/dev/net/tun ba ya nan yayin da tun ke lodawa: gyara kullin na'urar

OpenVPN yana tsayawa da korafin errno 2 game da /dev/net/tun yayin da lsmod ke lissafin modul ɗin tun cikin kwanciyar hankali. Dukkan gaskiyar biyu gaskiya ne a lokaci ɗaya. Modul ɗin yana samar da direba, kuma hanyar da abokin ciniki ke buɗewa kullin na'ura ne wanda wani abu daban dole ya ƙirƙira. Ɗaukar su a matsayin abu ɗaya shine dalilin da yasa gyaran bayyananne na sake loda modul ɗin ba ya canza komai kwata-kwata.

Abu biyu, masu biyu daban-daban

Modul na kernel da kullin na'ura abubuwa ne masu zaman kansu tare da zagayen rayuwa masu zaman kansu. Loda modul ɗin yana yin rijistar direba, kuma a tsarin da ke da devtmpfs kernel yana neman a ƙirƙiri kullin da ya dace. A tsarin da ba shi da devtmpfs babu abin da ke ƙirƙirar komai, kuma direban yana zaune a wurin ba tare da wata hanya da ke nuna shi ba. Modul ɗin na iya zama a loda, lafiyayye kuma gaba ɗaya ba za a iya isa gare shi ta hanyar tsarin fayil a lokaci ɗaya.

Shi ya sa rubutun kuskure da jerin modul ba sa cin karo da juna. Abokin ciniki yana buɗe hanya, hanyar ba ta nan, kuma kernel yana mayar da ENOENT kafin a tuntuɓi direban tun kwata-kwata. Sake loda modul ɗin ba zai iya gyara hanyar da ta ɓace ba, kuma ƙirƙirar hanyar ba zai iya gyara direban da ya ɓace ba.

lsmod | grep -w tun
stat -c "%F %t:%T" /dev/net/tun
grep " /dev " /proc/mounts

devtmpfs da mknod bayyananne

Yawanci hanyoyi biyu ne ke ƙirƙirar wannan kullin, kuma sanin wanne ya kamata ya kasance da alhakin yana gaya muku abin da za a gyara. devtmpfs yana barin kernel ya ƙirƙiri kullin na'urori a cikin kwafin da aka ɗaura, kuma udev yana sanya mallaka da izini a kansu. Wani mknod bayyananne shine hanyar hannu don hotuna da wuraren suna inda babu ɗayan waɗannan da ke gudana lokacin tashi.

Kwatanta sakamako maimakon niyya. Idan devtmpfs yana ɗaure a /dev kuma kullin har yanzu ba ya nan, direban ba shine wanda kuke tsammani ba, ko wani abu ya cire kullin bayan tashi. Idan /dev babban jagora ne a cikin rootfs da aka buɗe, babu wata hanya ta atomatik kuma wanda ya gina hoton dole ya ƙirƙiri kullin.

stat -c "%F major=%t minor=%T" /dev/net/tun
# expect: character special file major=a minor=c8

Inda babu ɗayan hanyoyin da ke gudana, dole a yi kullin da hannu, kuma tsari yana da muhimmanci. Fara ƙirƙirar babban jagorar, domin mknod ba zai iya ƙirƙira shi ba, sannan na'urar haruffa, sannan yanayin da zai bar ta a rubuta ta root kawai. Sake loda modul ɗin kafin ka ƙirƙiri kullin, kuma cire hanyar da take nan kawai bayan ls ya nuna cewa jagora ce ba na'ura ba.

sudo modprobe tun
sudo mkdir -p /dev/net
sudo mknod /dev/net/tun c 10 200
sudo chmod 600 /dev/net/tun
ls -l /dev/net/tun

Nau'in da stat ke bayarwa shine mafi saurin bambanci, kuma jagora a wannan hanyar ita ce mafi yawan abin mamaki a cikin ƙananan hotuna. Wani mkdir da kyakkyawar niyya a cikin Dockerfile yana barin daidai haka, kuma babu yawan loda modul da zai maye gurbin jagora da na'urar haruffa. Major 10 tare da minor 200 shine ma'auratan da aka yi rijista don tun, wanda aka bayyana a hexadecimal kamar a da c8.

Alamomi huɗu, dalilai huɗu

Dalilai huɗu suna bayanin kusan kowane yanayi, kuma kowanne yana barin wata alama daban a cikin rajistan ayyukan. Fara da yanayin tashi. Hotuna marasa faifai, allunan da aka saka da matakan initramfs sau da yawa ba sa ɗaure devtmpfs ko /devda udev ke sarrafawa, don haka babu wani tsari da ya taɓa rubuta kullin. Sannan karanta zaɓuɓɓukan ɗaurewa a duk abin da /devke ɗauka, domin nodev yana barin hanyar ta kasance yayin da ya ƙi buɗe ta, kuma ɗaurewar bind da aka ɗauka daga mai masauki mai tsauri tana ɗauke da tutar ba tare da sanar da kanta ba. Ɗaurewar karatu-kawai tana gazawa da wuri kuma da ƙarfi: mknod yana mayar da EROFS a wurin, yayin da EPERM ke nufin tsarin ba shi da ikon, ba wai tsarin fayil yana kare kansa ba. A ƙarshe, runtime na kwantena mai nasa /dev tmpfs yana buƙatar a shigar da kullin cikin nasa wurin suna, kuma cgroup ɗin na'urarsa dole ya ba da izinin ma'auratan major da minor.

Duba matakin manufa kafin sake canza izini. SELinux da AppArmor na iya ƙin buɗewa wanda kowane sifa na fayil ya yarda da shi, kuma wannan ƙin yana bayyana a cikin rajistan dubawa ba a cikin fitarwar abokin ciniki ba. Canjin izini da ba ya taɓa bayyana a cikin ƙi lokaci ne da aka kashe a matakin da bai dace ba gaba ɗaya.

sudo journalctl -k -n 20 --no-pager
sudo ausearch -m AVC -ts recent | tail -5

Tabbatar da shi da mu'amala, ba da jeri ba

Jeri mai nasara yana tabbatar da cewa hanya tana nan kuma ba wani abu ba. Buɗe kullin tun lafiyayye don karatu kuma kiran zai dawo da kuskure, domin na'urar ba ta da ma'anar karatu kuma ba fayil na yau da kullum ba ce. Wannan kuskuren shine alamar nasara a nan, kuma gane shi yana hana ka bin sa a matsayin lahani.

head -c 1 /dev/net/tun
head: error reading '/dev/net/tun': File descriptor in bad state

Jarrabawar yanke hukunci tana ƙirƙirar mu'amala, domin tana gwada direban, kullin da damar ka a mataki ɗaya. Idan ƙari ya yi nasara kuma hanyar haɗi ta bayyana, duk uku suna aiki. Lokacin da ya gaza, errno yana raba dalilan: ENOENT yana nufin babu kullin da za a iya amfani da shi, EPERM yana nuni ga iyawa, tutocin ɗaurewa ko manufa, kuma EBUSY yana nufin wani tsari ya riga ya mallaki mu'amalar.

sudo ip tuntap add dev tun7 mode tun
ip -brief link show tun7
sudo ip tuntap del dev tun7 mode tun

Gudanar da wannan jarrabawar a cikin yanayin da ke gazawa a zahiri, domin sashin sabis, kwantena ko aiki da aka tsara na iya ɗauke da wani tsarin iyawa daban fiye da harsashin shigarka. Jarrabawar da ta wuce a cikin yanayin da bai dace ba ba ta tabbatar da komai game da wanda ke gazawa.

Lokacin da na'urar ba ita ce matsalar ba

Idan jarrabawar mu'amala ta yi nasara kuma abokin ciniki har yanzu yana gazawa, matsalar da ta rage ita ce bayanin martaba, yanayin sabis ko hanya, kuma na'urar tana lafiya. Wannan shine lokacin da za a daina gyara kullin na'urori, domin ƙarin canje-canje suna ƙara nisa daga tsarin da ke aiki kawai.

Gudanar da bincike biyar ɗin guda ɗaya kowace lokaci maimakon ƙirƙirar sabo: shin an loda modul ɗin ba tare da modul mai hamayya ba, shin hanyar na'urar haruffa ce da major da minor daidai, shin zaɓuɓɓukan ɗaurewa suna da tsabta, shin yanayin tsari yana ɗauke da iyawa, kuma shin akwai ƙin manufa a lokacin gazawar. Lahani da ya tsira daga duka biyar ba matsalar na'ura ba ce, duk abin da saƙon ya ambata.