[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200611170107.GA27737@pi3.com.pl>
Date: Thu, 11 Jun 2020 19:01:07 +0200
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: [p_lkrg] <Exploit Detection> Someone is trying to
execute file: [//////////////]
On Wed, Jun 10, 2020 at 11:04:35PM +0200, Mikhail Morfikov wrote:
> I know that the LKRG's UMH blocking feature is supposed to block execution of
> files from paths which aren't whitelisted (when lkrg.umh_validate is set to
> "1"). But what file is it actually blocking when I get bunch of the following
> messages in the log?
>
> kernel: [p_lkrg] <Exploit Detection> !!! BLOCKING UMH !!!
> kernel: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [//////////////]
> kernel: [p_lkrg] <Exploit Detection> --- . ---
When LKRG blocks execution it overwrites original path with slash chars. If you
see that in the log, it means someone is executing something through UMH which
was already previoussly blocked. You can't restore what was blocked.
>
> I've seen something like the following:
>
> kernel: [p_lkrg] <Exploit Detection> !!! BLOCKING UMH !!!
> kernel: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [/sbin/modprobe]
> kernel: [p_lkrg] <Exploit Detection> --- . ---
>
> And in this case the name is displayed, so there's no problem here, but what
> about the "slasher" file?
>
> Also I have question concerning the feature itself -- will it be possible to
> define some custom paths to be included in the whitelist via sysctl?
>
For now, we only support hardcoded whitelist. You can easily add your own path
to the LKRG source code. Also list is evolving and we adding / removing some
entires.
Btw. modprobe is whitelisted.
Thanks,
Adam
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
