4.14. 增加内核补丁

Debian GNU/Linux 为 Linux 内核提供了一些增强其安全性的补丁。 它们包括:

  • Linux Intrusion Detection provided in the kernel-patch-2.4-lids package. This kernel patch makes the process of hardening your Linux system easier by allowing you to restrict, hide and protect processes, even from root. It implements mandatory access control capabilities.

  • Linux Trustees, provided in package trustees. This patch adds a decent advanced permissions management system to your Linux kernel. Special objects (called trustees) are bound to every file or directory, and are stored in kernel memory, which allows fast lookup of all permissions.

  • NSA Enhanced Linux (in package selinux). Backports of the SElinux-enabled packages are available at http://selinux.alioth.debian.org/. More information available at SElinux in Debian Wiki page, at Manoj Srivastava’s and Russell Cookers’s SElinux websites.

  • The kernel patch http://people.redhat.com/mingo/exec-shield provided in the kernel-patch-exec-shield package. This patch provides protection against some buffer overflows (stack smashing attacks).

  • The Grsecurity patch, provided by the kernel-patch-2.4-grsecurity and kernel-patch-grsecurity2 packages [28] implements Mandatory Access Control through RBAC, provides buffer overflow protection through PaX, ACLs, network randomness (to make OS fingerprinting more difficult) and many more features.

  • The kernel-patch-adamantix provides the patches developed for Adamantix, a Debian-based distribution. This kernel patch for the 2.4.x kernel releases introduces some security features such as a non-executable stack through the use of http://pageexec.virtualave.net/ and mandatory access control based on http://www.rsbac.org/. Other features include: http://www.vanheusden.com/Linux/sp/, AES encrypted loop device, MPPE support and an IPSEC v2.6 backport.

  • cryptoloop-source. This patches allows you to use the functions of the kernel crypto API to create encrypted filesystems using the loopback device.

  • IPSEC kernel support (in package linux-patch-openswan). If you want to use the IPsec protocol with Linux, you need this patch. You can create VPNs with this quite easily, even to Windows machines, as IPsec is a common standard. IPsec capabilities have been added to the 2.5 development kernel, so this feature will be present by default in the future Linux Kernel 2.6. Homepage: http://www.openswan.org. FIXME: The latest 2.4 kernels provided in Debian include a backport of the IPSEC code from 2.5. Comment on this.

The following security kernel patches are only available for old kernel versions in woody and are deprecated:

  • http://acl.bestbits.at/ (ACLs) for Linux provided in the package kernel-patch-acl. This kernel patch adds access control lists, an advanced method for restricting access to files. It allows you to control fine-grain access to files and directory.

  • The http://www.openwall.com/linux/ linux kernel patch by Solar Designer, provided in the kernel-patch-2.2.18-openwall package. This is a useful set of kernel restrictions, like restricted links, FIFOs in /tmp, a restricted /proc file system, special file descriptor handling, non-executable user stack area and other features. Note: This package applies to the 2.2 release, no packages are available for the 2.4 release patches provided by Solar.

  • kernel-patch-int. This patch also adds cryptographic capabilities to the Linux kernel, and was useful with Debian releases up to Potato. It doesn’t work with Woody, and if you are using Sarge or a newer version, you should use a more recent kernel which includes these features already.

However, some patches have not been provided in Debian yet. If you feel that some of these should be included please ask for it at the http://www.debian.org/devel/wnpp/.

[28] Notice that this patch conflicts with patches already included in Debian’s 2.4 kernel source package. You will need to use the stock vanilla kernel. You can do this with the following steps:

  1. # apt-get install kernel-source-2.4.22 kernel-patch-debian-2.4.22
  2. # tar xjf /usr/src/kernel-source-2.4.22.tar.bz2
  3. # cd kernel-source-2.4.22
  4. # /usr/src/kernel-patches/all/2.4.22/unpatch/debian

For more information see http://bugs.debian.org/194225, http://bugs.debian.org/199519, http://bugs.debian.org/206458, http://bugs.debian.org/203759, http://bugs.debian.org/204424, http://bugs.debian.org/210762, http://bugs.debian.org/211213, and the http://lists.debian.org/debian-devel/2003/debian-devel-200309/msg01133.html