[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20200614130901.GA26740@openwall.com>
Date: Sun, 14 Jun 2020 15:09:01 +0200
From: Solar Designer <solar@...nwall.com>
To: lkrg-users@...ts.openwall.com
Subject: Re: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [//////////////]
Hi Adam,
On Thu, Jun 11, 2020 at 07:01:07PM +0200, Adam Zabrocki wrote:
> On Wed, Jun 10, 2020 at 11:04:35PM +0200, Mikhail Morfikov wrote:
> > I know that the LKRG's UMH blocking feature is supposed to block execution of
> > files from paths which aren't whitelisted (when lkrg.umh_validate is set to
> > "1"). But what file is it actually blocking when I get bunch of the following
> > messages in the log?
> >
> > kernel: [p_lkrg] <Exploit Detection> !!! BLOCKING UMH !!!
> > kernel: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [//////////////]
> > kernel: [p_lkrg] <Exploit Detection> --- . ---
>
> When LKRG blocks execution it overwrites original path with slash chars. If you
> see that in the log, it means someone is executing something through UMH which
> was already previoussly blocked. You can't restore what was blocked.
As discussed previously, I think we should detect this special case (by
checking that the pathname is all-slashes and contains at least two of
them) and log a different message. While we're at it, I think we should
change the three lines above (which may be mixed with other messages) to
just one line, and drop the "Exploit Detection" from there (like we
eventually should from all such messages given our evolutionary
restructuring of LKRG), and drop "Someone" (we have no reason to claim
that a person was involved). So we should have:
kernel: [p_lkrg] Blocked usermodehelper execution of /some/path
the first time, and:
kernel: [p_lkrg] Blocked usermodehelper execution of a previously blocked pathname
I think LKRG is currently unnecessarily verbose and shouting. It should
keep its messages brief and to the point. At the same time, I think
it's preferable to expand the UMH acronym here.
Yes, someone could trigger the second kind of message by trying to
execute all-slashes the first time, but that's OK'ish.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
