Date: Sun, 14 Jun 2020 15:09:01 +0200 From: Solar Designer <solar@...nwall.com> To: lkrg-users@...ts.openwall.com Subject: Re: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [//////////////] Hi Adam, On Thu, Jun 11, 2020 at 07:01:07PM +0200, Adam Zabrocki wrote: > On Wed, Jun 10, 2020 at 11:04:35PM +0200, Mikhail Morfikov wrote: > > I know that the LKRG's UMH blocking feature is supposed to block execution of > > files from paths which aren't whitelisted (when lkrg.umh_validate is set to > > "1"). But what file is it actually blocking when I get bunch of the following > > messages in the log? > > > > kernel: [p_lkrg] <Exploit Detection> !!! BLOCKING UMH !!! > > kernel: [p_lkrg] <Exploit Detection> Someone is trying to execute file: [//////////////] > > kernel: [p_lkrg] <Exploit Detection> --- . --- > > When LKRG blocks execution it overwrites original path with slash chars. If you > see that in the log, it means someone is executing something through UMH which > was already previoussly blocked. You can't restore what was blocked. As discussed previously, I think we should detect this special case (by checking that the pathname is all-slashes and contains at least two of them) and log a different message. While we're at it, I think we should change the three lines above (which may be mixed with other messages) to just one line, and drop the "Exploit Detection" from there (like we eventually should from all such messages given our evolutionary restructuring of LKRG), and drop "Someone" (we have no reason to claim that a person was involved). So we should have: kernel: [p_lkrg] Blocked usermodehelper execution of /some/path the first time, and: kernel: [p_lkrg] Blocked usermodehelper execution of a previously blocked pathname I think LKRG is currently unnecessarily verbose and shouting. It should keep its messages brief and to the point. At the same time, I think it's preferable to expand the UMH acronym here. Yes, someone could trigger the second kind of message by trying to execute all-slashes the first time, but that's OK'ish. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.