[N950] Infodump Thread - Page 2 - maemo.org

Active Topics

The N900 is now 15 years old! (9)
to Nokia N900 by Arno_11 - 9 hrs, 12 mins ago
Sailfish OS for the Motorola Moto G7 Power (XT1955-5) - (ocean) (4)
to SailfishOS by Maemish - 5 days, 21 hrs ago
more...

Page 2 of 8

< Prev

Next >

Last »

Thread Tools

	javispedro	2011-08-09 , 22:45
	Posts: 2,355 \| Thanked: 5,249 times \| Joined on Jan 2009 @ Barcelona	#11

Originally Posted by qole

So javispedro, can you explain how to get into this "non-enforcing mode"? Because I'm still stuck in the same place.

The main goal is to disable the aegis "seal" that prevents tampering from userspace to the Aegis enforcing settings. I mentioned userspace because nothing prevents a kernel module from tampering with the seal, and that is exactly what can be done: a module that removes the seal.

So, the steps should be:

Put the kernel module binary and the modhash.py script into a directory accessible by root.
Open a root shell, and then enter develsh.
Code:
```
# develsh
```
Calculate the hash of the unseal.ko module using the modhash.py script. It will also try to add it to the Aegis whitelist.
Code:
```
# python modhash.py unseal.ko 
2ff9c8645c953d97bbd31b4b36fe401b3932a038
```
(You do not need to do anything with the hash; it should all be done automatically)
Load the module!
Code:
```
# insmod unseal.ko
```

Check the results

Code:

# dmesg -c
...
[  416.146728] unseal: valinfo.seal=0

Now that Aegis configuration is no longer sealed, disable it!
Code:
```
# echo 0 > /sys/kernel/security/validator/enforce
```

In non-enforcing mode, Aegis will print all of the "security warnings" it prints on dmesg as usual, but it will not actually reject binaries.

Some things to note:

Note that you need to repeat all of the steps every time you reboot.
Do not blame me if you trigger Aegis selfdestruction doing this (you will need to reflash)
Do not use this kernel module in anything other than the current N950 image
The modhash.py script can be used to hash any other kernel module you would wish to load.
This can be at any moment disabled by a future firmware so I suggest not making a fuss about it. I suggest using it for developer convenience only for the time being. It it is not a hack -- in fact, it will only work when developer mode and develsh are available and contain the many required privileges.

Last edited by javispedro; 2011-09-20 at 23:04. Reason: removing unneeded stuff

Quote & Reply |

The Following 37 Users Say Thank You to javispedro For This Useful Post:
AapoRantalainen, AlMehdi, asys3, BrettQ, Bundyo, Daneel, daperl, divan, dwaradzyn, fms, gionni88, hawaii, Jaffa, joerg_rw, lkravovicz, lma, marxian, mdengler, mece, mgedmin, MohammadAG, momcilo, mr id, mrsellout, nicolai, Pillum, qole, Reffyyyy, rlinfati, saned, shady, sjgadsby, Tigerite, wicket, YavkatA, ysss, zehjotkah

	hawaii	2011-08-09 , 23:03
	Posts: 1,030 \| Thanked: 792 times \| Joined on Jun 2009	#12

Woot!

I have to also suspect that this "hole" was intentional. I've not come across TC platforms in my entire life, so I'm hoping engineers who implemented this and left a plaintext file for policy configuration, did so on purpose.

The config file can't be reloaded into the tcb module without developer mode, so at least that's a small hurdle :P

Quote & Reply |

	qole	2011-08-09 , 23:26
	Moderator \| Posts: 7,109 \| Thanked: 8,820 times \| Joined on Oct 2007 @ Vancouver, BC, Canada	#13

I'm getting Internal Server Error trying to get the modhash.py script...

__________________
qole.org --- twitter --- Easy Debian wiki page
Please don't send me a private message, post to the appropriate thread.
Thank you all for your donations!

Quote & Reply |

The Following User Says Thank You to qole For This Useful Post:
javispedro

	hawaii	2011-08-09 , 23:30
	Posts: 1,030 \| Thanked: 792 times \| Joined on Jun 2009	#14

403. Bad perms on dir?

Quote & Reply |

	javispedro	2011-08-09 , 23:37
	Posts: 2,355 \| Thanked: 5,249 times \| Joined on Jan 2009 @ Barcelona	#15

Yes, fixed.

Quote & Reply |

	hawaii	2011-08-09 , 23:38
	Posts: 1,030 \| Thanked: 792 times \| Joined on Jun 2009	#16

Got files. Will test now.

Quote & Reply |

	hawaii	2011-08-09 , 23:46
	Posts: 1,030 \| Thanked: 792 times \| Joined on Jun 2009	#17

Code:

[29046.856658] unseal: Hello World !!
[29046.856719] unseal: valinfo at 0xb0541780
[29046.856719] unseal: valinfo.seal=1
[29046.856750] unseal: Aegis unsealed
[29046.856781] unseal: valinfo.seal=0

Success. Didn't burn itself.

Curiously, the only reason this works is because kernel modules don't need signing to be loaded? You simply need a SHA1 hash of the module injected into the loading whitelist?

Quote & Reply |

lma	2011-08-09 , 23:48
Posts: 2,802 \| Thanked: 4,491 times \| Joined on Nov 2007	#18

Originally Posted by hawaii

I have to also suspect that this "hole" was intentional. I've not come across TC platforms in my entire life, so I'm hoping engineers who implemented this and left a plaintext file for policy configuration, did so on purpose.

The config file can't be reloaded into the tcb module without developer mode, so at least that's a small hurdle :P

Well, the entire thing hinges on having develsh pre-installed and with enough credentials to even load kernel modules. I'm 99.99% certain that retail devices won't be so lucky.

Quote & Reply |

	javispedro	2011-08-09 , 23:53
	Posts: 2,355 \| Thanked: 5,249 times \| Joined on Jan 2009 @ Barcelona	#19

Remember to do the echo 0 > enforce part, otherwise Aegis is kept in enforce mode.

Originally Posted by hawaii

Curiously, the only reason this works is because kernel modules don't need signing to be loaded? You simply need a SHA1 hash of the module injected into the loading whitelist?

Yes. In the initial version, I modified restok.conf to give the unknown source all of the privileges I wanted (dac_admin, setuid, setgid, and sys_module). But then I realized develsh already has all of those tokens... so I deduced you could already load modules; only the hashes were missing, but develsh also had the privileges to load those.

Therefore, I used develsh as a replacement for the restok.conf trick.

Quote & Reply |

The Following User Says Thank You to javispedro For This Useful Post:
qole

	javispedro	2011-08-10 , 00:05
	Posts: 2,355 \| Thanked: 5,249 times \| Joined on Jan 2009 @ Barcelona	#20

Originally Posted by lma

Well, the entire thing hinges on having develsh pre-installed and with enough credentials to even load kernel modules. I'm 99.99% certain that retail devices won't be so lucky.

Nokia has indeed said that certain "locked" (operator locked?) devices won't have developer mode (and thus no develsh)

However, not even in my worst nightmares I expect unlocked devices to be shipped without developer mode -- cause they would be as locked as an iPhone or even more.