云网牛站
所在位置:首页 > Linux新闻 > OpenWall正式开源Linux内核安全卫士LKRG

OpenWall正式开源Linux内核安全卫士LKRG

2018-02-07 09:19:36作者:王练稿源:开源中国

OpenWall 近期开源了一个新的内核防护项目 LKRG(全称为 Linux Kernel Runtime Guard),这是一个可加载的核心模块,可用来检查 Linux 内核的运行完整性,并侦测针对该内核的攻击。

OpenWall正式开源Linux内核安全卫士LKRG

 

LKRG 是一个内核模块而非补丁,可用于主流的 Linux 发行版本中,主要有两大功能。一是在 Linux 系统中开发扩展功能时实施各种规定,以避免那些不被 Linux 内核支持的更改;另外一个则是侦测针对内核的攻击,例如当内核要根据未授权的凭证赋予读取权限时加以拦截。

 

不过,OpenWall 同时强调,LKRG 目前仍处于早期实验阶段,版本为 v0.0,不排除偶尔出现误报的情况。

 

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645615] [p_lkrg] <Exploit Detection> Detected pointer swapping attack!process[1486 | exploit_no_smap] has different 'cred' pointer [0xffff9560a5d886c0 vs 0xffff9560a5d88300]

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645653] [p_lkrg] <Exploit Detection> Detected pointer swapping attack!process[1486 | exploit_no_smap] has different 'real_cred' pointer [0xffff9560a5d886c0 vs 0xffff9560a5d88300]

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645685] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different UID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645704] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different EUID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645723] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different SUID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645742] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different FSUID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645761] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different GID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645780] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different EGID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645799] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different SGID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645817] [p_lkrg] <Exploit Detection> process[1486 | exploit_no_smap] has different FSGID! 1000 vs 0

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645836] [p_lkrg] <Exploit Detection> Detected SECCOMP corruption!process[1486 | exploit_no_smap] has corrupted TIF_SECCOMP flag! [1 vs 0]

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645862] [p_lkrg] <Exploit Detection> Detected SECCOMP corruption!process[1486 | exploit_no_smap] has different SECCOMP mode! [SECCOMP_MODE_FILTER vs SECCOMP_MODE_DISABLED]

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645894] [p_lkrg] <Exploit Detection> Detected SECCOMP corruption!process[1486 | exploit_no_smap] has different SECCOMP filter pointer! [0xffff9560a4345600 vs 0x          (null)]

Dec 19 19:33:58 pi3-ubuntu kernel: [   70.645925] [p_lkrg] <Exploit Detection> Trying to kill process[exploit_no_smap | 1486]!

Dec 19 19:35:25 pi3-ubuntu kernel: [  157.976342] hv_balloon: Balloon request will be partially fulfilled. Balloon floor reached.

 

相关主题

在Ubuntu/Ubuntu Kylin上安装360安全卫士

精选文章
热门文章