{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"Metoda p\u00ebr shk\u00ebputjen e mbrojtjes Lockdown n\u00eb Ubuntu p\u00ebr anashkalimin e UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andi Konovalov nga kompania Google publikoi<\/a><\/noindex> metoda p\u00ebr \u00e7aktivizimin e mbrojtjes n\u00eb distanc\u00eb Lockdown<\/a><\/noindex>, e ofruar n\u00eb paket\u00ebn me b\u00ebrtham\u00ebn Linux, t\u00eb shp\u00ebrndar\u00eb n\u00eb Ubuntu (metodat teorikisht t\u00eb propozuara duhet<\/a><\/noindex> t\u00eb funksionojn\u00eb me b\u00ebrtham\u00ebn Fedora dhe shp\u00ebrndarje t\u00eb tjera, por ato nuk jan\u00eb testuar). <\/p>\n

Lockdown kufizon qasjen e p\u00ebrdoruesit root n\u00eb b\u00ebrtham\u00eb dhe bllokon rrug\u00ebt p\u00ebr rreth UEFI Secure Boot. P\u00ebr shembull, n\u00eb modalitetin lockdown, kufizohet qasja n\u00eb \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, modalitetin e ndihm\u00ebs kprobes, mmiotrace, tracefs, BPF, CIS t\u00eb PCMCIA (Struktura e Informacionit t\u00eb Kart\u00ebs), disa interfesa ACPI dhe regjistrat MSR t\u00eb CPU, ndalohen thirrjet kexec_file dhe kexec_load, ndalohet kalimi n\u00eb gjumin e thell\u00eb, limitohet p\u00ebrdorimi i DMA p\u00ebr pajisjet PCI, ndalohet importimi i kodit ACPI nga variablat EFI, dhe nuk lejohet manipulimi me portet hyr\u00ebse\/dal\u00ebse, p\u00ebrfshir\u00eb ndryshimin e numrit t\u00eb nd\u00ebrhyrjes dhe portit hyr\u00ebs\/dal\u00ebs p\u00ebr portin serial.<\/p>\n

Mekanizmi Lockdown u shtua koh\u00ebt e fundit n\u00eb p\u00ebrb\u00ebrjen kryesore t\u00eb b\u00ebrtham\u00ebs Linux 5.4<\/a><\/noindex>, por n\u00eb b\u00ebrthamat e shp\u00ebrndara n\u00eb shp\u00ebrndarje, ai ende zbaton n\u00eb form\u00ebn e patches ose kompletuar me patches. Nj\u00eb nga dallimet q\u00eb ofrohen n\u00eb p\u00ebrmir\u00ebsimet e shp\u00ebrndara nga implementimi i integruar n\u00eb b\u00ebrtham\u00eb \u00ebsht\u00eb mund\u00ebsia p\u00ebr t\u00eb \u00e7aktivizuar bllokimin e ofruar n\u00ebse ka qasje fizike n\u00eb sistem. <\/p>\n

N\u00eb Ubuntu dhe Fedora, p\u00ebr t\u00eb \u00e7aktivizuar Lockdown, \u00ebsht\u00eb parashikuar nj\u00eb kombinim \u00e7el\u00ebsash Alt+SysRq+X. Supozohet se kombinimi Alt+SysRq+X mund t\u00eb p\u00ebrdoret vet\u00ebm me qasje fizike n\u00eb pajisje, dhe n\u00eb rastin e nj\u00eb shkeljeje n\u00eb distanc\u00eb dhe marrjes s\u00eb qasjes root, sulmuesi nuk do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb \u00e7aktivizoj\u00eb Lockdown dhe, p\u00ebr shembull, t\u00eb ngarkoj\u00eb n\u00eb b\u00ebrtham\u00eb nj\u00eb modul t\u00eb pad\u00ebshmuar me digastimin digjital me rootkit. <\/p>\n

Andrei Konovalov tregoi se metodat q\u00eb lidhen me p\u00ebrdorimin e tastier\u00ebs p\u00ebr konfirmimin e pranis\u00eb fizike t\u00eb p\u00ebrdoruesit nuk jan\u00eb efektive. Nj\u00eb m\u00ebnyr\u00eb e thjesht\u00eb p\u00ebr t\u00eb \u00e7aktivizuar Lockdown do t\u00eb ishte simulimi programatik i<\/a><\/noindex> shtypjes s\u00eb Alt+SysRq+X p\u00ebrmes \/dev\/uinput, por ky opsion \u00ebsht\u00eb bllokuar fillimisht. Megjithat\u00eb, u identifikuan t\u00eb pakt\u00ebn dy m\u00ebnyra tjet\u00ebr p\u00ebr t\u00eb ng\u00ebrthyer Alt+SysRq+X. <\/p>\n

\u041f\u0435\u0440\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 «sysrq-trigger» — \u0434\u043b\u044f \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u044d\u0442\u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u0437\u0430\u043f\u0438\u0441\u0430\u0432 «1» \u0432 \/proc\/sys\/kernel\/sysrq, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c «x» \u0432 \/proc\/sysrq-trigger. \u0423\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u0430 \u00ebsht\u00eb eliminuar<\/a><\/noindex> u identifikua n\u00eb p\u00ebrdit\u00ebsimin e dhjetorit t\u00eb b\u00ebrtham\u00ebs Ubuntu dhe n\u00eb Fedora 31. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se zhvilluesit, ashtu si n\u00eb rastin e \/dev\/uinput, fillimisht p\u00ebrpiqeshin<\/a><\/noindex> bllokoni k\u00ebt\u00eb metod\u00eb, por bllokimi nuk funksionoi p\u00ebr shkak t\u00eb gabimit<\/a><\/noindex> kodit.<\/p>\n

M\u00ebnyra e dyt\u00eb lidhet me emulimin e tastier\u00ebs p\u00ebrmes USB\/IP<\/a><\/noindex> dhe d\u00ebrgimin e m\u00ebposht\u00ebm t\u00eb sekuenc\u00ebs Alt+SysRq+X me tastier\u00ebn virtuale. N\u00eb b\u00ebrtham\u00ebn e ofruar n\u00eb Ubuntu, USB\/IP \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb parazgjedhje (CONFIG_USBIP_VHCI_HCD=m dhe CONFIG_USBIP_CORE=m) dhe jan\u00eb ofruar modul\u00ebt e nevojsh\u00ebm t\u00eb pun\u00ebs, t\u00eb certifikuar me n\u00ebnshkrim digjital usbip_core dhe vhci_hcd. Sulmuesi mund t\u00eb krijoj\u00eb<\/a><\/noindex> nj\u00eb pajisje USB virtuale, duke filluar<\/a><\/noindex> p\u00ebrpunuesin e rrjetit n\u00eb nd\u00ebrfaqen loopback dhe duke e lidhur at\u00eb si nj\u00eb pajisje USB t\u00eb larg\u00ebt p\u00ebrmes USB\/IP. Rreth k\u00ebsaj metode \u00ebsht\u00eb raportuar<\/a><\/noindex> te zhvilluesit e Ubuntu, por nj\u00eb rregullim ende nuk \u00ebsht\u00eb l\u00ebshuar.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Metodat p\u00ebr \u00e7aktivizimin e mbrojtjes Lockdown n\u00eb Ubuntu p\u00ebr anashkalimin e UEFI Secure Boot | ProHoster","description":"Andrei Konovalov nga kompania Google publikoi nj\u00eb metod\u00eb p\u00ebr \u00e7aktivizimin e mbrojtjes","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b","og:url":"https:\/\/prohoster.info\/sq\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}