Kees Cook, molaoli oa mehleng oa tsamaiso ea kernel.org le moetapele oa Sehlopha sa Ts'ireletso sa Ubuntu eo hona joale a sebetsang ho Google ho boloka Android le ChromeOS, o bontšitse ho tšoenyeha ka ts'ebetso ea hajoale ea ho lokisa likokoana-hloko makaleng a tsitsitseng a kernel. Beke e 'ngoe le e' ngoe, litokiso tse ka bang lekholo li kenyelelitsoe makaleng a tsitsitseng, 'me ka mor'a hore fensetere ea ho amohela liphetoho tokollong e latelang e koetsoe, e atamela sekete (bahlokomeli ba tšoara litokiso ho fihlela fensetere e koaloa, le ka mor'a ho thehoa ha " -rc1" ba phatlalatsa tse bokelletsoeng hang-hang), tse ngata haholo 'me li hloka mosebetsi o mongata bakeng sa lihlahisoa tsa tlhokomelo tse thehiloeng ho Linux kernel.
Ho ea ka Keys, ts'ebetso ea ho sebetsa le liphoso kernel ha e fuoe tlhokomelo e nepahetseng mme kernel e haelloa ke bonyane bahlahisi ba eketsehileng ba 100 bakeng sa mosebetsi o kopanetsoeng sebakeng sena. Bahlahisi ba ka sehloohong ba kernel ba lula ba lokisa liphoso, empa ha ho na tiiso ea hore litokiso tsena li tla fetisetsoa ho mefuta ea kernel e sebelisoang ke batho ba boraro. Basebelisi ba lihlahisoa tse fapaneng tse thehiloeng ho Linux kernel le bona ha ba na mokhoa oa ho laola hore na ke likokoana-hloko life tse lokisitsoeng le hore na ho sebelisoa kernel efe lisebelisoa tsa bona. Qetellong, bahlahisi ba ikarabella bakeng sa ts'ireletso ea lihlahisoa tsa bona, empa ka matla a phahameng haholo a ho hatisa likhatiso makaleng a tsitsitseng a kernel, ba ne ba tobane le khetho - ho kenya lisebelisoa tsohle, ho khetha tse bohlokoa ka ho fetisisa, kapa ho hlokomoloha litokiso tsohle. .
Tharollo e nepahetseng e ka ba ho falla feela litokiso tsa bohlokoa le bofokoli, empa ho arola liphoso tse joalo ho tsoa ho phallo e akaretsang ke bothata bo boholo. Palo e kholo ka ho fetisisa ea mathata a hlahang ke phello ea ho sebelisa puo ea C, e hlokang tlhokomelo e kholo ha u sebetsa ka mohopolo le lintlha. Ho mpefatsa boemo le ho feta, lipache tse ngata tse ka bang kotsing ha li fanoe ka sesupo sa CVE, kapa li fuoa sets'oants'o sa CVE nakoana kamora hore patch e phatlalatsoe. Sebakeng se joalo, ho thata haholo ho bahlahisi ho arola litokiso tse nyane ho tsoa litabeng tsa bohlokoa tsa ts'ireletso. Ho latela lipalo-palo, ho feta 40% ea bofokoli e lokisoa pele CVE e abeloa, 'me ka karolelano tieho lipakeng tsa tokollo ea tokiso le kabelo ea CVE ke likhoeli tse tharo (ke hore, qalong tokiso e nkuoa e le kokoanyana e tloaelehileng, empa feela ka mor'a likhoeli tse 'maloa ho hlakile hore ts'oaetso e lokisitsoe).
Ka lebaka leo, ntle le lekala le arohaneng le nang le litokiso bakeng sa bofokoli le ntle le ho fumana tlhahisoleseding mabapi le khokahanyo ea ts'ireletso ea bothata bo itseng, baetsi ba lihlahisoa tse thehiloeng ho Linux kernel ba tloheloa hore ba tsoele pele ho fetisetsa litokiso tsohle ho tloha makaleng a morao-rao a tsitsitseng. Empa mosebetsi ona o hloka mosebetsi o mongata 'me o tobana le khanyetso lik'hamphani ka lebaka la tšabo ea ho hlaha ha liphetoho tse fokolang tse ka senyang ts'ebetso e tloaelehileng ea sehlahisoa.
A re hopoleng hore ho latela Linus Torvalds, liphoso tsohle li bohlokoa 'me bofokoli ha boa lokela ho aroloa ho mefuta e meng ea liphoso ebe e abeloa sehlopha se ikhethileng sa pele. Maikutlo ana a hlalositsoe ke taba ea hore ho nts'etsopele ea tloaelehileng ea sa sebetseng ka ho khetheha litabeng tsa ts'ireletso, kamano pakeng tsa tokiso le ts'oaetso e ka bang teng ha e hlake (bakeng sa litokiso tse ngata, ke tlhahlobo e arohaneng feela e etsang hore ho khonehe ho utloisisa hore li amana le ts'ireletso. ). Ho ea ka Linus, litsebi tsa ts'ireletso tse tsoang lihlopheng tse ikarabellang bakeng sa ho boloka liphutheloana tsa kernel kabong ea Linux li lokela ho kenya letsoho ho khetholleng bofokoli bo ka bang teng ho tsoa ho li-patches tse akaretsang.
Kees Cook o lumela hore tharollo e le 'ngoe feela ea ho boloka ts'ireletso ea kernel ka litšenyehelo tse telele tsa nako e telele ke hore lik'hamphani li tsamaise lienjineri tse amehang ho lokisoeng ha kernel ea lehae ka boikitlaetso bo kopaneng ba ho boloka litokiso le bofokoli ho kernel e kholo (holimo ho noka). ). Ka mokhoa oa eona oa morao-rao, bahlahisi ba bangata ha ba sebelise liphetolelo tsa morao-rao tsa kernel lihlahisoa tsa bona le ho khutlisetsa litokiso ka tlung, i.e. Hoa fumaneha hore baenjiniere ba lik'hamphani tse fapaneng ba etsisa mosebetsi oa e mong, ba rarolla bothata bo tšoanang.
Mohlala, haeba lik'hamphani tse 10, e 'ngoe le e 'ngoe e e-na le moenjiniere a le mong ea tšehetsang litokiso tse tšoanang, li abela lienjiniere tseo ho lokisa litšitšili sebakeng se ka holimo, ho e-na le ho khutlisa tokiso e le' ngoe, li ka lokisa liphoso tse 10 tse fapaneng molemong oa bohle kapa tsa kenella tlhahlobong ea tlhahiso e reriloeng. liphetoho le ho thibela buggy code ho kenyeletsoa kernel. Lisebelisoa li ka boela tsa neheloa ho theheng lisebelisoa tse ncha tsa ho etsa liteko le ho sekaseka khoutu e tla lumella ho bonoa kapele ha lihlopha tse tloaelehileng tsa liphoso tse hlahang khafetsa.
Kees Cook o boetse a fana ka maikutlo a ho sebelisa liteko tse ikemetseng le tse fuzzing ka kotloloho ts'ebetsong ea nts'etsopele ea kernel, a sebelisa lits'ebetso tse tsoelang pele tsa kopanyo le ho lahla taolo ea nts'etsopele ea khale ka lengolo-tsoibila. Hajoale, tlhahlobo e sebetsang e sitisoa ke taba ea hore lits'ebetso tse kholo tsa tlhahlobo li arohane le nts'etsopele mme li etsahala ka mor'a hore litollo li thehoe. Li-keys li boetse li khothaletsoa ho sebelisa lipuo tse fanang ka boemo bo holimo ba ts'ireletso, joalo ka Rust, ha ho etsoa ho fokotsa palo ea liphoso.
Source: opennet.ru