Mhoroi mose! Kunyanya kuvadzidzi vekosi Isu takagadzirira dudziro yepamutemo FAQ yeSELinux chirongwa. Zvinoita sekuti shandurudzo iyi inogona kubatsira kwete kuvadzidzi chete, saka tiri kugoverana nemi.
Takaedza kupindura mimwe yemibvunzo inowanzo bvunzwa nezve SELinux chirongwa. Parizvino, mibvunzo yakakamurwa kuva mapoka makuru maviri. Mibvunzo yese nemhinduro zvinopihwa .
tsananguro
tsananguro
- Chii chinonzi Security Enhanced Linux?
Chengetedzo-yakagadziridzwa Linux (SELinux) ireferensi yekumisikidzwa kweFlask kuchengetedza dhizaini yekuchinjika, yakasimbiswa yekuwana kutonga. Yakagadzirwa kuti iratidze kubatsira kwekuchinjika kwekutonga nzira dzekushandisa uye nzira dzakadai dzinogona kuwedzerwa kune inoshanda sisitimu. Iyo Flask architecture yakazobatanidzwa muLinux uye yakatakurwa kune akati wandei masisitimu, kusanganisira iyo Solaris inoshanda sisitimu, iyo FreeBSD inoshanda sisitimu, uye iyo Darwin kernel, ichiburitsa rakasiyana rebasa rakabatana. Iyo Flask architecture inopa rutsigiro rwakakwana rwekushandisa akawanda marudzi eakatemerwa ekutonga ekutonga marongero, kusanganisira ayo akavakirwa papfungwa dzeType Enforcement, Role-based Access Control, uye Multi-level Chengetedzo. - Chii chinopa kuchengetedza-inokwidziridzwa Linux inopa iyo yakajairwa Linux haigone?
Iyo yekuchengetedza-inosimudzira Linux kernel inoisa yakasimbiswa yekutonga mitemo inodzikamisa zvirongwa zvevashandisi uye maseva ehurongwa kune yakaderera seti yeropafadzo dzavanoda kuita mabasa avo. Nekupikiswa uku, kugona kweaya mapurogiramu evashandisi uye masisitimu madhimoni kukonzera kukuvadza kana kukanganisirwa (semuenzaniso, nebuffer mafashama kana kusarongeka) kunoderedzwa kana kubviswa. Iyi nzira yekurambidza inoshanda yakazvimiririra yetsika Linux yekudzora nzira. Iyo haina pfungwa yea superuser "mudzi" uye haigovane zvinozivikanwa zvikanganiso zvechinyakare Linux kuchengetedza masisitimu (semuenzaniso, kutsamira pane setuid/setgid binaries).
Kuchengeteka kweiyo isina kuchinjwa Linux system kunoenderana nekurongeka kwekernel, zvese zvine rombo maapplication, uye imwe neimwe yezvigadziriso zvavo. Dambudziko mune imwe yenzvimbo idzi rinogona kukonzera kuti hurongwa hwese huve pangozi. Kusiyana neizvi, kuchengetedzeka kweiyo yakagadziridzwa sisitimu yakavakirwa pakuchengetedza-yakakwidziridzwa Linux kernel kunoenderana zvakanyanya nekurongeka kwekernel uye yayo yekuchengetedza mutemo kumisikidzwa. Kunyangwe kurongeka kwemashandisirwo kana matambudziko ekumisikidza angabvumira kukanganisa kushoma kwezvirongwa zvemushandisi wega wega uye masisitimu madhimoni, iwo haaise njodzi yekuchengetedza kune mamwe mapurogiramu evashandisi nemadhimoni ehurongwa kana kuchengetedzeka kwehurongwa hwakazara. - Yakanakira chii?
New Linux maficha ane kuchengetedzwa kwakagadziridzwa akagadzirirwa kuve nechokwadi chekuparadzaniswa kweruzivo zvichienderana nekuvanzika uye kutendeseka zvinodiwa. Izvo zvakagadzirirwa kudzivirira maitiro kubva pakuverenga data nemapurogiramu, kukanganisa nedata uye zvirongwa, kupfuura nzira dzekuchengetedza maapplication, kuita zvirongwa zvisingavimbike, kana kukanganisa mamwe maitiro kutyora mitemo yekuchengetedza system. Ivo zvakare vanobatsira kudzikisira kukuvara kunogona kukonzerwa nemalware kana malware. Dzinofanirwawo kubatsira mukuona kuti vashandisi vane mvumo dzakasiyana dzekuchengetedza vanogona kushandisa iyo yakafanana system kuwana mhando dzakasiyana dzeruzivo nemhando dzakasiyana dzekuchengetedza pasina kukanganisa izvo zvinodiwa. - Ndingawana sei kopi?
Kugoverwa kweLinux kwakawanda kunosanganisira tsigiro yeSELinux, ingave yakavakirwa-mukati sechinhu chakasarudzika kana seyesarudzo pasuru. Iyo huru SELinux userland kodhi inowanikwa pa . Vashandisi vekupedzisira vanofanirwa kazhinji kushandisa mapakeji anopihwa nekugovera kwavo. - Chii chakabatanidzwa mukuburitswa kwako?
Iyo NSA SELinux kuburitswa inosanganisira iyo yakakosha SELinux userland kodhi. SELinux tsigiro yakatoverengerwa mune mainline Linux 2.6 kernel, inowanikwa pa kernel.org. Iyo yakakosha SELinux userland kodhi ine raibhurari yekugadzirisa mabhinari mutemo (libsepol), muumbi wepolicy (checkpolicy), raibhurari yezvekuchengetedza zvikumbiro (libselinux), raibhurari yezvishandiso zvekutonga maturusi (libsemanage), uye akati wandei ane chekuita nepolicy utilities ( policycoreutils).
Pamusoro peiyo SELinux-inogonesa kernel uye yakakosha userland kodhi, iwe unozoda mutemo uye mamwe SELinux-patched userspace mapakeji kushandisa SELinux. Iyo policy inogona kuwanikwa kubva . - Ndinogona here kuisa Hardened Linux pane iripo Linux system?
Ehe, unogona kuisa chete SELinux shanduko pane iripo Linux system, kana iwe unogona kuisa Linux kugovera iyo inotosanganisira SELinux rutsigiro. SELinux ine Linux kernel ine SELinux tsigiro, musimboti seti yemaraibhurari uye zvinoshandiswa, mamwe akagadziridzwa evashandisi mapakeji, uye gadziriro yemitemo. Kuti uiise pane iripo Linux system inoshaya SELinux rutsigiro, unofanirwa kukwanisa kuunganidza software uye zvakare kuve nemamwe anodiwa system mapakeji. Kana yako Linux kugovera kwatove kunosanganisira SELinux rutsigiro, haufanire kuvaka kana kuisa iyo NSA kuburitswa kweSELinux. - Inoenderana sei Chengetedzo Yakawedzerwa Linux neLinux isina kuchinjwa?
Chengetedzo Yakasimbiswa Linux inopa kuwirirana kwebhinari neiyo iripo Linux application uye neiyo iripo Linux kernel modules, asi mamwe kernel modules angangoda kugadziridzwa kuti adyidzane nemazvo neSELinux. Aya mapoka maviri ekuenderana anokurukurwa zvakadzama pazasi:- Kuenderana Kwekushandisa
SELinux inopa kuenderana kwemabhinari nemashandisirwo aripo. Isu takawedzera iyo kernel data zvimiro kuti ibatanidze hunhu hutsva hwekuchengetedza uye takawedzera maAPI matsva ekufona kwekuchengetedza kuchengetedza. Nekudaro, isu hatina kushandura chero application-inooneka data zvimiro kana kushandura chimiro chechero nharembozha iripo, saka maapplication aripo anogona kumhanya pasina kugadziridzwa kana mutemo wekuchengetedza uchivabvumira kuti vashande. - Kernel Module Kuenderana
Pakutanga, SELinux yakapa kugarisana kwekuzvarwa chete kune iripo kernel modules; zvaive zvakafanira kudzokorodza mamodule akadaro achipesana neakachinja kernel misoro kuitira kuti utore mitsva yekuchengetedza minda yakawedzerwa kune kernel data zvimiro. Sezvo LSM neSELinux zvave kubatanidzwa mune huru Linux 2.6 kernel, SELinux ikozvino inopa kuenderana kwebhinari nemamodule kernel aripo. Nekudaro, mamwe ma kernel module anogona kusadyidzana zvakanaka neSELinux pasina kugadziridzwa. Semuenzaniso, kana kernel module inogovera zvakananga uye kuseta kernel chinhu pasina kushandisa yakajairika yekutanga mabasa, ipapo chinhu chekernel chinogona kushaya ruzivo rwekuchengetedza. Mamwe ma kernel modules anogonawo kushaya kwakaringana kuchengetedza kudzora kwekuita kwavo; Chero nhare dziripo kune kernel mabasa kana mamvumo mabasa anozokonzeresa SELinux mvumo yekutarisa, asi yakawanda granular kana yekuwedzera madhiraivha anogona kudikanwa kutevedzera MAC marongero.
Chengetedzo-inokwidziridzwa Linux haifanire kukonzera matambudziko ekudyidzana neanogara eLinux masisitimu sekureba kwese kwakakosha mashandiro achitenderwa nekumisikidzwa kwemitemo yekuchengetedza.
- Kuenderana Kwekushandisa
- Ndezvipi zvinangwa zvemuenzaniso wekuchengetedza mutemo wekugadzirisa?
Padanho repamusoro, chinangwa ndechekuratidza kuchinjika uye kuchengetedzeka kwekumanikidzirwa kwekutonga kwekuwana uye kupa iri nyore yekushanda sisitimu ine shanduko shoma kune maapplication. Pachinhanho chepasi, mutemo une huwandu hwezvinangwa zvinotsanangurwa mugwaro remitemo. Zvinangwa izvi zvinosanganisira kudzora kuwanikwa kwedata, kuchengetedza kutendeseka kwekernel, system software, system yekumisikidza ruzivo uye system logs, kudzikisira kukuvara kungangokonzereswa nekushandisa kusavimbika mukuita kunoda ropafadzo, kuchengetedza nzira dzakasarudzika kubva pakuita zvakaipa. kodhi, kuchengetedza chinzvimbo cheadmin uye domain kubva pakupinda pasina kuvimbiswa kwemushandisi, kudzivirira zvakajairwa mushandisi maitiro kubva mukukanganisa sisitimu kana admin maitiro, uye kudzivirira vashandisi nemaadmin kubva mukushandisa kusaitemba mubrowser yavo nehutsinye nharembozha. - Nei Linux yakasarudzwa sepuratifomu?
Linux yakasarudzwa sepuratifomu yekutanga referensi yekushandiswa kwebasa iri nekuda kwekukura kwayo kubudirira uye yakavhurika budiriro nharaunda. Linux inopa mukana wakanakisa wekuratidza kuti mashandiro aya anogona kubudirira pane anogamuchira sisitimu yekushandisa uye, panguva imwe chete, inobatsira kuchengetedzeka kweiyo inonyanya kushandiswa system. Iyo Linux chikuva inopawo mukana wakanakisa webasa iri kuti riwane yakafararisa inobvira ongororo uye inogona kushanda sehwaro hwekuwedzera kuchengetedzwa kwetsvakiridzo nevamwe vanofarira. - Wakaitei basa iri?
National Security Agency ine basa rekutsvagisa nekuvandudza matekinoroji anodiwa kugonesa NSA kupa ruzivo rwekuchengetedzeka mhinduro, zvigadzirwa, uye masevhisi ezvivakwa zveruzivo zvakakoshera zvido zvekuchengetedza nyika yeU.S.
Kugadzira inoshanda, yakachengeteka sisitimu yekushandisa inoramba iri yakakosha yekutsvagisa dambudziko. Chinangwa chedu ndechekugadzira chivakwa chinoshanda chinopa tsigiro inodiwa yekuchengetedza, inomhanyisa zvirongwa nenzira iri pachena kune mushandisi, uye inokwezva kune vatengesi. Isu tinotenda kuti danho rakakosha pakuzadzisa chinangwa ichi nderekuratidza kuti nzira dzekutonga dzekuwana dzakasimbiswa dzinogona sei kubatanidzwa muhurongwa hwepasi pasi. - Izvi zvine chekuita sei netsvagiridzo yeNSA OS yapfuura?
Vatsvagiri veNSA's National Information Assurance Research Laboratory neSecure Computing Corporation (SCC) vakagadzira anesimba uye anochinjika ekutonga ekugadzirisa zvivakwa zvichibva paType Enforcement, nzira yakatanga kugadzirwa yeLOCK system. NSA neSCC vakagadzira maviri maprototype Mach-based architectures: DTMach uye DTOS () NSA neSCC dzakabva dzashanda neboka reFlux rekutsvagisa paYunivhesiti yeUtah kuendesa zvivakwa kune Fluke research operating system. Munguva yekutama uku, dhizaini yakakwenenzverwa kuti itsigire zvirinani zvirongwa zvekuchengetedza. Ichi chivakwa chakavandudzwa chainzi Flask () Ikozvino NSA yakabatanidza iyo Flask architecture muLinux inoshanda sisitimu kuunza tekinoroji kunharaunda yakakura yevagadziri uye vashandisi. - Ko kuchengetedza-inokwidziridzwa Linux ndeye yakavimbika inoshanda sisitimu?
Mutsara wekuti "Trusted Operating System" kazhinji unoreva sisitimu yekushandisa inopa rutsigiro rwakakwana kune akati wandei akaturikidzana ekuchengetedza uye humbowo-hwe-pfungwa yekusangana yakatarwa seti yehurumende zvinodiwa. Chengetedzo-Yakawedzerwa Linux inosanganisa mazano anobatsira kubva kune aya masisitimu, asi anotarisa pakusimbisa kwekutonga kwekuwana. Chinangwa chekutanga chekugadzira kuchengetedza-inovandudza Linux yaive yekugadzira mashandiro anobatsira anopa zvinobatika kuchengetedza mabhenefiti munzvimbo dzakasiyana siyana dzepasirese kuratidza tekinoroji. SELinux pachayo haisi yakavimbika inoshanda sisitimu, asi inopa yakakosha chengetedzo chimiro-inomisikidzwa yekuwana kutonga-inodiwa neakavimbika anoshanda sisitimu. SELinux yakabatanidzwa muLinux kugovera iyo yakaverengerwa zvinoenderana neYakanyorwa Chengetedzo Dziviriro Profile. Ruzivo nezve zvigadzirwa zvakaedzwa uye zvakasimbiswa zvinogona kuwanikwa pa . - Akadzivirirwa zvechokwadi here?
Iyo pfungwa yeyakachengeteka sisitimu inosanganisira akawanda hunhu (semuenzaniso, kuchengetedzwa kwemuviri, kuchengetedzwa kwevashandi, nezvimwewo), uye Linux ine yakagadziridzwa kero yekuchengetedza chete yakamanikana seti yeaya hunhu (kureva, iyo yekumanikidza yekuwana zvidzoreso mune inoshanda sisitimu) . Mune mamwe mazwi, "system yakachengeteka" inoreva kuchengetedzwa zvakakwana kuchengetedza rumwe ruzivo munyika chaiyo kubva kune mhandu chaiyo iyo iyo muridzi uye / kana mushandisi weruzivo anoyambirwa. Chengetedzo Yakawedzerwa Linux inoitirwa chete kuratidza inodiwa kudzora mune yemazuva ano sisitimu yekushandisa seLinux, uye saka haigone kusangana chero inonakidza tsananguro yeyakachengeteka system iri yega. Isu tinotenda tekinoroji inoratidzwa mukuchengetedza-inosimudzira Linux ichave yakakosha kune vanhu vanovaka masisitimu akachengeteka. - Chii chawakaita kuvandudza vimbiso?
Chinangwa chepurojekiti iyi chaive chekuwedzera zvidzoreso zvekushandisa zvine shanduko shoma kuLinux. Ichi chinangwa chekupedzisira chinodzikamisa zvakanyanya zvinogona kuitwa kuvandudza vimbiso, saka hapasati pave nebasa rakanangana nekuvandudza Linux vimbiso. Kune rimwe divi, kuvandudzwa kunovaka pabasa rekare pakugadzira yakakwirira-simbiso yekuchengetedza zvivakwa, uye mazhinji eaya magadzirirwo emisimboti anotakurwa kuLinux nekuchengetedzwa kwakavandudzwa. - Ko CCEVS ichayera Linux nekuchengetedzwa kwakawedzerwa?
Chengetedzo-Yakawedzerwa Linux pachayo haina kugadzirwa kugadzirisa iyo yakazara seti yezvekuchengetedza nyaya dzinounzwa neiyo chengetedzo mbiri. Kunyangwe zvichikwanisika kuongorora kushanda kwayo kwazvino chete, tinotenda kuti kuongorora kwakadaro kungave kweukoshi hushoma. Nekudaro, isu takashanda nevamwe kuti tibatanidze tekinoroji iyi muLinux kugoverwa kwakaongororwa uye kugoverwa kuri kuongororwa. Ruzivo nezve zvigadzirwa zvakaedzwa uye zvakasimbiswa zvinogona kuwanikwa pa . - Wakamboedza kugadzirisa chero hurema here?
Kwete, hatina kutsvaga kana kuwana chero hurema panguva yebasa redu. Isu takangoita zvishoma zvishoma kuwedzera maitiro edu matsva. - Hurongwa uhu hunotenderwa kushandiswa nehurumende here?
Chengetedzo-yakawedzera Linux haina yakakosha kana imwe mvumo yekushandiswa kwehurumende pane chero imwe vhezheni yeLinux.Chengetedzo-yakakwenenzverwa Linux haina yakakosha kana imwe mvumo yekushandiswa kwehurumende pane chero imwe shanduro yeLinux. - Izvi zvakasiyana sei nezvimwe zvirongwa?
Chengetedzo-Yakasimudzirwa Linux ine yakanyatsotsanangurwa dhizaini yekumisikidza yekumisikidza kwekutonga kwekuwana, iyo yakaedzwa yakasimbiswa uchishandisa akati wandei prototype masisitimu (DTMach, DTOS, Flask). Dzidzo dzakadzama dzakaitwa pakugona kwekuvaka kutsigira huwandu hwakawanda hwemitemo yekuchengetedza uye inowanikwa mukati. ΠΈ .
Iyo dhizaini inopa yakanyatso-grained kutonga pamusoro peakawanda kernel abstractions uye masevhisi asina kudzorwa nemamwe masisitimu. Mamwe emhando yekusiyanisa yeLinux system ine kuchengetedzwa kwakawedzerwa ndeiyi:- Kupatsanurwa kwakachena kwepolicy kubva kune kodzero dzekushandisa
- Yakanyatsotsanangurwa policy interfaces
- Kusununguka kubva kumitemo nemitauro yemitemo
- Kuzvimirira kwemamwe mafomati ekuchengetedza label uye zviri mukati
- Kusiyanisa mavara uye zvidzoreso zve kernel zvinhu uye masevhisi
- Caching yekuwana sarudzo yekubudirira
- Rutsigiro rwekuchinja kwemitemo
- Kudzora pamusoro pekutanga maitiro uye chirongwa chenhaka uye kuuraya
- Manage faira masisitimu, madhairekitori, mafaera uye akavhurika faira tsananguro
- Kugadzirisa masokisi, mameseji uye network interfaces
- Kudzora pamusoro pekushandiswa kwe "Mikana"
- Ndezvipi zvirambidzo zvekupihwa rezenisi kune ino system?
Yese kodhi kodhi inowanikwa pane saiti , yakagovaniswa pasi pematemu akafanana neiyo yekutanga source code. Semuenzaniso, zvigamba zveLinux kernel uye zvigamba zvezvizhinji zviripo zviripo pano zvinoburitswa pasi pemitemo ye . - Pane zvinodzora kunze kwenyika?
Linux ine Enhanced Chengetedzo haina mamwe ekunze ekunze zvinodzora zvichienzaniswa nechero imwe vhezheni yeLinux. - NSA ine hurongwa hwekuishandisa here munyika?
Nezvikonzero zviri pachena, NSA haitauri nezvekushandiswa kwekushandisa. - Ko Chirevo chaChikunguru 26, 2002 cheSimbiso neSecure Computing Corporation chinoshandura chinzvimbo cheNSA chekuti SELinux yakapihwa pasi peGNU General Public License?
Nzvimbo yeNSA haina kuchinja. NSA inoramba ichitenda kuti zvirevo uye mamiriro eGNU General Public License anotonga kushandiswa, kukopa, kugovera, uye kugadziridzwa kweSELinux. Cm. . - Iyo NSA inotsigira yakavhurika sosi software here?
Matanho ekuchengetedzwa kwesoftware eNSA anovhara zvese zviri zviviri proprietary uye open source software, uye takabudirira kushandisa ese ari maviri evaridzi uye akavhurika sosi mhando mumabasa edu ekutsvagisa. Basa reNSA rekuvandudza kuchengetedzwa kwesoftware rinokurudzirwa nekufunga kumwe kwakapusa: kuwedzera zviwanikwa zvedu kupa vatengi veNSA sarudzo dzekuchengetedza dzakanakisa muzvigadzirwa zvavo zvinonyanya kushandiswa. Chinangwa chechirongwa chekutsvagisa cheNSA ndechekugadzira budiriro yetekinoroji inogona kugoverwa nenharaunda yekuvandudza masoftware kuburikidza nenzira dzakasiyana dzekupa. NSA haitsigire kana kusimudzira chero chigadzirwa chesoftware kana mhando yebhizinesi. Asi, NSA iri kukurudzira kuchengetedzwa. - Ko NSA inotsigira Linux?
Sezvataurwa pamusoro apa, NSA haitsigire kana kusimudzira chero chigadzirwa chesoftware kana chikuva; NSA inobatsira chete kuvandudza kuchengetedzwa. Iyo Flask dhizaini yakaratidzwa muSELinux referensi yekumisikidzwa yakaendeswa kune akati wandei mamwe masisitimu anoshanda, anosanganisira Solaris, FreeBSD, uye Darwin, akaiswa kune Xen hypervisor, uye akaiswa kune maficha akadai seX Window System, GConf, D-BUS, uye PostgreSQL. Flask architecture concepts anoshandiswa zvakanyanya kune dzakasiyana siyana masisitimu uye nharaunda.
Kubatana
- Tinoronga sei kushamwaridzana nenharaunda yeLinux?
Tine , iyo ichashanda senzira yedu yekutanga yekuburitsa ruzivo nezveLinux nekuchengetedzwa kwakavandudzwa. Kana iwe uchifarira kuchengetedza-inokwidziridzwa Linux, tinokukurudzira kuti ubatane neanovandudza tsamba yekutumira, ongorora iyo kodhi kodhi, uye upe mhinduro yako (kana kodhi). Kuti ubatanidze rondedzero yevagadziri vetsamba, ona . - Ndiani angabatsira?
SELinux ikozvino inotsigirwa uye yakagadziridzwa neyakavhurika sosi Linux software nharaunda. - NSA inopa mari here basa rekutevera?
Sangano reNSA parizvino harisati richizeya zvikumbiro zvekuwedzera basa. - Rudzii rwerutsigiro rwuripo?
Isu tinoda kugadzirisa nyaya kuburikidza netsamba yekutumira [email inodzivirirwa], asi isu tingasakwanisa kupindura mibvunzo yese ine chekuita neimwe saiti. - Ndiani akabatsira? Vakaitei?
Iyo yekuchengetedza-inosimudzira Linux prototype yakagadziriswa neNSA nevanotsvagisa vabatsiri NAI Labs, Secure Computing Corporation (SCC), uye MITER Corporation. Mushure mekutanga kuburitswa pachena, zvimwe zvinhu zvakawanda zvakatevera. . - Ndingawana sei zvimwe?
Tinokukurudzira kuti ushanyire mapeji edu ewebhu, uverenge zvinyorwa uye mapepa ekutsvagisa apfuura, uye kutora chikamu mutsamba yedu yekutumira [email inodzivirirwa]
Unoona shanduro yacho ichibatsira here? Nyora mhinduro!
Source: www.habr.com