Current State of Kloak?

madaidan · September 18, 2019, 4:12pm

madaidan · September 18, 2019, 9:48pm

I wonder if it would make sense to enable compile time hardening flags for kloak. I don’t know very much about these so I’m not sure.

Patrick_mobile · September 19, 2019, 4:28am

All already enabled.

Patrick · September 19, 2019, 7:15am

This could be reviewed for example by using:

hardening-check

and

checksec --file

madaidan · September 19, 2019, 4:31pm

They don’t seem to be for me on Arch Linux.

hardening-check gives me

kloak:
 Position Independent Executable: yes
 Stack protected: yes
 Fortify Source functions: no, not found!
 Read-only relocations: yes
 Immediate binding: no, not found!

checksec gives me

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   140 Symbols     Yes	0		6	kloak

They are all fully enabled on Whonix though. It may be a difference in Debian and Arch’s default toolchain. It would probably be helpful to hard code the hardening flags in so it doesn’t rely on the OS’s toolchain having them by default.

The default compiler for kloak (GCC) also doesn’t seem to support things like control flow integrity or safestack which those scripts don’t check for either.

Patrick · January 1, 2020, 12:06pm

sudo journalctl -b -o cat | grep DENIED | grep kloak

AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:99): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:100): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:101): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:102): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:103): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
AVC apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:104): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:105): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:106): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”
audit: type=1400 audit(1577878831.488:107): apparmor=“DENIED” operation=“ptrace” profile=“/usr/sbin/kloak” pid=3211 comm=“fuser” requested_mask=“readby” denied_mask=“readby” peer=“/usr/bin/whonixcheck”

Patrick · January 1, 2020, 12:15pm

Patrick · January 13, 2020, 5:16pm

Still.

Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:25): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:26): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:27): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:28): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:29): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:30): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:31): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:32): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host kernel: audit: type=1400 audit(1578935540.625:33): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"
Jan 13 17:12:20 host audit[4001]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/sbin/kloak" pid=4001 comm="fuser" requested_mask="readby" denied_mask="readby" peer="/usr/bin/whonixcheck"

I wonder how kloak and whonixcheck are connected. Any idea how to fix?

madaidan · January 13, 2020, 5:19pm

Add

deny ptrace,

to the kloak profile. Kloak shouldn’t need to ptrace whonixcheck. Dunno why it’s giving errors.

Patrick · January 13, 2020, 5:26pm

This does not happen directly after boot. Only when manually run whonixcheck form terminal after boot.

kloak has already capability sys_ptrace, Therefore should be allowed already?

We need to understand why this happens. If it has a strange interaction with whonixcheck it might have a strange interaction with other applications too.

In worst case this could crash kloak or render it ineffective.

Patrick · January 13, 2020, 5:31pm

This fixed it:

https://github.com/Whonix/kloak/commit/081fa02799e60f8e33e39c858fe13853e01c2b5f

madaidan · January 13, 2020, 5:33pm

No, the capability and apparmor ptrace rules are different.

That should be changed to ptrace readby,. Giving it all ptrace permissions is dangerous. It only needs readby.

Patrick · January 13, 2020, 5:37pm

Using that now.

https://github.com/Whonix/kloak/commit/84fca49dc259c68b9d1caa61f4d7cddb78fb6ba9

Patrick · January 13, 2020, 5:40pm

https://github.com/vmonaco/kloak/pull/26

Patrick · August 6, 2020, 11:49am

Patrick · September 7, 2020, 8:03am

github.com/vmonaco/kloak

SystemCallFilter causing service to fail after OS upgrade

opened 01:51AM - 10 Jul 20 UTC

closed 03:16AM - 07 Sep 20 UTC

haroonrafi

I upgraded Linux Mint from v19 (based on Ubuntu 18.04) to v20 (Ubuntu 20.04) and… Kloak stopped working as a service, although it worked when run manually. Removing and reinstalling made no difference. ``` ● kloak.service - kloak anti keystroke deanonymization tool Loaded: loaded (/lib/systemd/system/kloak.service; enabled; vendor preset: enabled) Active: failed (Result: core-dump) since Fri 2020-07-10 02:05:08 BST; 516ms ago Docs: https://github.com/vmonaco/kloak Process: 13922 ExecStart=/usr/sbin/kloak (code=dumped, signal=SYS) Main PID: 13922 (code=dumped, signal=SYS) Jul 10 02:05:08 DESKTOP systemd[1]: kloak.service: Scheduled restart job, restart counter is at 5. Jul 10 02:05:08 DESKTOP systemd[1]: Stopped kloak anti keystroke deanonymization tool. Jul 10 02:05:08 DESKTOP systemd[1]: kloak.service: Start request repeated too quickly. Jul 10 02:05:08 DESKTOP systemd[1]: kloak.service: Failed with result 'core-dump'. Jul 10 02:05:08 DESKTOP systemd[1]: Failed to start kloak anti keystroke deanonymization tool. ``` After narrowing it down to `SystemCallFilter` in `kloak.service` and running `strace`, it seems that adding `pread64` to the list fixes the problem: ``` SystemCallFilter=ioctl nanosleep select write read openat close brk fstat lseek mmap mprotect munmap rt_sigaction rt_sigprocmask access execve getuid arch_prctl set_tid_address set_robust_list prlimit64 pread64 ```

Patrick · September 7, 2020, 11:08am

Patrick · December 3, 2020, 9:59am

Package build on the ARM hardware platform might be fixed in Debian bullseye and above:
arm support · Issue #25 · vmonaco/kloak · GitHub

Might try again on Debian bullseye.

arm support · Issue #25 · vmonaco/kloak · GitHub

Patrick · August 4, 2021, 7:57pm

github.com/vmonaco/kloak

compilation warning string_fortified.h:106:10: warning: '__builtin_strncpy' specified bound

opened 07:56PM - 04 Aug 21 UTC

adrelanos

``` gcc src/main.c src/keycodes.c -o kloak -lm -lpthread -Wdate-time -D_FORTIFY…_SOURCE=2 -g -O2 -ffile-prefix-map=/build/kloak-0.2.29=. -fstack-protector-strong -Wformat -Werror=format-security -Wl,-z,relro -Wl,-z,now gcc src/eventcap.c -o eventcap -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -ffile-prefix-map=/build/kloak-0.2.29=. -fstack-protector-strong -Wformat -Werror=format-security -Wl,-z,relro -Wl,-z,now In file included from /usr/include/string.h:495, from src/main.c:2: In function 'strncpy', inlined from 'main' at src/main.c:554:5: /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: warning: '__builtin_strncpy' specified bound depends on the length of the source argument [-Wstringop-overflow=] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/main.c: In function 'main': src/main.c:554:5: note: length computed here 554 | strncpy(_rescue_keys_str, rescue_keys_str, strlen(rescue_keys_str)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ```

Patrick · August 17, 2021, 9:42pm