Yadda za a gano wace sandbox ta systemd ta ƙi hook ɗin OpenVPN ɗinka

Hook ɗin yana aiki lokacin da ka kunna shi da hannu a matsayin root kuma yana mayar da Operation not permitted a daidai lokacin da sabis ɗin ya fara shi. Fayil ɗin bai canza ba tsakanin waɗannan gudanarwa; yanayin ya canza. systemd yana ba da ƙaramin duniya ga tsari: ƙarancin iyawa, wani /dev, hanyoyin tsarin fayil na karatu kawai da iyakar ayyuka. Karanta gazawar a matsayin iyaka da ta ƙi wani aiki na musamman, ba a matsayin rubutun da ya lalace ba.

Fara daga aikin da aka ƙi

Layin log ɗin da ya ce unit ɗin ya kasa ba ya gaya maka kusan komai. Layin mai amfani yana ambaton kiran da aka ƙi: kullin na'urar da ba a iya buɗe shi ba, babban fayil da ba a iya rubuta a ciki ba, filin suna da ba a iya ƙirƙira shi ba. Nemo wannan kiran kafin ka taɓa ko ɗaya umarni, domin kowanne yana daidaita da wani takunkumi daban. Sa'an nan karanta unit ɗin da ya gudana da gaske, har da drop-in, maimakon fayil ɗin da kunshin ya aiko.

Binciken da ke ƙasa yana buga hanyar guntun, manyan fayilolin drop-in da kuma halayen da suka dace don ƙin na'ura ko tsarin fayil. Karanta su duka kafin ka yanke shawarar wace iyaka ce ta dace:

systemctl show "[email protected]" -p FragmentPath -p DropInPaths -p PrivateDevices -p DevicePolicy -p DeviceAllow -p ProtectHome -p ProtectSystem -p TasksMax
journalctl -u "[email protected]" -b --no-pager | grep -iE 'operation not permitted|permission denied|cannot open|failed'

Babu wani abu a cikin wannan gunkin da yake rubutu. Idan kiran da aka ƙi ba ya cikin jaridar, haɓaka cikakken bayani na abokin ciniki don gudanarwa ɗaya maimakon yin hasashe kan umarni. Tsarin da ke gudana yana tabbatar da cewa unit ɗin ya fara, ba cewa hook ɗin ya gudana da ikon da yake buƙata ba.

Filin suna yana buƙatar haƙƙin mount da na'urar TUN ba ta taɓa amfani da su ba

Ayyuka biyu da suka yi kama a cikin hook ɗaya suna da bayanan izini daban. Buɗe /dev/net/tun da ƙirƙirar mu'amala yana buƙatar gudanarwar cibiyar sadarwa tare da samun damar zuwa wannan kullin. Ƙirƙirar filin sunan cibiyar sadarwa mai suna kuma yana buƙatar aikin mount, domin kayan aikin filin suna yana mount sabon /sys kallo kuma yana ɗaure babban fayil ɗin yanayi a wurinsa. unit ɗin abokin ciniki na asali yana barin gudanarwar mount a waje da jerin iyakokinsa da gangan, don haka ana ƙin matakin filin suna yayin da tunnel ɗin da kansa zai yi aiki.

Shi ya sa ba da kullin na'urar ba ya ceto rubutun. Izinin na'ura yana amsa tambaya ɗaya, shin wannan tsari zai iya buɗe wannan kullin, kuma tambayar filin suna wata ce dabam. Daidaita kiran da ke kasawa da iyawarsa kafin ka faɗaɗa wani abu.

Gwaji a cikin shell ɗinka yana gada kowace iyawa da root marar iyaka yake da ita, kuma unit ɗin yana gada abin da jerin iyakokinsa ya riƙe. Waɗannan gudanarwa biyu gwaje-gwaje ne daban ko da binary ɗin ɗaya ne.

Na'urori, hanyoyi masu kariya da iyakokin ayyuka

Da zarar an san aikin da aka ƙi, ƙungiyoyin umarni uku suna bayyana yawancin gazawa. Samun damar na'urori yana ƙarƙashin PrivateDevices, wanda ke maye gurbin /dev da ƙaramin saitin na'urorin karya, da kuma DevicePolicy tare da DeviceAllow, waɗanda ke yanke shawarar abin da cgroup ke yarda da shi. /dev/net/tun ba ya cikin wannan ƙaramin saiti, don haka unit ɗin da ke da PrivateDevices=yes ba zai iya buɗe shi ba, ko da manufar na'ura ta ce me.

Kariyar tsarin fayil tana amsa tambaya ta biyu. ProtectHome=yes yana mai da /home, /root da /run/user marasa isa, kuma ProtectSystem=full yana mai da /usr, /boot da /etc karatu kawai. Don haka hook ɗin da ke rubutu kusa da fayil ɗin saɓo daidaitonsa yana aiki a cikin shell ɗinka kuma yana kasawa a ƙarƙashin unit ɗin, da irin wannan siffar izini kamar iyawar da ta ɓace. Matsar da shigarwar da ake rubutawa zuwa hanyar da manufar ta yarda, ko ƙara ƙaramin ReadWritePaths= shigarwa.

Iyakokin albarkatu su ne ƙungiya ta uku, kuma mafi ƙarancin bayyana. TasksMax= yana iyakance yawan ayyukan da unit ɗin zai iya ƙirƙira, kuma iyakar bayanin fayil tana yin irin wannan ga sockets da hannaye. Ƙaddamarwar da ta wuce iyaka tana kasawa da kuskuren albarkatu maimakon kuskuren izini, shi ya sa ainihin saƙon har yanzu yana da muhimmanci.

Fitar da matakin filin suna daga hook ɗin

Shiri da ke buƙatar izinin da bai kamata abokin ciniki ya riƙe ba yana cikin unit ɗinsa. Oneshot da ke gudana kafin abokin ciniki, yana riƙe sakamakonsa kuma an tsara shi kafin haɗin, yana ba matakin filin suna abin da yake buƙata ba tare da ba da waɗannan haƙƙoƙin ga tsarin tunnel ba. Sa'an nan abokin ciniki yana nuni ga wannan unit maimakon kiran rubutun daga hook ɗin up ɗinsa.

Samfurin da ke ƙasa siffa ce ta farawa, ba abin da za a yi amfani da shi ba tare da karantawa ba. Yana riƙe shirin a inda izinin yake zaune kuma yana barin unit ɗin tunnel ba tare da taɓawa ba:

# /etc/systemd/system/[email protected]
[Unit]
Description=Namespace preparation for %i
Before=openvpn-client@%i.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/netns-up.sh %i
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
[Install]
WantedBy=multi-user.target

Ƙara tsari da drop-in maimakon gyara unit ɗin da aka tattara, domin haɓakawa ba za ta iya watsi da canjin ka cikin shiru ba. Babban fayil ɗin yana da alaƙa da sunan misali, don haka bayanin martaba na biyu yana buƙatar fayil ɗinsa:

sudo mkdir -p /etc/systemd/system/[email protected]
sudo tee /etc/systemd/system/[email protected]/10-namespace.conf >/dev/null <<'CONF'
[Unit]
[email protected]
[email protected]
CONF
sudo systemctl daemon-reload

Maimaita wannan kira bayan canjin

Ba a tabbatar da gyara sai lokacin da wannan kira ya ba da wani sakamako dabam. Sake kunna duka unit ɗin biyu, gudanar da aikin da ya kasa, kuma kwatanta sakamakonsa da layin jaridar da ka ajiye kafin canjin. Unit ɗin da ke farawa yayin da hook ɗin ba ya sake gudana ba gyara ba ne.

Jerin da ke ƙasa yana riƙe kwatancen da gaskiya, domin yana bincika kiran da aka ƙi ba launin unit ɗin ba. Ajiye fitarwarsa kusa da layin jaridar da ka kama kafin canjin:

sudo systemctl restart "[email protected]" "[email protected]"
systemctl status "[email protected]" --no-pager
journalctl -u "[email protected]" -b --no-pager | grep -c 'Operation not permitted'
ip -brief addr show tun0

Ƙidaya ƙin yarda maimakon karanta layin ƙarshe, domin hook na iya kasawa, sake gwadawa kuma yin nasara, kuma ƙididdigar ce kaɗai ke nuna ko iyakar ta motsa. Bar sharhi a cikin drop-in wanda ke ambaton umarnin da ka sassauta da dalilin, tunda haɓakawa na gaba yana kwatanta daidaitonsa da tsoho na kunshin. Unit ɗin da ke farawa kawai bayan an kashe kowace kariya ba a gyara shi ba.