Elementi taggati con: kernel
#backdoor kernel Allwinner : labriqueinter.net sauve
une nouvelle affaire de mauvais code et de #blob propriétaire fait tourner les blogs techniques : #Allwinner a laissé une faille dans son #kernel compilé distribué et utilisé par nombre de fabriquants, qui permet à n'importe quelle application de prendre des privilèges root...
Mais bonne nouvelle : ni le kernel utilisé par #Olimex ni la distribution #Debian sur laquelle est basée la brique ne sont vulnérables à ce qu'il semble... joie ;)
* l'histoire du backdoor : http://www.minimachines.net/actu/allwinner-backdoor-kernel-linux-40354
* la réponse d'Olimex : https://olimex.wordpress.com/2016/05/10/how-to-root-any-allwinner-device-running-android-and-most-of-the-chinese-pi-clones-which-bet-on-allwinner-android-linux-kernel/
#floss #securité #OSH
The dream of running mainline kernels on #Android devices has not yet been achieved, but it may be closer than many people think.#kernel #linux
Linux retira el algoritmo de cifrado Speck creado por la NSA
#hacktivismo #kernel #nsa
Quizás nunca debió estar ahí. Hablamos de Speck, un algoritmo de cifrado desarrollado por la NSA, incluido por primera vez en la edición 4.17 del kernel, el pasado mes de junio. Speck no fue diseñado para ser irrompible ni extremadamente seguro. Su objetivo era proveer
Most of the internet could be affected as some Linux devs threaten to rescind code in response to the Leftist's #Code-of-Conduct invasion.
#Linux powers the #internet, the #Android in your pocket, and perhaps even some of your #household #appliances. A #controversy over #politics is now seeing some of its #developers threatening to #withdraw the #license to all of their #code, potentially #destroying or making the whole #Linux #kernel #unusable for a very long time.
Contributors can, at any time, #rescind the #license grant regarding their #property via written notice to those whom they are rescinding the grant from (regarding their property (code)) .
The #GPL version 2 lacks a #no-rescission-clause (the GPL version 3 has such a clause: to attempt furnish defendants with an estoppel defense, the Linux Kernel is licensed under version 2, however, as are the past contributions).
HiSilicon is looking to add WarpDrive to the Linux kernel. Not to be confused with anything from Star Trek, WarpDrive is a generic accelerator framework they have been developing.
Update: 2018.07 – it’s getting worse – steal bytes WITHOUT RUNNING ANY CODE
this attack is SUPER SLOW but it could steal arbitrary Bytes (how many bytes are one root password? (well yes you would to have to know in advance where exactly the root password is in memory and then it is probably (hopefully) not in an unencrypted state but in an sha512sum hashed/encrypted state) from routers and servers WITHOUT RUNNING ANY CODE on the system itself?
(this will hit the AngularJS, JQuery and NoScript guys BADLY, Richard Stallmann is right.)
mirror: GuardION – Practical Mitigation of DMA-based – Rowhammer Attacks on ARM – Vrije Universiteit Amsterdam.pdf
Hello \#Firefox, this is \#Meltdown. And these are your passwords.
… intel, i think you just broke the internet.
Update: Android and ARM affected – iPhones too?
„Over the last two years, the Rowhammer bug transformed from a hard-to-exploit DRAM disturbance error into a fully weaponized attack vector“
Paper on RowHammer: https://gruss.cc/files/rowhammerjs.pdf
Doesn’t this sound great?
2015: RowHammer.js (src)
„Insanity: doing the same thing over and over again and expecting different results.“
Albert Einstein – Who did not live long enough to see Rowhammer
Google is downplaying the problem.
the paper continues:
„Researchers demonstrated exploits not only against desktop computers, but also used single bit flips to compromise the cloud and mobile devices, all without relying on any software vulnerability.
Since hardware-level mitigations cannot be backported, a search for software defenses is pressing.
Proposals made by both academia and industry, however, are either impractical to deploy, or insufficient in stopping
all attacks: we present rampage, a set of DMA-based Rowhammer attacks against the latest Android OS, consisting of (1) a root exploit, and (2) a series of app-to-app exploit scenarios that bypass all defenses.
To mitigate Rowhammer exploitation on ARM, we propose guardion, a lightweight defense that prevents DMA-based attacks – the main attack vector on mobile devices – by isolating DMA buffers with guard rows.
We evaluate guardion on 22 benchmark apps and show that it has a negligible memory overhead (2.2 MB on average).
We further show that we can improve system performance by re-enabling higher order allocations after Google disabled these as a reaction to previous attacks.“
Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation
risc v is very new: https://wiki.debian.org/InstallingDebianOn/SiFive/HiFiveUnleashed
buy here: [url=https://www.crowdsupply.com/sifive/hifive1]https://www.crowdsupply.com/sifive/hifive1[/url]
why no ethernet port per default? Freedom U540
<span style="color: #ff6600;"><strong>From: David Woodhouse Date: Sun Jan 21 2018 - 15:28:51 EST</strong></span> ```- **Next message:** [ulrik . debie-os: „Re: \[PATCH\] Input: trackpoint – force 3 buttons if 0 button is reported“]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04602.html]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04602.html[/url]) - **Previous message:** [David Lechner: „\[PATCH\] mmc: davinci: suppress error message on EPROBE\_DEFER“]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04600.html]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04600.html[/url]) - **In reply to:** [Andy Lutomirski: „Re: \[RFC 09/10\] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation“]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/06508.html]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/06508.html[/url]) - **Next in thread:** [Linus Torvalds: „Re: \[RFC 09/10\] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation“]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04628.html]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04628.html[/url]) - **Messages sorted by:** [\[ date \]]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/date.html#04601]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/date.html#04601[/url]) [\[ thread \]]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/index.html#04601]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/index.html#04601[/url]) [\[ subject \]]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/subject.html#04601]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/subject.html#04601[/url]) [\[ author \]]([url=http://lkml.iu.edu/hypermail/linux/kernel/1801.2/author.html#04601]http://lkml.iu.edu/hypermail/linux/kernel/1801.2/author.html#04601[/url]) - - - - - -
On Sun, 2018-01-21 at 11:34 -0800, Linus Torvalds wrote:
> All of this is pure garbage.
> Is Intel really planning on making this shit architectural? Has
> anybody talked to them and told them they are f*cking insane?
> Please, any Intel engineers here - talk to your managers.Â
If the alternative was a two-decade product recall and [color="#ff0000"]giving everyone[/color]
[color="#ff0000"] free CPUs, I'm not sure it was entirely insane.[/color]
Certainly it's a nasty hack, but hey â the world was on fire and in the end we didn't have to just turn the datacentres off and go back to goat farming, so it's not all bad.
```my comment: that is exactly what Intel OUGHT to do: recall all CPUs of the last 20 years.
IMHO the „motive“ of intel/AMD is pretty clear: „yes we admit our product is flawed – we try to give you a choice: flip the IBRS_ALL bit and get a 20% speed penalty but (probably) fix the security whole. Or leave the whole wide open because your infrastructure is physically shielded against intruders and NOT connected to the internet.“
Another possibility: fire their managers close down and start over under a new name with a new design and a hacking team that tries to constantly break things?
That would be the clean thing to do to save their economic asses uh i mean assets.
But that will not be enough: Intel / AMD / CPU and Hardware manufacturer: To avoid future mistakes follow the UNIX philosophy: 1. Simplify 2. Simplify 3. Simplify – everything.
Even Dr Sheldon Cooper or Einstein makes mistakes: Complexity is THE ENEMY in this game for perfection. (that only god and/or nobody can achieve, check out the „perfect software“ paradigm)
if you don’t believe me, you might believe: McIlroy:
„We used to sit around in the Unix Room saying, ‚What can we throw out? Why is there this option?‘
It’s often because there is some deficiency in the basic design — you didn’t really hit the right design point.
Instead of adding an option, think about what was forcing you to add that option.“
Never the less errors will be made: If architectural / design errors surface that can not be fixed by software – there should be some kind of recall mechanism, but this is expensive for the producer, so what probably happens is: Make the customer / re-seller bear the risk: If you want to run a Intel based computer, you will have to agree to some disclaimer like on software:
„THIS CPU IS SOLD „AS IS“ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
You are solely responsible for determining the appropriateness of using or redistributing this CPU and assume any risks associated with Your exercise of permissions under this License.“
Means: We don’t know if we just sold you a bunch of crap technology with unfixable security wholes – because this product is so complex – we kind of lost control over it’s quality – so all risk is on YOU!
That is just how mankind is: Apes with complex technology and technology dependent lifestyles that could get out of hand if no learning curve existed: so simplify, simplify, simplify!
Let’s just hope your lifestyle has no unfixable security problems.
Even worse: The monetary system actually might „encourage“ to repeat mistakes such as war – because it is good money for the „hardware“ (weapons) manufacturers.
And that is exactly what Intel will do: Save it’s ass – despite the flood (32 and more) lawsuits.
So Intel tries to sell it’s fix as „security“ and will not compensate the damaged datacenter owners – which probably are forced to rebuy, rebuy, rebuy Intel’s new CPU or go to an alternative CPU manufacturer that does not have this trouble (is there still one? Apple gave up on that… MISTAKE! another reason why monoculture sucks – not only in farming and nature).
Look at traffic: You could go by train, by car or by bus or by airplane or bicycle or horse or elephant or soon: DroneTaxi or or simply: walk.
There are basically completely different „methods“ of doing the same thing: travel distances and/or transport stuff.
And thus provide redundancy for the: travel/transport problem.
But redundancy costs money… repeating mistakes does too.
Oracle SPARC has the same problems.
This could be THE CHANCE for alternative CPU manufactureres and maybe even: Open Hardware?
„The RISC-V Foundation says that no currently announced RISC-V CPU is vulnerable to Meltdown and Spectre“
„Until recently, RISC-V hadn’t seen much adoption in industry, but, in the past two years, Nvidia and Western Digital both announced that they would be adopting RISC-V CPUs. In light of the recent Meltdown/Spectre issue, the RISC-V foundation has released a statement on the vulnerabilities’ impact on RISC-V development.“
„As CISC raises too many verification problems, and a closed-source chip design cannot be trusted, the only solution is open-source RISC:“
OpenSPARC T1 is the open source version of the UltraSPARC T1 processor, a multi-core, 64-bit multiprocessor. The UltraSPARC T1 processor with CoolThreadstechnology was the highest-throughput and most eco-responsible processor ever created when it became available in the UltraSPARC T1 system. It was a breakthrough discovery for reducing data center energy consumption, while dramatically increasing throughput. Its 32 simultaneous processing threads, drawing about as much power as a light bulb, gave customers the best performance per watt of any processor available.
OpenSPARC T1 source components are covered under multiple open source licenses. The majority of OpenSPARC T1 source code is released under the GNU General Public License. GNU General Public License Source based on existing open source projects will continue to be available under their current licenses. Binary programs are released under a binary Software License Agreement.
Docs & Specs
Is Open Source RISC-V Ready to Take on Intel, AMD, and ARM in the Data Center?
Open source startup SiFive introduces a single board computer running Linux on the open RISC-V architecture. Is the data center next?
costly RISC-V mainboard and CPU: https://www.crowdsupply.com/sifive/hifive-unleashed
LinuxGizmos.com:“Aside from being open source and customizable, one of the main benefits of RISC-V is that it is fully modern, purpose built, and unburdened with legacy code.“
costly dev board: https://www.crowdsupply.com/microsemi/hifive-unleashed-expansion-board
… but only if we (can) buy it.
Debian supported CPU architectures:
Motorola 680x0: | m68k - Atari | - atari - Amiga | - amiga - 68k Macintosh | - mac - VME | - bvme6000 | - mvme147 | - mvme16x | DEC Alpha | alpha | - generic | - jensen | - nautilus | Sun SPARC | sparc | - sun4cdm | - sun4u The UltraSPARC class systems fall under the sun4u identifier, and are supported using the sun4u set of install images. | ARM and StrongARM | arm | - netwinder | - riscpc | - shark | - lart | IBM/Motorola PowerPC | powerpc - CHRP | - chrp - PowerMac | - powermac, new-powermac - PReP | - prep - APUS | - apus | HP PA-RISC | hppa - PA-RISC 1.1 | - 32 - PA-RISC 2.0 | - 64 | Intel ia64-based | ia64 | MIPS (big endian) | mips - SGI Indy/I2 | - r4k-ip22 | MIPS (little endian) | mipsel - DEC Decstation | - r4k-kn04 | - r3k-kn02 | IBM S/390 | s390 | - tape | - vmrdr ```… the mail continues:
As a hack for existing CPUs, it's just about tolerable â as long as it
can die entirely by the next generation.
So the part is I think is odd is the IBRS_ALL feature, where a future
CPU will advertise "I am able to be not broken" and then you have to
set the IBRS bit once at boot time to ask it not to be broken. That
part is weird, because it ought to have been treated like the RDCL_NO
bit â just "you don't have to worry any more, it got better".
We do need the IBPB feature to complete the protection that retpoline
gives us â it's that or rebuild all of userspace with retpoline.
We'll also want to expose IBRS to VM guests, since Windows uses it.
I think we could probably live without the IBRS frobbing in our own
syscall/interrupt paths, as long as we're prepared to live with the
very hypothetical holes that still exist on Skylake. Because I like
IBRS more... no, let me rephrase... I hate IBRS less than I hate the
'deepstack' and other stuff that was being proposed to make Skylake
almost safe with retpoline.
„As a programmer, it is your job to put yourself out of business. What you do today can be automated tomorrow.“
— Doug McIlroy
Damn this guy is a philosopher.
\#linux #gnu #gnulinux #opensource #administration #sysops #unix #intel #spectre #meltdown #kernel #kiss #simplicity #simplify #cpu #amd #cisc #risc #rowhammer #firefox #iphone #arm #security #itsec #cybersec #cybersercurity #cyber #internetsecurity #web
Crear una iso booteable con un kernel Linux y lo mínimo
#codigo #kernel #linux #minimo #sistemas
Instalamos dependencias (en debian): # apt-get install wget bc build-essential gawk xorriso qemu git Ahora clonamos los scripts que descargarán Linux kernel 4.7.6, BusyBox 1.24.2 and Syslinux 6.03. $ git clone https://github.com/ivandavidov/minimal-linux-script $ cd minimal-linux-script/ $ bash minimal.sh Esperamos a que compile el kernel y genere la iso. Cuando termine tendremos una iso lista para […]
Disponible el Linux Kernel 4.17
#gnu/linux #kernel #linux #núcleo
Se ha publicado una nueva edición del kernel, la 4.17 con nombre en clave “Merciless Moray”. Contra lo que podríamos esperar y el propio Torvalds había sugerido tras batir algunos récords en su repositorio Git, nos mantenemos todavía en las series 4.x del núcleo. El
Kernel Self Protection Project
Ich baue gerne meine Linux Kernel selbst und nehme auch alles an security features mit. Beim Kernel 4.9 habe ich auch mal die TCP Erweiterung (BBR) von Google eingebaut.
Wer seinen Kernel auch mal etwas härten möchte kann hier mal schauen: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
#linux #kernel #it-sicherheit #tcp #netzwerk #google
GNU Hurd • https://www.gnu.org/software/hurd/
What is the GNU Hurd?
The GNU Hurd is the GNU project's replacement for the Unix kernel. It is a collection of servers that run on the Mach microkernel to implement file systems, network protocols, file access control, and other features that are implemented by the Unix kernel or similar kernels (such as Linux). (...)
What is the mission of the GNU Hurd project?
Our mission is to create a general-purpose kernel suitable for the GNU operating system, which is viable for everyday use, and gives users and programs as much control over their computing environment as possible. (...)
Debian -- Debian GNU/Hurd • https://www.debian.org/ports/hurd/
The Hurd is a set of servers running on top of the GNU Mach microkernel. Together they build the base for the GNU operating system.
Currently, Debian is only available for Linux and kFreeBSD, but with Debian GNU/Hurd we have started to offer GNU/Hurd as a development, server and desktop platform, too. (...)
Arch Hurd • https://www.archhurd.org/
This is the Hurd. Welcome.
Welcome to the Arch Hurd website. Arch Hurd is a derivative work of Arch Linux porting it to the GNU Hurd system with packages optimised for the i686 architecture.
Our goal is to provide an Arch-like user environment (BSD-style init scripts, i686-optimised packages, use of the pacman package manager, rolling-release, and a KISS set up) on the Hurd which is stable enough for use, if not as a primary OS, at least as something to consider as a dual-boot option.
Currently we provide a LiveCD for users to install or try Arch Hurd for themselves, and provide an installation guide covering its use, as well as an alternate installation guide for users for whom the LiveCD is not an option, for whatever reason.
We are attempting to bring the spirit of Arch Linux to the Hurd, and if you'd like to help us achieve that, we'd love to hear from you on the mailing lists or IRC. (...)
There are several different ways to run a GNU/Hurd system:
Distrib - Distributions based on the Hurd
Xen - In Xen
QEMU - In QEMU
cloud - In the "cloud": OpenStack
chroots need a couple of tricks to work properly.
VirtualBox - In VirtualBox
https://github.com/bbesim/vagrant_GNU-debian-hurd_basebox - On Vagrant
#nix #guix #hurd #debian #arch #debianhurd #archhurd #gnu #linux #fsf #freesw #kernel #gnumach #unix #gpl #so #os #distros #mach #kernel