faboollasermac を削除する
SmartInstallerMac_v290.pkg を入れたのだけど、インストーラーにアンインストール機能がない。
たいへんクソなソフトウエアである。
そのくせ、ローカルでWebサーバーを動かし続けるというさらにクソな仕様。
そして、DXFが読み込めないというどうしようもなくクソ。
なので削除。
$ pkgutil --pkgs | grep smartdiys com.smartdiys.faboollaser
何が入ったか調べる。
$ pkgutil --files com.smartdiys.faboollaser LaunchDaemons LaunchDaemons/com.smartdiys.faboollaser.plist faboollasermac faboollasermac/dfu faboollasermac/dfu/bin faboollasermac/dfu/bin/dfu-util faboollasermac/dfu/lib faboollasermac/dfu/lib/libusb-1.0.0.dylib faboollasermac/faboollaser.app faboollasermac/faboollaser.app/Contents faboollasermac/faboollaser.app/Contents/Frameworks faboollasermac/faboollaser.app/Contents/Info.plist faboollasermac/faboollaser.app/Contents/MacOS faboollasermac/faboollaser.app/Contents/MacOS/MacOS.so faboollasermac/faboollaser.app/Contents/MacOS/Nav.so faboollasermac/faboollaser.app/Contents/MacOS/Python faboollasermac/faboollaser.app/Contents/MacOS/_AE.so faboollasermac/faboollaser.app/Contents/MacOS/_Ctl.so faboollasermac/faboollaser.app/Contents/MacOS/_Dlg.so faboollasermac/faboollaser.app/Contents/MacOS/_Evt.so faboollasermac/faboollaser.app/Contents/MacOS/_File.so faboollasermac/faboollaser.app/Contents/MacOS/_Menu.so faboollasermac/faboollaser.app/Contents/MacOS/_Qd.so faboollasermac/faboollaser.app/Contents/MacOS/_Res.so faboollasermac/faboollaser.app/Contents/MacOS/_Win.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_cn.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_hk.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_iso2022.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_jp.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_kr.so faboollasermac/faboollaser.app/Contents/MacOS/_codecs_tw.so faboollasermac/faboollaser.app/Contents/MacOS/_collections.so faboollasermac/faboollaser.app/Contents/MacOS/_ctypes.so faboollasermac/faboollaser.app/Contents/MacOS/_functools.so faboollasermac/faboollaser.app/Contents/MacOS/_hashlib.so faboollasermac/faboollaser.app/Contents/MacOS/_heapq.so faboollasermac/faboollaser.app/Contents/MacOS/_io.so faboollasermac/faboollaser.app/Contents/MacOS/_json.so faboollasermac/faboollaser.app/Contents/MacOS/_locale.so faboollasermac/faboollaser.app/Contents/MacOS/_multibytecodec.so faboollasermac/faboollaser.app/Contents/MacOS/_random.so faboollasermac/faboollaser.app/Contents/MacOS/_scproxy.so faboollasermac/faboollaser.app/Contents/MacOS/_socket.so faboollasermac/faboollaser.app/Contents/MacOS/_ssl.so faboollasermac/faboollaser.app/Contents/MacOS/_struct.so faboollasermac/faboollaser.app/Contents/MacOS/app faboollasermac/faboollaser.app/Contents/MacOS/array.so faboollasermac/faboollaser.app/Contents/MacOS/binascii.so faboollasermac/faboollaser.app/Contents/MacOS/bz2.so faboollasermac/faboollaser.app/Contents/MacOS/cPickle.so faboollasermac/faboollaser.app/Contents/MacOS/cStringIO.so faboollasermac/faboollaser.app/Contents/MacOS/datetime.so faboollasermac/faboollaser.app/Contents/MacOS/fcntl.so faboollasermac/faboollaser.app/Contents/MacOS/frontend faboollasermac/faboollaser.app/Contents/MacOS/grp.so faboollasermac/faboollaser.app/Contents/MacOS/include faboollasermac/faboollaser.app/Contents/MacOS/itertools.so faboollasermac/faboollaser.app/Contents/MacOS/lib faboollasermac/faboollaser.app/Contents/MacOS/math.so faboollasermac/faboollaser.app/Contents/MacOS/operator.so faboollasermac/faboollaser.app/Contents/MacOS/readline.so faboollasermac/faboollaser.app/Contents/MacOS/resource.so faboollasermac/faboollaser.app/Contents/MacOS/select.so faboollasermac/faboollaser.app/Contents/MacOS/strop.so faboollasermac/faboollaser.app/Contents/MacOS/termios.so faboollasermac/faboollaser.app/Contents/MacOS/time.so faboollasermac/faboollaser.app/Contents/MacOS/unicodedata.so faboollasermac/faboollaser.app/Contents/MacOS/zlib.so faboollasermac/faboollaser.app/Contents/Resources faboollasermac/faboollaser.app/Contents/Resources/frontend faboollasermac/faboollaser.app/Contents/Resources/frontend/admin.js faboollasermac/faboollaser.app/Contents/Resources/frontend/app.css faboollasermac/faboollaser.app/Contents/Resources/frontend/app.html faboollasermac/faboollaser.app/Contents/Resources/frontend/app.js faboollasermac/faboollaser.app/Contents/Resources/frontend/assetsfa19c0ffd7c43e9906a09d1c5f6a7b68.png faboollasermac/faboollaser.app/Contents/Resources/frontend/vendor.js faboollasermac/faboollaser.app/Contents/Resources/icon-windowed.icns faboollasermac/faboollaser.app/Contents/Resources/include faboollasermac/faboollaser.app/Contents/Resources/include/python2.7 faboollasermac/faboollaser.app/Contents/Resources/include/python2.7/pyconfig.h faboollasermac/faboollaser.app/Contents/Resources/lib faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7 faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7/config faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7/config/Makefile
なんか、ファイルは自分で消さないといけないらしい。
ほんどクソなアプリをありがとう。
んで、これどこに入ったのさ？
$ sudo find / | grep faboollasermac Password: /Library/faboollasermac /Library/faboollasermac/dfu /Library/faboollasermac/dfu/bin /Library/faboollasermac/dfu/bin/dfu-util /Library/faboollasermac/dfu/lib /Library/faboollasermac/dfu/lib/libusb-1.0.0.dylib /Library/faboollasermac/faboollaser.app /Library/faboollasermac/faboollaser.app/Contents /Library/faboollasermac/faboollaser.app/Contents/Frameworks /Library/faboollasermac/faboollaser.app/Contents/Info.plist /Library/faboollasermac/faboollaser.app/Contents/MacOS /Library/faboollasermac/faboollaser.app/Contents/MacOS/MacOS.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/Nav.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/Python /Library/faboollasermac/faboollaser.app/Contents/MacOS/_AE.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Ctl.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Dlg.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Evt.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_File.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Menu.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Qd.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Res.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_Win.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_cn.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_hk.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_iso2022.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_jp.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_kr.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_codecs_tw.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_collections.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_ctypes.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_functools.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_hashlib.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_heapq.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_io.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_json.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_locale.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_multibytecodec.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_random.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_scproxy.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_socket.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_ssl.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/_struct.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/app /Library/faboollasermac/faboollaser.app/Contents/MacOS/array.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/binascii.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/bz2.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/cPickle.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/cStringIO.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/datetime.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/fcntl.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/frontend /Library/faboollasermac/faboollaser.app/Contents/MacOS/grp.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/include /Library/faboollasermac/faboollaser.app/Contents/MacOS/itertools.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/lib /Library/faboollasermac/faboollaser.app/Contents/MacOS/math.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/operator.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/readline.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/resource.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/select.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/strop.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/termios.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/time.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/unicodedata.so /Library/faboollasermac/faboollaser.app/Contents/MacOS/zlib.so /Library/faboollasermac/faboollaser.app/Contents/Resources /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/admin.js /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/app.css /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/app.html /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/app.js /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/assetsfa19c0ffd7c43e9906a09d1c5f6a7b68.png /Library/faboollasermac/faboollaser.app/Contents/Resources/frontend/vendor.js /Library/faboollasermac/faboollaser.app/Contents/Resources/icon-windowed.icns /Library/faboollasermac/faboollaser.app/Contents/Resources/include /Library/faboollasermac/faboollaser.app/Contents/Resources/include/python2.7 /Library/faboollasermac/faboollaser.app/Contents/Resources/include/python2.7/pyconfig.h /Library/faboollasermac/faboollaser.app/Contents/Resources/lib /Library/faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7 /Library/faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7/config /Library/faboollasermac/faboollaser.app/Contents/Resources/lib/python2.7/config/Makefile (snip)
$ sudo find / | grep LaunchDaemons | grep smartdiys /Library/LaunchDaemons/com.smartdiys.faboollaser.plist
場所はわかった。
$ sudo rm -rf /Library/faboollasermac $ sudo rm /Library/LaunchDaemons/com.smartdiys.faboollaser.plist
パッケージ情報も削除しておく。
$ sudo pkgutil --forget com.smartdiys.faboollaser Forgot package 'com.smartdiys.faboollaser' on '/'.
やっときれいになった。
しかし、まだプロセスが動いている模様。
$ ps ax | grep fabool 36832 ?? Ss 3:01.69 /Library/faboollasermac/faboollaser.app/Contents/MacOS/app $ sudo kill 36832
どっかにデータも保持していると思うのだけど、こちらはUI上で全部削除してから作業したので不明。
frpを使ったNAT配下マシンの中継接続
ちょっとした余興に使うのに、goで書かれたfrpを使って、NAT配下のraspi上のowncloudを、さくらのクラウドに置いたインスタンスで中継接続させてみた。
有料になっちゃった、ngrokを自前でやる的なもの。
frpの日本語の資料はないけど、中国語はいっぱいわかりやすいのがあったw
androidのowncloudクライアントβ(99円)からも普通に接続している。
proxy配下からの接続も問題なし。
まったくのゼロから２時間くらい。
一番時間かかったのは本題ではないowncloud。
frpはmakeせずにバイナリ配布の各アーキテクチャ向けのを使った。
frpは、sshだけなら設定は超簡単だった。
webの中継は独特な感じでめんどくさい。何ヶ所かちょっと試行錯誤あった。
TSL化とfrpの認証は設定していない。
owncloud config.iniのtrusted_hostの設定は、さくら側のIPをハードコートしてしまったので解決してない。
*では通らなかった。制限をしない方法はないんだろうか？
数日使ってみたが、超安定している。
速度も、まぁこんなもんじゃないかなという感じ。
認証強化とTLS化したらそれでそのまま使っていいかも。
ownClowdのクライアントがイマイチだけど。それはDAVクライアントでいいかな。
中継サーバー側はどのくらいの接続を許すのか、どのくらいのルールを書けるのか、あとモニタサーバーを起動してみてないので、それを見てみるか。daemonをsystemd配下にするのもいるな。
NASやWebCamにfrp組み込んでみるのもいいかも。
sourceからのビルドもやってみないと。
しかし、技書話人伝 の準備のが先かw
まだ原稿できてないw
印刷と製本も手でやるので時間が苦しい。
procからuuid作ると、14文字目が4になる
uuidをファイル名にしてたくさん作ったものをlsして気がついた。
漫然と表示してただけなら気が付かなかったかも。
再現テスト。
#!/bin/bash
for i in `seq 1000`
do
cat /proc/sys/kernel/random/uuid | awk -F'-' '{print $1$2$3$4$5}u' >> test.log
done
cat test.log| cut -c 13 | sort | uniq -c
$ ./test.sh
1000 4
面白い。
環境はAWS t2.microでubuntu 16.04.4。
$ uname -a
Linux ip-xxx-xxx-xxx-xxx 4.4.0-1049-aws #58-Ubuntu SMP Fri Jan 12 23:17:09 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ cat /etc/os-release
NAME="Ubuntu"
VERSION="16.04.4 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.4 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial
UUIDって、完全乱数かと思ってたら、ver4ではバリアントとバージョン情報が入るのね。
16進表記ではRRRRRRRR-RRRR-4RRR-rRRR-RRRRRRRRRRRRとなり、バリアント(10)とバージョン(0100)を除くすべてのビットを乱数（R:122ビット）で生成する。
規則性が埋もれているのであれば、扱いには注意しないといけないな...
High Sierraにしたら、sshでパスフレーズを必ず聞かれるようになってめんどくさい
Sierraからだそうですけど。
$ vi ~/.ssh/config
UseRoaming no
これしか書いてなかった…
以下追記。
ServerAliveInterval 1200
ServerAliveCountMax 12
TCPKeepAlive yes
Compression yes
AddKeysToAgent yes
UseKeychain yes
GSSAPIAuthentication no
こんな感じに。
しかし、初回は同じように聞かれる。
そのあとは覚えてくれるようだ。
スペクターとメルトダウンのシェルスクリプト簡易チェッカーがあったので試してみた
speed47/spectre-meltdown-checker: Spectre & Meltdown vulnerability/mitigation checker for Linux
https://github.com/speed47/spectre-meltdown-checker
何か実行して調べるわけではなく、いろんなパラメータから状態を調べるだけのよう。
ダウンロードして実行してみる。
さくらのクラウド
ターゲットは、まだ対策がされていない"さくらのクラウド"でのインスタンス。
ダウンロードして実行権限を与える。
ubuntu@psv:~/test$ wget https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh --2018-01-16 13:33:29-- https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.228.133 Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.228.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 36439 (36K) [text/plain] Saving to: ‘spectre-meltdown-checker.sh’ spectre-meltdown-ch 100%[===================>] 35.58K --.-KB/s in 0.03s 2018-01-16 13:33:29 (1.26 MB/s) - ‘spectre-meltdown-checker.sh’ saved [36439/36439] ubuntu@psv:~/test$ chmod +x spectre-meltdown-checker.sh
rootで実行しろってことだけど、ユーザー権限でもある程度はわかる。
ubuntu@psv:~/test$ ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Note that you should launch this script with root privileges to get accurate information. We'll proceed but you might see permission denied errors. To run it as root, you can try the following command: sudo ./spectre-meltdown-checker.sh Checking for vulnerabilities against running kernel Linux 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: UNKNOWN > STATUS: UNKNOWN (couldn't check (couldn't extract your kernel from /boot/vmlinuz-4.4.0-96-generic)) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: UNKNOWN (couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?) * The SPEC_CTRL CPUID feature bit is set: UNKNOWN (couldn't read /dev/cpu/0/cpuidr, is cpuid support enabled in your kernel?) * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
rootでやってみる。
ubuntu@psv:~/test$ sudo ./spectre-meltdown-checker.sh [sudo] password for ubuntu: Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
リアルな表示は、エスケープシーケンでカラフルになっているから、もっとわかりやすいよ。
対策はされていない。
ubuntu@psv:~$ uname -a Linux psv 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
ubuntu@psv:~$ sudo apt-get update ubuntu@psv:~$ sudo apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages have been kept back: libdrm-amdgpu1 libdrm2 libegl1-mesa libgbm1 libgl1-mesa-dri libwayland-egl1-mesa linux-generic linux-headers-generic linux-image-generic The following packages will be upgraded: libgdk-pixbuf2.0-0 libgdk-pixbuf2.0-common ubuntu-mono 3 upgraded, 0 newly installed, 0 to remove and 9 not upgraded. Need to get 346 kB of archives. After this operation, 0 B of additional disk space will be used. Do you want to continue? [Y/n] y (snip)
xenial-updates/mainにも、xenial-security/mainにも、対策パッケージは来ていないようだ。
AWS
AWSでもやってみようかな。
$ sudo ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-1039-aws #48-Ubuntu SMP Wed Oct 11 15:15:01 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
EC2の中身までは責任の範囲外で、自分でやれってことね。
パッケージアップデートして再起動。
$ sudo apt-get update $ sudo apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages were automatically installed and are no longer required: linux-aws-headers-4.4.0-1028 linux-aws-headers-4.4.0-1035 linux-aws-headers-4.4.0-1038 linux-aws-headers-4.4.0-1041 linux-aws-headers-4.4.0-1043 linux-aws-headers-4.4.0-1044 linux-headers-4.4.0-1028-aws linux-headers-4.4.0-1035-aws linux-headers-4.4.0-1038-aws linux-headers-4.4.0-1041-aws linux-headers-4.4.0-1043-aws linux-headers-4.4.0-1044-aws linux-image-4.4.0-1028-aws linux-image-4.4.0-1035-aws linux-image-4.4.0-1038-aws linux-image-4.4.0-1041-aws linux-image-4.4.0-1043-aws linux-image-4.4.0-1044-aws Use 'sudo apt autoremove' to remove them. The following packages have been kept back: libdrm2 The following packages will be upgraded: grub-common grub-pc grub-pc-bin grub2-common libseccomp2 squashfs-tools unattended-upgrades 7 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. Need to get 3,477 kB of archives. After this operation, 28.7 kB of additional disk space will be used. Do you want to continue? [Y/n] y (snip) $ sudo reboot
AWSのは独自パッケージのようだ。
そんなに新しくないな。
$ uname -a Linux ip-xxx-xxx-xxx-xxx 4.4.0-1048-aws #57-Ubuntu SMP Tue Jan 9 21:45:57 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
実行する。
$ sudo ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-1048-aws #57-Ubuntu SMP Tue Jan 9 21:45:57 UTC 2018 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 35 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): YES * PTI enabled and active: YES * Checking if we're running under Xen PV (64 bits): NO > STATUS: NOT VULNERABLE (PTI mitigates the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
スペクターは未対策。
メルトダウンの対策がされたのはわかった。
