Linux Audit

Are these anti-cheats kernel modules? Asking because I only play two games on Linux and they do not use rootkits. If so one could at least prevent the installation using a couple sysctl variables [1]. I do not recommend putting this in /etc/sysctl.conf or in the .d directory as it can break OS updates among other things... I would instead put it in a startup script so that it can easily be disabled and the node rebooted. This would be in the cases the game installer wants elevated privileges and silently tries to install the modules. Obviously it will break the game but maybe that will happen soon enough so that one can request a refund for the games that did not disclose the rootkit. Once these are set to 1 on a running system the only way to set back to 0 is to disable that startup script and reboot as it becomes immutable on a running system. Your OS update tools should also be wrapped to check if this is enabled, warn you and politely abort until it is unset. The failure conditions are not strictly binary and may work, or appear to work until the machine is bricked. Related to this it may be worth installing something that does checksum snapshots of the filesystems to see if a game has tampered with system files. OSSEC, chkrootkit or even a cron job that just does this manually and runs diffs. While some package managers have this functionality they will usually ignore files outside of the package manifest that may get picked up by the system. Immutable…

Forget bpf, Linux has the audit framework to solve exactly this problem, and it's been in heavy use for a couple of decades now https://www.redhat.com/en/blog/configure-linux-auditing-auditd https://linux-audit.com/linux-audit-framework/configuring-and-auditing…

Why would you hide the files a user is explicitly expected to tweak to configure an app's behavior and call it an improvement??? It degrades the config experience, what part of "usability" is improved? Also, fun historical fact: it was a bug when it was implemented https://linux-audit.com/linux-history-how-dot-files-became-hidden-file…

Roughly the same reason why dotfiles became a thing on Unix: https://linux-audit.com/linux-history-how-dot-files-became-hidden-file… Fortunately more and more software is putting its config in ~/.config/ rather than dumping it all over users' home directories.

Checkout hidepid=2 mount option. https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/ Some things can break (like pihole can't find the pidof FTL and such) but normally not an issue for most programs.

ls -l $HOME/.gvfsd/.profile/gvfsd-helper /bin/systemd/systemd-daemon /usr/lib/systemd/systemd-daemon If one or more of those files is found, you likely are infected - they probably are not "real" system files. If you find one, do a system audit https://linux-audit.com/determine-file-and-related-package/

If you're wondering what BPF is: https://linux-audit.com/bpfilter-next-generation-linux-firewall/ and https://en.wikipedia.org/wiki/Berkeley_Packet_Filter

Why such a hack? This is a solved problem already. Try Linux audit API. You can set it up for tracking various actions, and you'll get a log with all the information including a process name. https://linux-audit.com/configuring-and-auditing-linux-systems-with-au…

A pretty sensible overview of auditd for those who aren't Linux sysadmins: https://linux-audit.com/configuring-and-auditing-linux-systems-with-au…

Have a look at eg: https://linux-audit.com/granting-temporary-access-to-servers-using-sig… And re-read the (imnho rather obtuse) ssh-keygen man pages. [ed: and maybe this too: https://framkant.org/2017/07/scalable-access-control-using-openssh-cer… ]

How do you do kernel updates without a reboot? I've looked several times and found different technologies over time (kexec, (Oracle's) ksplice, kGraft, kpatch, livepatch). They do appear to have some use-cases, e.g. delaying the need for a reboot by being able to install a critical vulnerability fix/workaround so that the reboot can be done at a more convenient time. Because many of the patch mechanisms are function-based, they don't appear to solve the general problem in such a way that reboots can be avoided all together for arbitrary large kernel changes. From my reading of the solutions none are at the level of unattended upgrades using apt/yum-cron or similar in a way that "most" can benefit from them without worrying too much about it (ksplice might do it, but not sure how much you need to pay for it for server use and therefore how accessible it is). kexec helps with skipping the bootloader/BIOS, but I'm not sure if it ends up restaring all the systemd services or going up/down the runlevels, some places suggest it reduces downtime but doesn't eliminate it. I've not experimented with any of these myself yet... so I'd be happy to be proven wrong and in any case learn more! References: - http://jensd.be/651/linux/linux-live-kernel-patching-with-kpatch-on-ce… - https://linux-audit.com/livepatch-linux-kernel-updates-without-rebooti… - https://wiki.archlinux.org/index.php/Kernel_live_patching - https://wiki.archlinux.org/index.php/Kexec EDIT: forgot to…

I was at my CPA the other day. One of her two monitors went blank due to a h/w issue and so per instructions from her IT guy she had to reboot. Windows decided it had to apply updates as part of the shutdown sequence and she was unable to decline. So we had to sit there and wait 5 minutes for it to apply the updates, then reboot. (Maybe there's a way to override applying the updates and yes, she should get her second monitor fixed. I'm her client, not her IT person, so I wasn't going to intervene. And we had a nice conversation while waiting, so there's that.) FTR, macOS has also become increasingly annoying with how it applies updates, and my iOS devices never seem to auto update at night like they're supposed to. As in industry, we suck at this. Is Linux the only OS making an effort at patching without rebooting? And does it actually work? https://linux-audit.com/livepatch-linux-kernel-updates-without-rebooti…