{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft ofroi sistemin e menaxhimit t\u00eb aksesit IPE p\u00ebr b\u00ebrtham\u00ebn Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania ka paraqitur p\u00ebr diskutim n\u00eb list\u00ebn e shp\u00ebrndarjes s\u00eb zhvilluesve t\u00eb b\u00ebrtham\u00ebs Linux kodin e modulit LSM me implementimin e mekanizmit IPE (Implementimi i Politik\u00ebs s\u00eb Integritetit), i cili zgjeron sistemet ekzistuese t\u00eb menaxhimit t\u00eb detyruesh\u00ebm t\u00eb aksesit. N\u00eb vend t\u00eb lidhjes me etiketat dhe rrug\u00ebt, n\u00eb IPE vendimi p\u00ebr lejen ose ndalimin e operacionit merret n\u00eb baz\u00eb t\u00eb pronarive t\u00eb vazhdueshme t\u00eb komponentit sistemor me t\u00eb cilin kryhet operacioni. Moduli lejon p\u00ebrcaktimin e nj\u00eb politike t\u00eb p\u00ebrgjithshme p\u00ebr sigurimin e integritetit p\u00ebr t\u00ebr\u00eb sistemin, duke treguar cilat operacione jan\u00eb t\u00eb lejueshme dhe si duhet t\u00eb verifikohet autenticiteti i komponent\u00ebve. <\/p>\n

IPE synon krijimin e sistemeve plot\u00ebsisht t\u00eb verifikueshme, integriteti i t\u00eb cilave konfirmohet nga ngarkuesi fillestar dhe b\u00ebrthama deri te skedar\u00ebt p\u00ebrfundimtar\u00eb ekzekutues, konfigurimet dhe skedar\u00ebt e ngarkuesh\u00ebm. P\u00ebr shembull, me ndihm\u00ebn e IPE mund t\u00eb tregoni se cil\u00ebt skedar\u00eb ekzekutues \u00ebsht\u00eb e lejuar t\u00eb ekzekutohen duke u mb\u00ebshtetur n\u00eb verifikimin e p\u00ebrputhjes s\u00eb tyre me versionin e referenc\u00ebs duke p\u00ebrdorur hash-et kriptografike t\u00eb ofruara nga sistemi dm-verity. N\u00eb rast t\u00eb ndryshimit ose z\u00ebvend\u00ebsimit t\u00eb skedarit, IPE mund t\u00eb bllokoj\u00eb operacionin ose t\u00eb regjistroj\u00eb faktin e shkeljes s\u00eb integritetit. <\/p>\n

Mekanizmi i propozuar mund t\u00eb p\u00ebrdoret n\u00eb firmware p\u00ebr pajisje t\u00eb integruara, ku t\u00eb gjitha softueret dhe konfigurimet p\u00ebrgatiten dhe ofrohen ve\u00e7mas nga pronari, p\u00ebr shembull, n\u00eb datacenters, Microsoft IPE p\u00ebrdoret n\u00eb pajisje p\u00ebr firewall. N\u00eb krahasim me sistemet e tjera t\u00eb verifikimit t\u00eb integritetit, si IMA, IPE \u00ebsht\u00eb i pavarur nga metadat n\u00eb FS \u2014 t\u00eb gjitha pron\u00ebsit\u00eb q\u00eb p\u00ebrcaktojn\u00eb lejueshm\u00ebrin\u00eb e operacioneve ruhen drejtp\u00ebrdrejt n\u00eb b\u00ebrtham\u00eb. <\/p>\n

Rregullat p\u00ebrcaktohen n\u00eb form\u00eb tekstuale duke p\u00ebrdorur grupe \u00e7el\u00ebs-vler\u00eb. T\u00eb parat jan\u00eb \u00e7el\u00ebsi \u00abop\u00bb, i cili p\u00ebrcakton operacionin p\u00ebr t\u00eb cilin aplikohet rregulli (p\u00ebr shembull, op=EXECUTE do t\u00eb aktivizohet n\u00eb p\u00ebrpjekjen p\u00ebr ekzekutim), dhe \u00abaction\u00bb, e cila p\u00ebrcakton veprimin (p\u00ebr shembull, \u00abaction=DENY\u00bb p\u00ebr bllokim). Rregullat lidhen me pron\u00ebsit\u00eb q\u00eb ofrohen nga n\u00ebn-sistemet e jashtme, si dm-verity dhe fs-verity. <\/p>\n

P\u00ebr shembull, rregullat op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY do t\u00eb lejojn\u00eb vet\u00ebm ngarkimin nga pjesa e verifikuar, do t\u00eb ndalojn\u00eb ekzekutimin e skedar\u00ebve nga pjes\u00ebt q\u00eb nuk kan\u00eb n\u00ebnshkrime n\u00eb dm-verity, si dhe do t\u00eb ndalojn\u00eb p\u00ebrzgjedhur ekzekutimin e skedarit me hash \u00ab401fce\u20260dec146938\u00bb. <\/p>\n

Grupi fillestar i rregullave t\u00eb ngarkimit p\u00ebrcaktohet p\u00ebrmes konfigurimit SECURITY_IPE_BOOT_POLICY dhe p\u00ebrfshihet n\u00eb nd\u00ebrtimin e kernelit, nd\u00ebrsa rregullat e tjera shtohen sipas nevoj\u00ebs p\u00ebrmes sked\u00ebs \\\/sys\\\/kernel\\\/security\\\/ipe\\\/new_policy. Rregullat e d\u00ebrguara jan\u00eb t\u00eb koduara duke p\u00ebrdorur nj\u00eb certifikat\u00eb t\u00eb p\u00ebrcaktuar n\u00eb SYSTEM_TRUSTED_KEYRING. <\/p>\n

N\u00eb sistemet e zakonshme, sugjerohet t\u00eb aplikohet IPE n\u00eb kombinim me mekanizmin DIGLIM, i zhvilluar nga Huawei. DIGLIM \u00ebsht\u00eb i implementuar p\u00ebrmes eBPF dhe lejon realizimin e leht\u00eb t\u00eb kontrollit t\u00eb integritetit n\u00eb nivelin e skedar\u00ebve t\u00eb ve\u00e7ant\u00eb n\u00eb distribuime t\u00eb zakonshme, pa k\u00ebrkuar p\u00ebrshtatje t\u00eb tyre (paraqitet si nj\u00eb variant i Secure Boot, i cili funksionon n\u00eb nivelin aplikativ). Q\u00ebllimi i DIGLIM \u00ebsht\u00eb t\u00eb mbaj\u00eb nj\u00eb grup verifikuesh nga hash-e p\u00ebr skedar\u00ebt dhe metadatat, dhe t\u00eb ofroj\u00eb akses n\u00eb skedar\u00ebt ekzekutues vet\u00ebm n\u00ebse hash-i i tij \u00ebsht\u00eb i pranish\u00ebm n\u00eb grup. Lista e hash-eve mund t\u00eb merret nga menaxheri i paketave RPM ose e gjeneruar manualisht nga p\u00ebrdoruesi.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043c\u0435\u0442\u043a\u0430\u043c \u0438 \u043f\u0443\u0442\u044f\u043c \u0432 IPE \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438\u043b\u0438 \u0437\u0430\u043f\u0440\u0435\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f. \u041c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u0431\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113980","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft ofroi sistemin e menaxhimit t\u00eb aksesit IPE p\u00ebr kernelin Linux | ProHoster","description":"Kompania paraqiti p\u00ebr diskutim n\u00eb list\u00ebn e d\u00ebrguesve t\u00eb zhvilluesve t\u00eb kernelit Linux kodin e modulit LSM me implementimin e mekanizmit IPE (Integrity Policy Enforcement), i cili zgjeron sistemet ekzistuese t\u00eb menaxhimit t\u00eb detyruesh\u00ebm t\u00eb aksesit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IPE \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u044f\u0434\u0440\u0430 Linux \u043a\u043e\u0434 LSM-\u043c\u043e\u0434\u0443\u043b\u044f \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 IPE (Integrity Policy Enforcement), \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-29T16:25:59+00:00","article:modified_time":"2024-02-29T16:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/113980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=113980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/113980\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=113980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=113980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=113980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}