このページはEtoJ逐語翻訳フィルタによって翻訳生成されました。

翻訳前ページへ
A Simple 道具 for Linux Kernel Audits | droidsec.org

A Simple 道具 for Linux Kernel Audits

22 May 2017 by jduck

In Android, the Linux kernel is the crux of 安全. It is 責任がある 施行するing 接近 支配（する）／統制する to just about everything in the system. If an 攻撃者 can 伸び（る） 独断的な code 死刑執行 in kernel 方式, they can bypass 使用／適用 sandboxing, 接近 金物類／武器類 直接／まっすぐに, and more.

動機づけ

Over the years, the Linux kernel source code has grown 意味ありげに. It 含む／封じ込めるs code for all supported functionality 含むing drivers for a wide variety of 金物類／武器類 across several supported architectures. A modern Linux kernel source tree is やめる large. The tree we will use in our demonstration within this 地位，任命する is 729 megabytes.

dev:0:/android/source/kernel/msm$ du -hs . --除外する .git
729M    .

Now, you may be wondering why size 事柄s. To better understand, let us put ourselves in the shoes of （頭が）ひょいと動く. He 作品 professionally as a source code auditor. Companies 雇う him to read through 広大な 量s of source code to discover and 直す／買収する，八百長をする bugs and/or vulnerabilities in the code. （頭が）ひょいと動く’s success depends on 工夫するing and 遂行する／発効させるing a 戦略 to use his time most 効果的に. Some auditors may 選ぶ to use 自動化するd 道具s while others may choose to manually read through the code.

（頭が）ひょいと動く prefers to work smarter instead of harder so he has developed a 控訴 of 正規の／正選手 表現s that he runs over the kernel code to identify 可能性のある problem areas. After 精査するing through the results and 分析するing the surrounding code, he discovers a rather serious looking problem in a driver. He pulls out the 実験（する） 装置 for the 事業／計画（する） and quickly finds that the driver is not 負担d. Oh no! Now （頭が）ひょいと動く becomes curious. He reaches out and asks which Android 装置s in the “Droid Army” are using the driver. Unfortunately, it turns out no 装置s use that driver. In my opinion, this 代表するs an error in （頭が）ひょいと動く’s 戦略 that led him to wasting his time. Is there anything （頭が）ひょいと動く can do 異なって to 避ける this 運命／宿命 in the 未来? The answer is “Yes.”

The 道具

Enter the Linux Kernel reducer, or lk-reducer for short. This 道具 helps 避ける some of the problems we have discussed thus far. It 作品 by 監視するing とじ込み／提出する system 接近 while building the Linux kernel. (By no means is its 公共事業（料金）／有用性 限られた／立憲的な to the Linux Kernel, but it is 簡単に where we 設立する a need.) This is possible because 供給するing the Linux Kernel source code is a 合法的な 必要物／必要条件 under the GNU Public License (GPL). By 監視するing the build 過程, we are able to 決定する which とじ込み／提出するs from within the source tree have been used to build the final kernel image. Some とじ込み／提出するs will 必然的に not get used and thus we can 決定する that they are not needed. Therefore, they can be 除去するd from review during a source code audit. This saves time during both 手動式の and 自動化するd source code reviews.

The 現在の incarnation of the 道具 is a slight modification of an 実施 by Jann Horn. The first incarnation consisted of using strace(1) and a bunch of 爆撃する scripts to 監視する calls to the open(2) system call. Jann developed his 見解／翻訳／版 around the Linux inotify subsystem. His 実施 is much more clean and performant. My only modifications were to let the 使用者 decide how to 過程 the 監視するing results based on a data とじ込み／提出する. The 道具 生成するs a とじ込み／提出する called “lk-reducer.out” that shows whether each とじ込み／提出する was Accessed, Untouched, or Generated. Let us see it in 活動／戦闘!

A Demonstration

Once the 道具 is downloaded and 収集するd, give it the path to your Linux kernel source tree:

dev:0:lk-reducer$ ./lk-reducer /android/source/kernel/msm
dev:0:msm$

Now, build the Linux kernel to 跡をつける which とじ込み／提出するs are 接近d. Remember to not only configure and build the kernel, but also clean the build too. さもなければ, we might 行方不明になる とじ込み／提出するs used during the きれいにする 過程 and 結局最後にはーなる with a tree we can build but not clean.

dev:0:msm$ 輸出（する） ARCH=arm64 SUBARCH=arm64 CROSS_COMPILE=aarch64-linux-androidkernel-
dev:0:msm$ make marlin_defconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  SHIPPED scripts/kconfig/zconf.tab.c
  SHIPPED scripts/kconfig/zconf.lex.c
  SHIPPED scripts/kconfig/zconf.hash.c
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
drivers/soc/qcom/Kconfig:381:警告: choice value used outside its choice group
drivers/soc/qcom/Kconfig:386:警告: choice value used outside its choice group
#
# configuration written to .config
#
dev:0:msm$ make
scripts/kconfig/conf --silentoldconfig Kconfig
drivers/soc/qcom/Kconfig:381:警告: choice value used outside its choice group
drivers/soc/qcom/Kconfig:386:警告: choice value used outside its choice group
  CHK     含む/config/kernel.解放（する）
[... その上の build 生産（高） omitted for brevity ...]
  DTC     arch/arm64/boot/dts/htc/msm8996-v3-htc_sailfish-xb.dtb
  GZIP    arch/arm64/boot/Image.gz
  CAT     arch/arm64/boot/Image.gz-dtb
dev:0:msm$ make mrproper
  CLEAN   .
  CLEAN   arch/arm64/kernel/vdso
  CLEAN   arch/arm64/kernel
  CLEAN   crypto/asymmetric_keys
  CLEAN   kernel/time
  CLEAN   kernel
  CLEAN   lib
  CLEAN   逮捕する/wireless
  CLEAN   安全/selinux
  CLEAN   usr
  CLEAN   arch/arm64/boot/dts/htc
  CLEAN   arch/arm64/boot
  CLEAN   .tmp_versions
  CLEAN   scripts/basic
  CLEAN   scripts/dtc
  CLEAN   scripts/kconfig
  CLEAN   scripts/mod
  CLEAN   scripts/selinux/genheaders
  CLEAN   scripts/selinux/mdp
  CLEAN   scripts
  CLEAN   含む/config 含む/生成するd arch/arm64/含む/生成するd
  CLEAN   .config .見解／翻訳／版 含む/生成するd/uapi/linux/見解／翻訳／版.h Module.symvers
dev:0:msm$

With the build and clean 過程 完全にするd, 簡単に 出口 the sub-爆撃する to 生成する the data とじ込み／提出する:

dev:0:msm$ 出口
出口
過程ing remaining events...
inotify event collection 段階 is over, ダンピング results to "lk-reducer.out"...
cleanup 完全にする

From here, you can 分析する the data とじ込み／提出する and choose whether to 削除する the とじ込み／提出するs from the 現在の source tree or copy them to another place. I tend to copy the とじ込み／提出するs to another directory and audit from there.

NOTE: If you’re working with a tree from Git, you might want to filter out the .git subdirectory as I’ve done here. You can always 協議する the history in the 初めの repository.

dev:0:msm$ grep ^A lk-reducer.out | 削減（する） -c 3- | grep -v '\./\.git/' > lk-reducer-keep.out
dev:0:msm$ mkdir ../msm-マカジキ-減ずるd
dev:0:msm$ tar cf - -T lk-reducer-keep.out | tar xf - -C ../msm-マカジキ-減ずるd/
dev:0:msm$ du -hs ../msm-マカジキ-減ずるd/
132M    ../msm-マカジキ-減ずるd/

As you can see, we’ve 減ずるd the source code from 729 megabytes 負かす／撃墜する to only 132 megabytes. More importantly, we know that there’s no code left that is not built into the final kernel image.

制限s

Of course, this is not the only problem 直面するd when auditing the Linux kernel. Even though we have 除去するd code that isn’t 接近d at build time, some remaining code may not get used 予定 to 調査（する）ing, system configuration, or other 明言する／公表するs that may be out of our 支配（する）／統制する. Also, code within a とじ込み／提出する might still be thrown out by the pre-加工業者 or optimized out during 編集. その上の, this 道具 does nothing to help understand the 脅し model or 決定する attack surfaces that might be 利益／興味ing for an audit.

結論

This 地位，任命する defines one problem Linux kernel auditors 直面する and 現在のs a 道具 designed to help solve it. Jann and I are pleased to publish this 道具 to 補助装置 the community in their source code audits of the Linux kernel. It is our hope that the 道具 will save you time and make you more 効果的な. You can find the 道具 on GitHub here. Thank you for your time and best of luck and your kernel auditing 努力するs!

© 2014-2017 droidsec.org