一、内核提权
由于目前fullnat用的内核是2.6.32-220.23.1.e16这个版本。最近存在内核提权的漏洞。这次受影响的存在于centos6中除了6.5的所有系统。
乌云上已经公布了http://zone.wooyun.org/content/3733
解决的办法是：
sysctl kernel.perf_event_paranoid=2
并写到/etc/sysctl.conf关于kernel.perf_event_paranoid：
kernel.perf_event_paranoid = 2: you can't take any measurements. The perf utility might still be useful to analyse existing records with perf ls, perf report, perf timechart or perf trace. kernel.perf_event_paranoid = 1: you can trace a command with perf stat or perf record, and get kernel profiling data. kernel.perf_event_paranoid = 0: you can trace a command with perf stat or perf record, and get CPU event data. kernel.perf_event_paranoid = -1: you get raw access to kernel tracepoints (specifically, you can mmap the file created by perf_event_open, I don't know what the implications are).
如果想直接打到内核中，修改kernel/events/core.c，找到int sysctl_perf_event_paranoid在最后改成2。然后搭乘patch，做成内核rpm包
二、待续