[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190408171539.GA8678@pi3.com.pl>
Date: Mon, 8 Apr 2019 19:15:39 +0200
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: Whitelisting LivePatch
Hey,
I would not call it False Positive since LKRG does the correct job detecting
kernel .text modification.
I didn't analyze specifically Canonical LivePatch but in general I would assume
it is doable to whitelist live-patching technology via hooking into internals
of LivePatch software and monitor their events.
Currently, we don't whitelist any live-patching technology but there are
various of them in the market, including:
- kpatch - merged into kernel vanilla mainline since Linux 4.x
- KernelCare - developed by CloudLinux
- ksplice
- kGraft
- Canonical LivePatch
- probably more
I don't see the reason why we should have exception just for Canonical
LivePatch. If we would want to support LivePatching, we should consider
whitelisting all of them. Currently, it is out-of-scope but it doesn't mean it
will not be in the future. If this happens, then we would need to evaluate
which technology should be the first to cover.
Btw. Some of the advanced functionalities that are of commercial (business)
relevance might be done via contractor work. In such case, the results would be
merged to the mainline of the project.
Thanks,
Adam
On Wed, Apr 03, 2019 at 10:37:39PM +0100, Paweł Krawczyk wrote:
> I'm hitting this false positive quite frequently and I was just
> wondering if there is any way to modify p_lkrg to whitelist this type of
> changes? What Canonical LivePatch does is, well, essentially patch the
> living kernel which obviously changes the code signature. LivePatch
> works through a kernel module called lkp_Ubuntu_4_15_0_45_48_generic_49
> (or similar).
>
>
> Apr 2 11:58:43 otto kernel: [3675742.580321] livepatch: enabling patch
> 'lkp_Ubuntu_4_15_0_45_48_generic_49'
> Apr 2 11:58:43 otto kernel: [3675742.585073] livepatch:
> 'lkp_Ubuntu_4_15_0_45_48_generic_49': starting patching transition
> Apr 2 11:58:43 otto kernel: [3675742.740469] [p_lkrg] ALERT !!! _STEXT
> MEMORY BLOCK HASH IS DIFFERENT - it is [0x918a7a1fc13e7dc9] and should
> be [0xfb806a7dd458b274] !!!
> Apr 2 11:58:43 otto kernel: [3675742.743774] [p_lkrg] ALERT !!! SYSTEM
> HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> Apr 2 11:58:44 otto kernel: [3675743.259222] [p_lkrg] ALERT !!! _STEXT
> MEMORY BLOCK HASH IS DIFFERENT - it is [0x918a7a1fc13e7dc9] and should
> be [0xfb806a7dd458b274] !!!
> Apr 2 11:58:44 otto kernel: [3675743.262512] [p_lkrg] ALERT !!! SYSTEM
> HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> Apr 2 11:58:44 otto kernel: [3675743.834990] [p_lkrg] ALERT !!! _STEXT
> MEMORY BLOCK HASH IS DIFFERENT - it is [0x918a7a1fc13e7dc9] and should
> be [0xfb806a7dd458b274] !!!
> Apr 2 11:58:44 otto kernel: [3675743.837264] [p_lkrg] ALERT !!! SYSTEM
> HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> Apr 2 11:58:45 otto kernel: [3675744.201058] livepatch:
> 'lkp_Ubuntu_4_15_0_45_48_generic_49': patching complete
>
>
> --
> Paweł Krawczyk
> +44 7879 180015
>
>
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
