd bal\u00edk sme sledovali in\u00e9 bal\u00edky, od ktor\u00fdch z\u00e1vis\u00ed, a pre ka\u017ed\u00fd bin\u00e1rny s\u00fabor sme sledovali jeho z\u00e1vislosti. V tejto \u010dasti stru\u010dne zhrnieme zistenia.<\/p>\n<h4>Distrib\u00facie<\/h4>\n<p>\nCelkom sme nahrali 361 556 bal\u00edkov pre v\u0161etky distrib\u00facie, pri\u010dom sme extrahovali len bal\u00edky zo z\u00e1kladn\u00fdch zrkadiel. Ignorovali sme bal\u00edky bez spustite\u013en\u00fdch ELF s\u00faborov, ako s\u00fa zdrojov\u00e9 k\u00f3dy, p\u00edsma a pod. Po filtrovan\u00ed ostalo 129 569 bal\u00edkov, ktor\u00e9 obsahuj\u00fa celkom 584 457 bin\u00e1rnych s\u00faborov. Rozdelenie bal\u00edkov a s\u00faborov pod\u013ea distrib\u00faci\u00ed je zn\u00e1zornen\u00e9 na obr. 3.<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/a24975fba7413ac8069c07412e5476cc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 3<\/i><\/p>\n<p>M\u00f4\u017eeme si v\u0161imn\u00fa\u0165, \u017ee \u010d\u00edm modernej\u0161ia distrib\u00facia, t\u00fdm viac bal\u00edkov a bin\u00e1rnych s\u00faborov v nej, \u010do je logick\u00e9. Napriek tomu bal\u00edky Ubuntu a Debian obsahuj\u00fa ove\u013ea viac bin\u00e1rnych s\u00faborov (ako spustite\u013en\u00fdch, tak dynamick\u00fdch modulov a kni\u017en\u00edc) ako CentOS, SUSE a RHEL, \u010do potenci\u00e1lne ovplyv\u0148uje povrch \u00fatoku Ubuntu a Debian (je potrebn\u00e9 poznamena\u0165, \u017ee \u010d\u00edsla odr\u00e1\u017eaj\u00fa v\u0161etky bin\u00e1rne s\u00fabory v\u0161etk\u00fdch verzi\u00ed bal\u00edka, teda niektor\u00e9 s\u00fabory sa analyzuj\u00fa nieko\u013ekokr\u00e1t). Je to obzvl\u00e1\u0161\u0165 d\u00f4le\u017eit\u00e9, ak zoh\u013eadn\u00edme z\u00e1vislosti medzi bal\u00edkmi. Tak m\u00f4\u017ee zranite\u013enos\u0165 v bin\u00e1rnom s\u00fabore jedn\u00e9ho bal\u00edka ovplyvni\u0165 mnoh\u00e9 \u010dasti ekosyst\u00e9mu, ako zranite\u013en\u00e1 kni\u017enica m\u00f4\u017ee ovplyvni\u0165 v\u0161etky bin\u00e1rne s\u00fabory, ktor\u00e9 ju importuj\u00fa. Ako v\u00fdchodiskov\u00fd bod sa pozrime na rozdelenie po\u010dtu z\u00e1vislost\u00ed medzi bal\u00edkmi v r\u00f4znych OS:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ii\/e3\/e5\/iie3e5-ei26ezg5yvcyvtzqzl80.png\"><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/c6570e643d92103c87659e61f5d395a6.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Obr. 4<\/i> <\/p>\n<p>Takmer vo v\u0161etk\u00fdch distrib\u00faci\u00e1ch m\u00e1 60% bal\u00edkov minim\u00e1lne 10 z\u00e1vislost\u00ed. Okrem toho niektor\u00e9 bal\u00edky maj\u00fa po\u010det z\u00e1vislost\u00ed v\u00fdrazne vy\u0161\u0161\u00ed (viac ako 100). To ist\u00e9 plat\u00ed aj pre sp\u00e4tn\u00e9 z\u00e1vislosti bal\u00edkov: ako sa o\u010dak\u00e1valo, nieko\u013eko bal\u00edkov pou\u017e\u00edvaj\u00fa mnoh\u00e9 in\u00e9 bal\u00edky v distrib\u00facii, tak\u017ee zranite\u013enosti v t\u00fdchto zop\u00e1r vybran\u00fdch maj\u00fa vysok\u00e9 riziko. Ako pr\u00edklad uv\u00e1dzame nasleduj\u00facu tabu\u013eku s 20 bal\u00edkmi s najvy\u0161\u0161\u00edm po\u010dtom sp\u00e4tn\u00fdch z\u00e1vislost\u00ed v SLES, Centos 7, Debian 9 a Ubuntu 18.04 (v ka\u017edej bunke je uveden\u00fd bal\u00edk a po\u010det sp\u00e4tn\u00fdch z\u00e1vislost\u00ed).<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/0aa544db8be1af7bffe21b6314537e18.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabu\u013eka 3<\/i><\/p>\n<p>Zauj\u00edmav\u00fd fakt. Hoci v\u0161etky analyzovan\u00e9 OS s\u00fa postaven\u00e9 pre architekt\u00faru x86_64, a v\u00e4\u010d\u0161ina bal\u00edkov m\u00e1 architekt\u00faru definovan\u00fa ako x86_64 a x86, bal\u00edky \u010dasto obsahuj\u00fa bin\u00e1rne s\u00fabory pre in\u00e9 architekt\u00fary, ako je zn\u00e1zornen\u00e9 na obr. 5.<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/b40f607e0c2f169bd1df21bd9994de8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr. 5<\/i><\/p>\n<p>V nasleduj\u00facej sekcii sa podrobnej\u0161ie pozrieme na vlastnosti analyzovan\u00fdch bin\u00e1rnikov.<\/p>\n<h4>\u0160tatistika ochrany bin\u00e1rnych s\u00faborov<\/h4>\n<p>\nAko absol\u00fatny minimum je potrebn\u00e9 \u0161tudova\u0165 z\u00e1kladn\u00fd s\u00fabor mo\u017enost\u00ed ochrany pre existuj\u00face bin\u00e1rne s\u00fabory. Nieko\u013eko distrib\u00faci\u00ed Linuxu sa dod\u00e1va so skriptmi, ktor\u00e9 vykon\u00e1vaj\u00fa tak\u00e9to kontroly. Napr\u00edklad v Debian\/Ubuntu existuje tak\u00fd skript. Tu je pr\u00edklad jeho \u010dinnosti:<\/p>\n<pre><code class=\"bash\">$ hardening-check $(which docker)\n\/usr\/bin\/docker:\n Position Independent Executable: \u00e1no\n Stack protected: \u00e1no\n Fortify Source functions: nie, n\u00e1jden\u00e9 s\u00fa len neopraven\u00e9 funkcie!\n Read-only relocations: \u00e1no\n Immediate binding: \u00e1no<\/code><\/pre>\n<p>\nSkript kontroluje p\u00e4\u0165 <noindex><a rel=\"nofollow\" href=\"http:\/\/manpages.ubuntu.com\/manpages\/trusty\/man1\/hardening-check.1.html\">ochrann\u00fdch funkci\u00ed<\/a><\/noindex>:<\/p>\n<ul>\n<li>Position Independent Executable (PIE): ur\u010duje, \u010di mo\u017eno presun\u00fa\u0165 textov\u00fd segment programu v pam\u00e4ti, aby sa dosiahla n\u00e1hodnos\u0165, ak je v jadre povolen\u00fd ASLR.\n<\/li>\n<li>Stack Protected: s\u00fa povolen\u00e9 ochrann\u00e9 kan\u00e1riky pre ochranu pred \u00fatokmi na kol\u00edziu z\u00e1sobn\u00edka.\n<\/li>\n<li>Fortify Source: s\u00fa nebezpe\u010dn\u00e9 funkcie (napr\u00edklad strcpy) nahraden\u00e9 ich bezpe\u010dnej\u0161\u00edmi ekvivalentmi, a kontrolovan\u00e9 pri behu volania s\u00fa nahraden\u00e9 ich nekontrolovan\u00fdmi ekvivalentmi (napr\u00edklad memcpy namiesto __memcpy_chk).\n<\/li>\n<li>Read-only relocations (RELRO): s\u00fa z\u00e1znamy tabu\u013eky premiestnen\u00ed ozna\u010den\u00e9 ako \u201eiba na \u010d\u00edtanie\u201c, ak boli aktivovan\u00e9 pred za\u010diatkom vykon\u00e1vania.\n<\/li>\n<li>Immediate binding (okam\u017eit\u00e9 viazanie): povol\u00ed linkeru runtime v\u0161etky premiestnenia pred za\u010diatkom vykon\u00e1vania programu (to je ekvivalentn\u00e9 \u00fapln\u00e9mu RELRO).<\/li>\n<\/ul>\n<p>\nS\u00fa uveden\u00e9 mechanizmy dostato\u010dn\u00e9? \u017dia\u013e, nie. S\u00fa zn\u00e1me sp\u00f4soby obch\u00e1dzania v\u0161etk\u00fdch uveden\u00fdch ochr\u00e1n, ale \u010d\u00edm pr\u00edsnej\u0161ia ochrana, t\u00fdm vy\u0161\u0161\u00ed je prah pre \u00fato\u010dn\u00edka. Napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity15\/sec15-paper-di-frederico.pdf\">met\u00f3dy obch\u00e1dzania RELRO<\/a><\/noindex> s\u00fa \u0165a\u017e\u0161ie aplikovate\u013en\u00e9, ak p\u00f4sob\u00ed PIE a okam\u017eit\u00e9 viazanie. Rovnako \u00fapln\u00fd ASLR si vy\u017eaduje \u010fal\u0161iu pr\u00e1cu na vytvoren\u00ed funk\u010dn\u00e9ho exploit. Av\u0161ak sofistikovan\u00ed \u00fato\u010dn\u00edci s\u00fa u\u017e pripraven\u00ed na tak\u00e9to ochrany: ich absencia v podstate ur\u00fdchli hacking. Preto je mimoriadne d\u00f4le\u017eit\u00e9, aby sa tieto opatrenia pova\u017eovali za nevyhnutn\u00e9 <i>minimum<\/i>. <\/p>\n<p>Chceli sme sk\u00fama\u0165, ko\u013eko bin\u00e1rnych s\u00faborov v zva\u017eovan\u00fdch distrib\u00faci\u00e1ch je chr\u00e1nen\u00fdch t\u00fdmito a \u010fal\u0161\u00edmi tromi met\u00f3dami:<\/p>\n<ul>\n<li>Nexecutabiln\u00fd bit (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Executable_space_protection\">NX<\/a><\/noindex>) br\u00e1ni vykon\u00e1vaniu v akomko\u013evek regi\u00f3ne, ktor\u00fd by nemal by\u0165 vykon\u00e1vate\u013en\u00fd, napr\u00edklad na stekovej hromade at\u010f.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rpath\">RPATH\/RUNPATH<\/a><\/noindex> ozna\u010duje cestu vykon\u00e1vania, ktor\u00fa dynamick\u00fd na\u010d\u00edta\u010d pou\u017e\u00edva na vyh\u013eadanie pr\u00edslu\u0161n\u00fdch kni\u017en\u00edc. Prv\u00fd je <i>povinn\u00fd<\/i> pre ka\u017ed\u00fa modern\u00fa syst\u00e9m: jeho absencia umo\u017e\u0148uje \u00fato\u010dn\u00edkom arbitr\u00e1rne zapisova\u0165 payload do pam\u00e4te a vykon\u00e1va\u0165 ho tak, ako je. Pre druh\u00e9 nespr\u00e1vne konfigur\u00e1cie cesty vykonania pom\u00e1haj\u00fa zav\u00e1dza\u0165 nestabiln\u00fd k\u00f3d, ktor\u00fd m\u00f4\u017ee vies\u0165 k nieko\u013ek\u00fdm probl\u00e9mom (napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nth-dimension.org.uk\/pub\/BTL.pdf\">eskal\u00e1cia privil\u00e9gi\u00ed<\/a><\/noindex>, ako aj <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.debian.org\/RpathIssue\">in\u00e9 probl\u00e9my<\/a><\/noindex>).<\/li>\n<li>Ochrana proti prekrytiu z\u00e1sobn\u00edka zabezpe\u010duje ochranu proti \u00fatokom, ktor\u00e9 sp\u00f4sobia, \u017ee sa z\u00e1sobn\u00edk prekr\u00fdva s in\u00fdmi oblas\u0165ami pam\u00e4te (napr\u00edklad s kopou). Vzh\u013eadom na ned\u00e1vne exploit\u00e1cie zneu\u017e\u00edvaj\u00face <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/blog\/exploiting-systemd-journald-part-1\/\">zranite\u013enosti prekrytia kopov v systemd<\/a><\/noindex>, pova\u017eovali sme za vhodn\u00e9 zahrn\u00fa\u0165 tento mechanizmus do na\u0161ich \u00fadajov.<\/li>\n<\/ul>\n<p>\nTak\u017ee bez \u010fal\u0161\u00edch formal\u00edt, prejdeme k \u010d\u00edslam. Tabu\u013eky 4 a 5 obsahuj\u00fa zhrnutie anal\u00fdzy vykonate\u013en\u00fdch s\u00faborov a kni\u017en\u00edc r\u00f4znych distrib\u00faci\u00ed, resp.<\/p>\n<ul>\n<li>Ako u\u017e bolo uveden\u00e9, ochrana NX je implementovan\u00e1 vo v\u0161etk\u00fdch pr\u00edpadoch s nieko\u013ek\u00fdmi v\u00fdnimkami. Najm\u00e4 je mo\u017en\u00e9 pozorova\u0165 o nie\u010do ni\u017e\u0161ie jej vyu\u017eitie v distrib\u00faci\u00e1ch Ubuntu a Debian v porovnan\u00ed s CentOS, RHEL a OpenSUSE.\n<\/li>\n<li>Z\u00e1sobn\u00edkov\u00e9 kan\u00e1riky s\u00fa mnoho kde absentuj\u00fa, najm\u00e4 v distrib\u00faci\u00e1ch so star\u00fdmi jadrami. Ur\u010dit\u00fd pokrok je zaznamenan\u00fd v posledn\u00fdch distrib\u00faci\u00e1ch Centos, RHEL, Debian a Ubuntu.\n<\/li>\n<li>S v\u00fdnimkou Debian a Ubuntu 18.04, v pr\u00edpade v\u00e4\u010d\u0161iny distrib\u00faci\u00ed je slab\u00e1 podpora PIE.\n<\/li>\n<li>Ochrana proti prekrytiu z\u00e1sobn\u00edka je slab\u00e1 v OpenSUSE, Centos 7 a RHEL 7 a prakticky absentuje v ostatn\u00fdch.\n<\/li>\n<li>V\u0161etky distrib\u00facie s modern\u00fdmi jadrami maj\u00fa ur\u010dit\u00fa podporu RELRO, pri\u010dom vedie Ubuntu 18.04 a druh\u00e9 miesto patr\u00ed Debi\u00e1nu.<\/li>\n<\/ul>\n<p>\nAko u\u017e bolo uveden\u00e9, metriky v tejto tabu\u013eke s\u00fa priemern\u00e9 za v\u0161etky verzie bin\u00e1rneho s\u00faboru. Ak sa pozrieme len na posledn\u00e9 verzie s\u00faborov, \u010d\u00edsla bud\u00fa in\u00e9 (napr\u00edklad, vid. <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">pokrok Debian pri zav\u00e1dzan\u00ed PIE<\/a><\/noindex>). Navy\u0161e, v\u00e4\u010d\u0161ina distrib\u00faci\u00ed zvy\u010dajne pri po\u010d\u00edtan\u00ed \u0161tatistiky kontroluje ochranu len nieko\u013ek\u00fdch funkci\u00ed v bin\u00e1rnom k\u00f3de, a v na\u0161ej anal\u00fdze je uveden\u00e9 skuto\u010dn\u00e9 percento posilnen\u00fdch funkci\u00ed. Preto ak je v bin\u00e1rke chr\u00e1nen\u00fdch 5 z 50 funkci\u00ed, uvedieme mu hodnotenie 0,1, \u010do zodpoved\u00e1 10% posilnen\u00fdch funkci\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/82e881c5ba2a3911f3a0ffae1a3475f4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabu\u013eka 4. Charakteristiky ochrany pre vykonate\u013en\u00e9 s\u00fabory zobrazen\u00e9 na obr. 3 (implement\u00e1cia pr\u00edslu\u0161n\u00fdch funkci\u00ed v percent\u00e1ch z celkov\u00e9ho po\u010dtu vykonate\u013en\u00fdch s\u00faborov)<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/57c8e67be7a57341105262c6e956594c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tabu\u013eka 5. Vlastnosti ochrany pre kni\u017enice zobrazen\u00e9 na obr. 3 (realiz\u00e1cia pr\u00edslu\u0161n\u00fdch funkci\u00ed v percent\u00e1ch z celkov\u00e9ho po\u010dtu kni\u017en\u00edc)<\/i><\/p>\n<p>M\u00e1me pokrok? Ur\u010dite \u00e1no: je to vidie\u0165 zo \u0161tatistiky pre jednotliv\u00e9 distrib\u00facie (napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"http:\/\/outflux.net\/debian\/hardening\/\">Debian<\/a><\/noindex>), ako aj z vy\u0161\u0161ie uveden\u00fdch tabuliek. Ako pr\u00edklad je na obr. 6 zobrazen\u00e9 zav\u00e1dzanie ochrann\u00fdch mechanizmov v troch po sebe id\u00facich distrib\u00faci\u00e1ch Ubuntu LTS 5 (vynechali sme \u0161tatistiku ochrany proti kol\u00edzii z\u00e1sobn\u00edka). Pozorujeme, \u017ee z verzie na verziu \u010doraz viac s\u00faborov podporuje z\u00e1sobn\u00edk kan\u00e1rikov, a rovnako sa \u010doraz viac bin\u00e1rnych s\u00faborov dod\u00e1va s plnou ochranou RELRO.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/d1\/ni\/or\/d1niordj1hmiklmg2-w5rsk6dla.png\"><img decoding=\"async\" alt=\"Mili\u00f3ny bin\u00e1rnych s\u00faborov nesk\u00f4r. Ako sa posilnil Linux\" src=\"\/wp-content\/uploads\/2019\/03\/9130099db6d59106da8f0a0fc760410e.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Obr. 6<\/i><\/p>\n<p>\u017dia\u013e, niektor\u00e9 spustite\u013en\u00e9 s\u00fabory v r\u00f4znych distrib\u00faci\u00e1ch st\u00e1le nemaj\u00fa \u017eiadnu z vy\u0161\u0161ie uveden\u00fdch ochr\u00e1n. Napr\u00edklad v Ubuntu 18.04 si m\u00f4\u017eete v\u0161imn\u00fa\u0165 bin\u00e1rku ngetty (n\u00e1hrada getty), ako aj shelly mksh a lksh, interpret picolisp, bal\u00edky nvidia-cuda-toolkit (popul\u00e1rny bal\u00edk pre aplik\u00e1cie s GPU ur\u00fdchlen\u00edm, ako s\u00fa r\u00e1mce strojov\u00e9ho u\u010denia) a klibc-utils. Podobne sa dod\u00e1va bin\u00e1rka mandos-client (administrat\u00edvny n\u00e1stroj umo\u017e\u0148uj\u00faci automaticky re\u0161tartova\u0165 stroje so \u0161ifrovan\u00fdmi s\u00faborov\u00fdmi syst\u00e9mami) a rsh-redone-client (nov\u00e1 implement\u00e1cia rsh a rlogin) bez ochrany NX, hoci maj\u00fa pr\u00e1va SUID :(. Okrem toho v niektor\u00fdch suid-bin\u00e1rkach ch\u00fdba z\u00e1kladn\u00e1 ochrana, ako s\u00fa z\u00e1sobn\u00edkov\u00e9 kan\u00e1riky (napr. bin\u00e1rny s\u00fabor Xorg.wrap z bal\u00edku Xorg).<\/p>\n<h1>Zhrnutie a z\u00e1vere\u010dn\u00e9 pozn\u00e1mky<\/h1>\n<p>\nV tomto \u010dl\u00e1nku sme zd\u00f4raznili nieko\u013eko bezpe\u010dnostn\u00fdch vlastnost\u00ed modern\u00fdch distrib\u00faci\u00ed Linuxu. Anal\u00fdza uk\u00e1zala, \u017ee v poslednej distrib\u00facii Ubuntu LTS (18.04) je priemerne najvy\u0161\u0161ia \u00farove\u0148 ochrany opera\u010dn\u00e9ho syst\u00e9mu a aplik\u00e1ci\u00ed medzi distrib\u00faciami s relat\u00edvne nov\u00fdmi jadrami, ako s\u00fa Ubuntu 14.04, 12.04 a Debian 9. Av\u0161ak posudzovan\u00e9 distrib\u00facie CentOS, RHEL a OpenSUSE v na\u0161ich d\u00e1tach predvolene poskytuj\u00fa hustej\u0161\u00ed s\u00fabor bal\u00edkov, pri\u010dom najnov\u0161ie verzie (CentOS a RHEL) maj\u00fa vy\u0161\u0161\u00ed percentu\u00e1lny podiel implement\u00e1cie ochrany proti prete\u010deniu z\u00e1sobn\u00edka v porovnan\u00ed s konkurentmi na b\u00e1ze Debiana (Debian a Ubuntu). Pri porovn\u00e1van\u00ed verzi\u00ed CentOS a RedHat si v\u0161im\u00e1me ve\u013ek\u00e9 zlep\u0161enia v implement\u00e1cii z\u00e1sobn\u00edkov\u00fdch kan\u00e1rikov a RELRO z verzi\u00ed 6 na 7, ale v priemere m\u00e1 CentOS viac funkci\u00ed ako RHEL. V\u0161eobecne by sa v\u0161etk\u00fdm distrib\u00faci\u00e1m malo venova\u0165 zvl\u00e1\u0161tna pozornos\u0165 ochrane PIE, ktor\u00e1, s v\u00fdnimkou Debianu 9 a Ubuntu 18.04, bola implementovan\u00e1 v menej ako 10% bin\u00e1rnych s\u00faborov z na\u0161ich \u00fadajov. <\/p>\n<p>Nakoniec je potrebn\u00e9 poznamena\u0165, \u017ee aj ke\u010f sme v\u00fdskum vykonali ru\u010dne, existuje mno\u017estvo bezpe\u010dnostn\u00fdch n\u00e1strojov (napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/cisofy.com\/lynis\/\">Lynis<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nongnu.org\/tiger\/\">Tiger<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hubblestack\/hubble\">Hubble<\/a><\/noindex>), ktor\u00e9 vykon\u00e1vaj\u00fa anal\u00fdzy a pom\u00e1haj\u00fa predch\u00e1dza\u0165 nebezpe\u010dn\u00fdm konfigur\u00e1ci\u00e1m. Bohu\u017eia\u013e, ani siln\u00e1 ochrana v rozumn\u00fdch konfigur\u00e1ci\u00e1ch nezaru\u010duje absenciu exploitov. Preto sme presved\u010den\u00ed, \u017ee je mimoriadne d\u00f4le\u017eit\u00e9 zabezpe\u010di\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">spo\u013eahliv\u00fd monitoring a prevenciu \u00fatokov v re\u00e1lnom \u010dase<\/a><\/noindex>, s\u00fastrediac sa na exploita\u010dn\u00e9 vzory a ich predch\u00e1dzanie.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444418\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>TL;DR. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u0441\u0445\u0435\u043c\u044b (hardening schemes), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043f\u044f\u0442\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux. \u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043c\u044b \u0432\u0437\u044f\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u044f\u0434\u0440\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0438 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0445\u0435\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b OpenSUSE 12.4, Debian 9, CentOS, RHEL 6.10 \u0438 7, \u0430 \u0442\u0430\u043a\u0436\u0435 Ubuntu 14.04, 12.04 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29880","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"TL;DR.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"TL;DR.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:27+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mili\u00f3ny bin\u00e1rov nesk\u00f4r. Ako sa Linux stal silnej\u0161\u00edm | ProHoster","description":"TL;DR.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u043e\u0432 \u0441\u043f\u0443\u0441\u0442\u044f. \u041a\u0430\u043a \u0443\u043a\u0440\u0435\u043f\u043b\u044f\u043b\u0441\u044f Linux | ProHoster","og:description":"TL;DR.","og:url":"https:\/\/prohoster.info\/sk\/blog\/milliony-binarnikov-spustya-kak-ukreplyalsya-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:27+00:00","article:modified_time":"2019-10-31T18:32:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29880","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 22:50:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:46:28","updated":"2026-01-20 22:50:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=29880"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29880\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=29880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=29880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=29880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}