{"id":38554,"date":"2019-10-31T22:24:30","date_gmt":"2019-10-31T19:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra\/"},"modified":"2019-10-31T22:24:30","modified_gmt":"2019-10-31T19:24:30","slug":"v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","title":{"rendered":"I Linux-k\u00e4rnan 5.4 har patchar antagits f\u00f6r att begr\u00e4nsa root-\u00e5tkomsten till k\u00e4rnans inre","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linus Torvalds har accepterats<\/a><\/noindex> I kommande version av Linux-k\u00e4rnan 5.4 ing\u00e5r en upps\u00e4ttning patchar «lockdown<\/a><\/noindex>« f\u00f6reslagen<\/a><\/noindex>\tDavid Howells (som arbetar p\u00e5 Red Hat) och Matthew Garrett (Matthew Garrett<\/a><\/noindex>, som utvecklas av Google, f\u00f6r att begr\u00e4nsa root-anv\u00e4ndarens \u00e5tkomst till k\u00e4rnan. Den relaterade «lockdown»-funktionen har flyttats till en valfri LSM-modul som laddas vid behov (Linux Security Module<\/a><\/noindex>), som skapar en barri\u00e4r mellan UID 0 och k\u00e4rnan, vilket begr\u00e4nsar viss l\u00e5g niv\u00e5-funktionalitet.<\/p>\n

Om en angripare genom ett angrepp lyckas k\u00f6ra kod med root-r\u00e4ttigheter kan han k\u00f6ra sin kod \u00e4ven p\u00e5 k\u00e4rnniv\u00e5, exempelvis genom att byta k\u00e4rna med hj\u00e4lp av kexec eller l\u00e4sa\/skriva minne via \/dev\/kmem. Den mest uppenbara f\u00f6ljden av s\u00e5dan aktivitet kan bli omlopp<\/a><\/noindex> UEFI Secure Boot eller extrahering av konfidentiella data lagrade p\u00e5 k\u00e4rnniv\u00e5.<\/p>\n

I f\u00f6rsta hand har funktioner f\u00f6r att begr\u00e4nsa root utvecklats inom ramen f\u00f6r att f\u00f6rst\u00e4rka skyddet f\u00f6r verifierad boot, och distributioner har l\u00e4nge anv\u00e4nt tredjepartspatchar f\u00f6r att blockera omloop av UEFI Secure Boot. Samtidigt har s\u00e5dana begr\u00e4nsningar inte inkluderats i k\u00e4rnans huvudstr\u00f6mlinje p\u00e5 grund av meningsskiljaktigheter<\/a><\/noindex> i deras implementation och oro f\u00f6r att st\u00f6ra befintliga system. «Lockdown»-modulen har sammanfogat patchar som redan anv\u00e4nds i distributioner, vilka har omarbetats till en separat delsystem, som inte \u00e4r kopplad till UEFI Secure Boot. <\/p>\n

I lockdown-l\u00e4ge begr\u00e4nsas \u00e5tkomsten till \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobes-debuggerl\u00e4ge, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), vissa ACPI-gr\u00e4nssnitt och CPU:s MSR-register, anrop av kexec_file och kexec_load blockeras, \u00f6verg\u00e5ng till vilol\u00e4ge f\u00f6rbjuds, anv\u00e4ndning av DMA f\u00f6r PCI-enheter begr\u00e4nsas, import av ACPI-kod fr\u00e5n EFI-variabler f\u00f6rbjuds,
\nmanipulationer med in- och utportar, inklusive \u00e4ndringar av avbrottsnumer och ing\u00e5ngs-\/utg\u00e5ngsport f\u00f6r seriell port, till\u00e5ts inte. <\/p>\n

Som standard \u00e4r lockdown-modulen inaktiverad, den byggs med inst\u00e4llningen SECURITY_LOCKDOWN_LSM i kconfig och aktiveras via k\u00e4rnparametern «lockdown=», kontrollfilen «\\\/sys\\\/kernel\\\/security\\\/lockdown» eller byggalternativ LOCK_DOWN_KERNEL_FORCE_*<\/a><\/noindex>, som kan anta v\u00e4rdena «integrity» och «confidentiality». I det f\u00f6rsta fallet blockeras m\u00f6jligheterna att g\u00f6ra \u00e4ndringar i den k\u00f6rande k\u00e4rnan fr\u00e5n anv\u00e4ndarutrymmet, och i det andra fallet inaktiveras dessutom funktionaliteten som kan anv\u00e4ndas f\u00f6r att extrahera konfidentiell information fr\u00e5n k\u00e4rnan.<\/p>\n

Det \u00e4r viktigt att p\u00e5peka att lockdown endast begr\u00e4nsar de inbyggda tillg\u00e5ngarna till k\u00e4rnan, men skyddar inte mot modifieringar p\u00e5 grund av utnyttjande av s\u00e5rbarheter. F\u00f6r att hindra \u00e4ndringar i det k\u00f6rande k\u00e4rnan vid anv\u00e4ndning av exploateringar av projektet Openwall utvecklas<\/a><\/noindex> en separat modul LKRG<\/a><\/noindex> (Linux Kernel Runtime Guard).<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044f\u0434\u0440\u0430 Linux 5.4 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 «lockdown«, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0414\u044d\u0432\u0438\u0434\u043e\u043c \u0425\u043e\u0443\u044d\u043b\u043b\u0441\u043e\u043c (David Howells, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Red Hat) \u0438 \u041c\u044d\u0442\u044c\u044e \u0413\u0430\u0440\u0440\u0435\u0442\u043e\u043c (Matthew Garrett, \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 Google) \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443. \u0421\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 «lockdown» \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 LSM-\u043c\u043e\u0434\u0443\u043b\u044c (Linux Security Module), \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0431\u0430\u0440\u044c\u0435\u0440 \u043c\u0435\u0436\u0434\u0443 UID 0 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Patchar f\u00f6r att begr\u00e4nsa root-tillg\u00e5ng till k\u00e4rnans interna funktioner har antagits i Linux 5.4 | ProHoster","description":"Linus Torvalds har godk\u00e4nt f\u00f6r kommande version.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u043e Linux 5.4 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 root \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u044f\u0434\u0440\u0430 | ProHoster","og:description":"\u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0438\u043d\u044f\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-yadro-linux-5-4-prinyaty-patchi-dlya-ogranicheniya-dostupa-root-k-vnutrennostyam-yadra","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:30+00:00","article:modified_time":"2019-10-31T19:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:07:39","updated":"2026-01-23 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/38554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=38554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/38554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=38554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=38554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=38554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}