{"id":3291,"date":"2017-05-23T16:10:49","date_gmt":"2017-05-23T08:10:49","guid":{"rendered":"https:\/\/ixyzero.com\/blog\/?p=3291"},"modified":"2017-05-23T16:10:49","modified_gmt":"2017-05-23T08:10:49","slug":"linux%e5%86%85%e6%a0%b8%e9%85%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/3291.html","title":{"rendered":"Linux\u5185\u6838\u914d\u7f6e"},"content":{"rendered":"

=Start=<\/p>\n

\u7f18\u7531\uff1a<\/h4>\n

\u4eca\u5e74\u65e9\u4e9b\u65f6\u5019\u7206\u51fa\u4e86\u4e00\u4e2a\u7531DCCP\u5bfc\u81f4\u7684\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u300c\u3010\u6f0f\u6d1e\u9884\u8b66\u3011\u96ea\u85cf11\u5e74\uff1aLinux kernel DCCP double-free \u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CVE-2017-6074\uff09<\/a>\u300d\uff0c\u800c\u8fd9\u4e2a\u6f0f\u6d1e\u9700\u8981\u5185\u6838\u7f16\u8bd1\u7684\u65f6\u5019\u5f00\u542fCONFIG_IP_DCCP \uff0c\u8bb8\u591aLinux\u53d1\u884c\u7248\u672c\u9ed8\u8ba4\u5f00\u542f\u3002\u4e0d\u8fc7\u5728\u5f88\u591a\u516c\u53f8\u7684\u751f\u4ea7\u73af\u5883\u4e2d\u5e76\u6ca1\u6709\u4e3b\u52a8\u52a0\u8f7d\uff0c\u6240\u4ee5\u6211\u4eec\u9700\u8981\u5148\u63d0\u524d\u5224\u65ad\u4e00\u4e0b\u7cfb\u7edf\u662f\u5426\u5df2\u52a0\u8f7d\u8fd9\u4e2a\u6a21\u5757\uff0c\u5982\u679c\u6ca1\u6709\u52a0\u8f7d\u7684\u8bdd\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u67d0\u4e9b\u65b9\u6cd5\u9650\u5236\u8be5\u6a21\u5757\u7684\u52a0\u8f7d\uff1b\u5982\u679c\u5df2\u7ecf\u52a0\u8f7d\u4e86\uff0c\u5219\u8981\u4e48\u5347\u7ea7\u5185\u6838\u5e76\u91cd\u542f\u673a\u5668\u3001\u8981\u4e48\u5148\u8bbe\u7f6e\u7981\u6b62\u5f00\u673a\u52a0\u8f7d\u7136\u540e\u91cd\u542f\u751f\u6548\u3002\u4e0b\u9762\u7684\u5185\u5bb9\u5c31\u662f\u6211\u5728\u68c0\u6d4b\u5e76\u5904\u7406\u8fd9\u4e2a\u6f0f\u6d1e\u7684\u65f6\u5019\u5b66\u4e60\u5230\u7684\u4e00\u4e9b\u548cLinux\u5185\u6838\u914d\u7f6e\u76f8\u5173\u7684\u77e5\u8bc6\u3002<\/p>\n

\u6b63\u6587\uff1a<\/h4>\n

\u53c2\u8003\u89e3\u7b54\uff1a<\/h4>\n

Linux\u4e0bdccp\u6f0f\u6d1e\u7684\u68c0\u6d4b\u65b9\u6cd5\u548c\u7f13\u89e3\u529e\u6cd5<\/h6>\n
\n
\n
\n
\n\n\n\n
\n
\n
# \u67e5\u770b\u5185\u6838\u7f16\u8bd1\u65f6\u662f\u5426\u5f00\u542f\u4e86CONFIG_IP_DCCP\u9009\u9879<\/code><\/div>\n
$ grep <\/code>\"CONFIG_IP_DCCP=\"<\/code> \/boot\/config-`uname -r`<\/code><\/div>\n
<\/div>\n
# \u67e5\u770b\u6b63\u5728\u8fd0\u884c\u7684\u7cfb\u7edf\u4e2d\u662f\u5426\u5df2\u7ecf\u52a0\u8f7d\u4e86dccp\u6a21\u5757<\/code><\/div>\n
$ lsmod | grep --color -i <\/code>\"dccp\"<\/code><\/div>\n
<\/div>\n
# \u5982\u679c\u7cfb\u7edf\u8fd8\u6ca1\u6709\u52a0\u8f7ddccp\u6a21\u5757\uff0c\u5219\u53ef\u4ee5\u901a\u8fc7\u4e0b\u9762\u7684\u547d\u4ee4\u7981\u6b62\u52a0\u8f7ddccp\u6a21\u5757\uff1b\u5982\u679c\u5df2\u7ecf\u52a0\u8f7d\u4e86\uff0c\u5219\u9700\u8981\u5148\u6267\u884c\u4e0b\u9762\u7684\u547d\u4ee4\uff0c\u7136\u540e\u91cd\u542f\u7cfb\u7edf\u624d\u53ef\u4ee5\u751f\u6548<\/code><\/div>\n
# echo <\/code>\"install dccp \/bin\/true\"<\/code> >> \/etc\/modprobe.d\/disable-dccp.conf<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Linux\u4e0b\u5982\u4f55\u67e5\u770b\u5f53\u524d\u7528\u7684\u54ea\u4e2a\u7248\u672c\u7684\u5185\u6838\u4ee5\u53ca\u5bf9\u5e94\u7684\u914d\u7f6e\u662f\u4ec0\u4e48\uff1f<\/h6>\n
\n
\n
\n
\n\n\n\n
\n
\n
$ cat \/boot\/config-$(uname -r)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # RHEL\/CentOS\/...<\/code><\/div>\n
$ zcat \/proc\/config.gz > running.config\u00a0 # only available <\/code>if<\/code> CONFIG_IKCONFIG_PROC was set when the kernel was built.<\/code><\/div>\n
$ cat \/boot\/config\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # only available <\/code>if<\/code> CONFIG_IKCONFIG_PROC was set when the kernel was built.<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Linux\u4e0b\u5982\u4f55\u67e5\u770b\u5df2\u7ecf\u52a0\u8f7d\u7684\u5185\u6838\u9a71\u52a8\/\u6a21\u5757\uff1f<\/h6>\n
\n
\n
\n
\n\n\n\n
\n
\n
$ lsmod<\/code><\/div>\n
$ cat \/proc\/modules<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Linux\u4e0b\u5982\u4f55\u67e5\u770b\u6709\u54ea\u4e9b\u5185\u6838\u9a71\u52a8\/\u6a21\u5757\u4ee5\u53ca\u5b83\u4eec\u7684\u8be6\u7ec6\u4fe1\u606f\uff1f<\/h6>\n
\n
\n
\n
\n\n\n\n
\n
\n
$ find \/lib\/modules\/$(uname -r) -type f -name <\/code>\"*.ko\"<\/code><\/div>\n
<\/div>\n
# \u67e5\u770bdccp\u6a21\u5757\u7684\u8be6\u7ec6\u4fe1\u606f<\/code><\/div>\n
$ modinfo dccp<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Linux\u4e0b\u5185\u6838\u914d\u7f6e\u7684\u8bf4\u660e<\/h6>\n
\n
\n
\n
\n\n\n\n
\n
\n
The <\/code>3<\/code> states of the main selection option <\/code>for<\/code> the SCSI subsystem (which actually selects the SCSI mid level driver) follow. Only one of these should appear in an actual kernel config file:<\/code><\/div>\n
<\/div>\n
CONFIG_SCSI=y\u00a0\u00a0 #\u76f4\u63a5\u7f16\u8bd1\u8fdb\u5185\u6838\u5e76\u5728\u5f00\u673a\u542f\u52a8\u65f6\u52a0\u8f7d<\/code><\/div>\n
CONFIG_SCSI=m\u00a0\u00a0 #\u5728\u5185\u6838\u7f16\u8bd1\u7684\u65f6\u5019\u7f16\u8bd1\u6210\u6a21\u5757\uff0c\u4e4b\u540e\u6309\u9700\u52a0\u8f7d<\/code><\/div>\n
# CONFIG_SCSI is not set\u00a0\u00a0\u00a0 #\u5728\u5185\u6838\u7f16\u8bd1\u7684\u65f6\u5019\u6ca1\u6709\u8bbe\u7f6e\uff0c\u540e\u671f\u4e5f\u4e0d\u4f1a\u88ab\u52a0\u8f7d<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

 <\/p>\n

\u53c2\u8003\u94fe\u63a5\uff1a<\/h4>\n

Linux kernel: CVE-2017-6074 \u2013 local privilege escalation in DCCP
\nhttps:\/\/ma.ttias.be\/linux-kernel-cve-2017-6074-local-privilege-escalation-dccp\/<\/a><\/p>\n

Linux\u4e0b\u5982\u4f55\u67e5\u770b\u5f53\u524d\u7528\u7684\u54ea\u4e2a\u7248\u672c\u7684\u5185\u6838\u4ee5\u53ca\u5bf9\u5e94\u7684\u914d\u7f6e\u662f\u4ec0\u4e48\uff1f
\nhttps:\/\/superuser.com\/questions\/287371\/obtain-kernel-config-from-currently-running-linux-system<\/a>
\nhttps:\/\/serverfault.com\/questions\/51032\/how-do-i-check-what-kernel-options-were-compiled-without-looking-at-boot-config<\/a>
\nhttps:\/\/unix.stackexchange.com\/questions\/123026\/where-kernel-configuration-file-is-stored<\/a>
\nhttps:\/\/unix.stackexchange.com\/questions\/83319\/how-can-i-know-if-the-current-kernel-was-compiled-with-a-certain-option-enabled<\/a><\/p>\n

Linux\u4e0b\u5982\u4f55\u67e5\u770b\u5df2\u7ecf\u52a0\u8f7d\u7684\u5185\u6838\u9a71\u52a8\/\u6a21\u5757\uff1f
\nhttps:\/\/www.cyberciti.biz\/tips\/how-to-display-or-show-information-about-a-linux-kernel-module-or-drivers.html<\/a>
\nhttps:\/\/www.cyberciti.biz\/faq\/howto-display-list-of-modules-or-device-drivers-in-the-linux-kernel\/<\/a>
\nhttps:\/\/serverfault.com\/questions\/62316\/how-do-i-list-loaded-linux-module-parameter-values<\/a>
\nhttps:\/\/serverfault.com\/questions\/10439\/how-do-you-check-the-version-of-a-ko-kernel-module-in-linux<\/a>
\nhttp:\/\/ask.xmodulo.com\/find-information-builtin-kernel-modules-linux.html<\/a>
\nhttps:\/\/stackoverflow.com\/questions\/9845877\/how-to-determine-if-a-specific-module-is-loaded-in-linux-kernel<\/a><\/p>\n

Linux\u4e0b\u5982\u4f55\u67e5\u770b\u6709\u54ea\u4e9b\u5185\u6838\u9a71\u52a8\/\u6a21\u5757\uff1f
\nhttps:\/\/unix.stackexchange.com\/questions\/184877\/how-to-list-all-loadable-kernel-modules<\/a><\/p>\n

Linux\u5185\u6838\u914d\u7f6e\u8bf4\u660e
\nhttp:\/\/www.tldp.org\/HOWTO\/SCSI-2.4-HOWTO\/kconfig.html<\/a>
\nhttps:\/\/stackoverflow.com\/questions\/5392756\/what-does-m-mean-in-kernel-configuration-file<\/a><\/p>\n

=END=<\/p>\n","protected":false},"excerpt":{"rendered":"

=Start= \u7f18\u7531\uff1a \u4eca\u5e74\u65e9\u4e9b\u65f6\u5019\u7206\u51fa\u4e86\u4e00\u4e2a\u7531DCCP\u5bfc\u81f4\u7684\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u300c\u3010\u6f0f\u6d1e\u9884\u8b66\u3011\u96ea\u85cf11\u5e74\uff1aLinux […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,11,25],"tags":[735,30,790,791],"class_list":["post-3291","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-linux","category-security","tag-kernel","tag-linux","tag-lsmod","tag-modinfo"],"views":7336,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=3291"}],"version-history":[{"count":1,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3291\/revisions"}],"predecessor-version":[{"id":3292,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3291\/revisions\/3292"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=3291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=3291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=3291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}