{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft ofroi sistemin e menaxhimit t\u00eb qasjes IPE p\u00ebr kernelin Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania ka paraqitur p\u00ebr diskutim n\u00eb list\u00ebn e shp\u00ebrndarjes s\u00eb zhvilluesve t\u00eb b\u00ebrtham\u00ebs Linux kodin e modulit LSM me realizimin e mekanizmit IPE (Integriteti i Politik\u00ebs s\u00eb Zbatimit), q\u00eb zgjeron sistemet ekzistuese t\u00eb menaxhimit t\u00eb detyruesh\u00ebm t\u00eb qasjes. N\u00eb vend t\u00eb lidhjes me etiketa dhe rrug\u00eb, n\u00eb IPE vendimi p\u00ebr leje ose ndales\u00eb t\u00eb operacionit merret n\u00eb baz\u00eb t\u00eb pronarive t\u00eb p\u00ebrhershme t\u00eb komponentit sistemor me t\u00eb cilin ekzekutohet operacioni. Moduli lejon p\u00ebrcaktimin e nj\u00eb politike t\u00eb p\u00ebrgjithshme t\u00eb sigurimit t\u00eb integritetit p\u00ebr t\u00eb gjith\u00eb sistemin, duke treguar cilat operacione jan\u00eb t\u00eb mundshme dhe si duhet t\u00eb verifikohet autenticiteti i komponent\u00ebve. <\/p>\n
IPE ka si q\u00ebllim krijimin e sistemeve t\u00eb plot\u00eb q\u00eb mund t\u00eb verifikohen, integriteti i t\u00eb cilave konfirmohet nga ngarkuesi fillestar dhe b\u00ebrthama deri te skedar\u00ebt ekzekutiv\u00eb p\u00ebrfundimtar\u00eb, konfigurimet dhe skedar\u00ebt e ngarkuar. P\u00ebr shembull, me ndihm\u00ebn e IPE mund t\u00eb p\u00ebrcaktohen skedar\u00ebt ekzekutiv\u00eb q\u00eb lejohet t\u00eb ekzekutohen duke kontrolluar p\u00ebrputhshm\u00ebrin\u00eb e tyre me versionin model duke p\u00ebrdorur hash-et kriptografik\u00eb q\u00eb ofrohen nga sistemi dm-verity. N\u00eb rast t\u00eb ndryshimit ose z\u00ebvend\u00ebsimit t\u00eb skedarit, IPE mund t\u00eb bllokoj\u00eb operacionin ose t\u00eb regjistroj\u00eb faktin e shkeljes s\u00eb integritetit. <\/p>\n
Mekanizmi i propozuar mund t\u00eb aplikohet n\u00eb firmware p\u00ebr pajisje t\u00eb integruara, ku gjith\u00eb programi dhe konfigurimet mbledhen dhe ofrohen posa\u00e7\u00ebrisht nga pronari, p\u00ebr shembull, n\u00eb qendrat e t\u00eb dh\u00ebnave Microsoft IPE p\u00ebrdoret n\u00eb pajisjet p\u00ebr firewalle. Nga sistemet tjera t\u00eb kontrollit t\u00eb integritetit, si IMA, IPE dallon me pavar\u00ebsin\u00eb nga metadatate n\u00eb FS \u2014 t\u00eb gjitha pron\u00ebsit\u00eb q\u00eb p\u00ebrcaktojn\u00eb lejueshm\u00ebrin\u00eb e operacioneve ruhen drejtp\u00ebrdrejt n\u00eb kern. <\/p>\n
Rregullat p\u00ebrcaktohen n\u00eb form\u00eb tekstuale duke p\u00ebrdorur sete \u00e7el\u00ebs-vler\u00eb. Thelb\u00ebsoret jan\u00eb \u00e7el\u00ebsi \u00abop\u00bb, q\u00eb p\u00ebrcakton operacionin t\u00eb cilit i aplikohet rregulli (p\u00ebr shembull, op=EXECUTE do t\u00eb aktivizohet me p\u00ebrpjekjen p\u00ebr t\u00eb ekzekutuar), dhe \u00abaction\u00bb, q\u00eb p\u00ebrcakton veprimin (p\u00ebr shembull, \u00abaction=DENY\u00bb p\u00ebr bllokim). Rregullat lidhen me pron\u00ebsit\u00eb e ofruara nga subsistemat e jashtme, si dm-verity dhe fs-verity. <\/p>\n
P\u00ebr shembull, rregullat op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY do t\u00eb lejojn\u00eb vet\u00ebm ngarkimin nga ndarja e v\u00ebrtetuar, do t\u00eb ndalojn\u00eb ekzekutimin e skedar\u00ebve nga ndarjet pa n\u00ebnshkrim n\u00eb dm-verity, si dhe do t\u00eb ndalojn\u00eb n\u00eb m\u00ebnyr\u00eb selektive ekzekutimin e skedarit me hash \u00ab401fce\u20260dec146938\u00bb. <\/p>\n
Grupi fillestar i rregullave t\u00eb ngarkimit p\u00ebrcaktohet me ndihm\u00ebn e konfigurimit t\u00eb SECURITY_IPE_BOOT_POLICY dhe p\u00ebrfshihet n\u00eb nd\u00ebrtimin e b\u00ebrtham\u00ebs, nd\u00ebrsa rregullat e tjera shtohen sipas nevoj\u00ebs p\u00ebrmes skedarit \/sys\/kernel\/security\/ipe\/new_policy. Rregullat e d\u00ebrguara sigurohen me an\u00eb t\u00eb nj\u00eb certifikate q\u00eb p\u00ebrcaktohet n\u00eb SYSTEM_TRUSTED_KEYRING. <\/p>\n
N\u00eb sistemet e zakonshme, propozimi \u00ebsht\u00eb p\u00ebrdorimi i IPE n\u00eb kombinim me mekanizmin DIGLIM, q\u00eb zhvillohet nga kompania Huawei. DIGLIM realizohet me eBPF dhe lejon leht\u00ebsisht realizimin e kontrollit t\u00eb integritetit n\u00eb nivelin e skedar\u00ebve individual\u00eb n\u00eb distribuimet e zakonshme, pa k\u00ebrkuar rishikimin e tyre (paraqitet si nj\u00eb variant i Secure Boot, q\u00eb funksionon n\u00eb nivelin e aplikacioneve). Q\u00ebllimi i DIGLIM \u00ebsht\u00eb mbajtja e nj\u00eb puli t\u00eb hash-eve verifikuese p\u00ebr skedar\u00ebt dhe metadatat dhe ofrimi i qasjes n\u00eb skedar\u00ebt ekzekutiv\u00eb vet\u00ebm n\u00ebse hash-i i tyre \u00ebsht\u00eb i pranish\u00ebm n\u00eb pul. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"