[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <114fb2fe-65b0-d844-4815-8eed1ba4a2b9@riseup.net>
Date: Fri, 24 Jan 2020 10:21:43 +0000
From: Patrick Schleizer <adrelanos@...eup.net>
To: lkrg-users@...ts.openwall.com
Subject: UMH blocked when though lkrg.block_modules = 0
sudo dmesg | grep lkrg
[ 89.832261] p_lkrg: loading out-of-tree module taints kernel.
[ 89.850921] p_lkrg: module verification failed: signature and/or
required key missing - tainting kernel
[ 89.852290] [p_lkrg] Loading LKRG...
[ 91.952994] [p_lkrg] LKRG initialized successfully!
[ 92.017905] [p_lkrg] Disabling MSRs verification during CI.
[ 92.047093] [p_lkrg] [ED] New pCFI configuration => 1 (No stackwalk
(weak))
[ 510.949628] [p_lkrg] <Exploit Detection> !!! BLOCKING UMH !!!
[ 510.949632] [p_lkrg] <Exploit Detection> Someone is trying to execute
file: [/bin/false]
[ 510.949633] [p_lkrg] <Exploit Detection> --- . ---
sudo sysctl -a | grep lkrg
lkrg.block_modules = 0
lkrg.ci_panic = 0
lkrg.clean_message = 0
lkrg.enforce_msr = 0
lkrg.enforce_pcfi = 1
lkrg.force_run = 0
lkrg.hide = 0
lkrg.log_level = 1
lkrg.random_events = 1
lkrg.smep_panic = 1
lkrg.timestamp = 15
lkrg.umh_lock = 0
It was probably caused by sysctl "kernel.core_pattern=|/bin/false".
Kind regards,
Patrick
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
