Microsoft yakaronga module yeLinux kernel kuti ione kutendeka kwesystem

Vagadziri veMicrosoft vaburitswa ichangopfuura ruzivo nezve kuiswa kweIPE mashandiro (Kuvimbika Kuteedzera Kuteedzera), inoitwa se module yeLSM (Linux Security Module) yeiyo Linux kernel.

Iyo module ichaita inokutendera iwe kutsanangura yakajairika kutendeseka mutemo weiyo yese system, inoratidza kuti ndeapi mashandiro ari kushanda uye kuti chokwadi cheicho chezvinhu chinofanira kusimbiswa sei. Iine IPE, unogona kudoma kuti ndeapi mafaera anogona kuitiswa uye ita shuwa kuti mafaera aya akafanana neshanduro yakapihwa neyakavimbika nzvimbo. Iyo kodhi yakavhurwa pasi peMIT rezinesi.

Kernel Linux inotsigira maLSM akawanda, kusanganisira SELinux (Linux ine yakasimbiswa chengetedzo) uye AppArmor pakati peanonyanya kuzivikanwa. Microsoft inopa paLinux seyo hwaro hwehunyanzvi hwenzira dzakasiyana siyana uye chirongwa ichi chitsva chakatumidza zita rekuti IPE (Kuvimbika Kwemutemo Kuteedzera).

Izvi zvakagadzirirwa kusimbisa kuvimbika kwekodhi yeLinux kernel, kuona kuti "chero kodhi iri kumhanya (kana mafaera ari kuverengwa) akafanana neshanduro yakagadzirwa neyakavimbika nzvimbo," Microsoft yakati paGitHub.

IPE inovavarira kugadzira zvizere zvinowoneka masisitimu ane huchokwadi hunosimbiswa kubva kubhootloader uye kernel kusvika kune ekupedzisira mafaera ekugadzirisa, kumisikidza uye kurodha pasi.

Kana paine shanduko yefaira kana kutsiva, iyo IPE inogona kuvharira mashandiro kana kurekodha chokwadi chekutyorwa kwekuvimbika. Iyo yakarongedzwa michina inogona kushandiswa mu firmware yemidziyo yakadzika mukati mawo ese ma software uye zvigadziriso zvinounganidzwa uye zvinopihwa kunyanya nemuridzi, semuenzaniso, muMicrosoft data nzvimbo, IPE inoshandiswa mumidziyo ye firewalls.

Kunyangwe iyo kernel ye Linux yatove nemamojuru akati wandei ekuongorora kuvimbika seIMA.

IPE inonyatso kupa kumhanyisa nguva yekumisikidza kodhi yebhanari Microsoft inotaura kuti IPE inosiyana nedzimwe maLSM munzira dzinoverengeka dzavanopa kuvimbika kwechokwadi.

IPE inotsigirawo kubudirira kuongororwa. Kana yagoneswa, zviitiko zvese
iyo inopasa iyo IPE mutemo uye isina kuvharwa ichaburitsa chiitiko chekuongorora.

Iyi module nyowani yakatsanangurwa neMicrosoft, haina kufanana nemamwe maratidziro ekuvimbika, senge IMA. Chinhu chinonakidza nezve IPE ndechekuti inosiyana munzira dzinoverengeka uye yakazvimirira metadata mune iyo systemystem, kunze kweizvozvo zvese zvivakwa zvinotarisisa kushanda kwemabasa zvakachengetwa zvakanangana nekernel.

Semuenzaniso, IPE haitsamiri nefaira system metadata uye hunhu hunovimbiswa neIPE. Zvakare, IPE haiteedzere chero nzira yekuongorora IMA siginecha mafaera. Izvi zvinodaro nekuti iyo Linux kernel yatove nemamojuru ayo, senge dm-chokwadi.

Ndiri kureva izvo kuongorora kutendeseka kweiyo faira yezvinyorwa uchishandisa cryptographic hashes, iyo dm-chokwadi kana fs-chokwadi zvimiro izvo zvatove zviripo mu kernel zvinoshandiswa.

Nekufananidza neSELinux, nzira mbiri dzekushanda dzinotendera uye dzinosungirwa. Mune yekutanga modhi, dambudziko danda rinogadzirwa chete kana uchiita macheki, ayo, semuenzaniso, anogona kushandiswa kwekutanga kuyedzwa kwenzvimbo.

"Zvakanaka, sisitimu inoshandisa IPE haina kuitirwa kuti ishandiswe nemakomputa uye haishandisi yechitatu-software kana marongero," akadaro muparidzi.

Mukuwedzera, the LSM inosimudzirwa neMicrosoft yakagadzirirwa mamwe makesi, seyakaisirwa masystem, uko chengetedzo iri pamberi uye manejimendi manejimendi ari mukutonga kuzere.

Varidzi veSystem vanogona kugadzira avo marongero ekutendeseka macheki uye vanoshandisa yakavakirwa-mukati dm-chokwadi masiginecha kuratidza makodhi.

Kupedzisa, chirongwa chitsva chinounza modha yekuchengetedza yeLinux iyo mamwe ma module asingakwanise kuita kudzivirira iyo system kubva mukuitwa kweyakaipa kodhi.

Finalmente Kana iwe uchida kuziva zvakawanda nezve ruzivo rweiyi module nyowani yakakurudzirwa nevatambi veMicrosoft, unogona kutarisa ruzivo Mune inotevera chinongedzo. Unogona kutarisa sosi kodhi yemo module mu chinotevera chinongedzo.