Sabis ɗin VPN yana kasawa a EXEC: kwatanta unit, binary da sudoers

Jiya tunnel ɗin yana aiki, kuma da safiyar yau unit ɗin ya mutu tare da Failed at step EXEC spawning /usr/local/bin/vpnclient a cikin journal. Takardun shiga, hanyoyi da asusun ba sa shiga wannan jimlar. systemd ya warware ExecStart zuwa wata hanya, ya nemi kernel ya aiwatar da ita, kuma kernel ya ƙi, galibi domin babu wani abu a wannan hanyar ko kuma fayil ɗin ba ya iya aiwatarwa. Ka ɗauki kuskuren a matsayin matsalar fayil da argv har sai umarnin da aka yi nazari ya tabbatar da akasin haka.

Me ya sa EXEC ke kasawa kafin a fara tabbatarwa

systemd ba ya tafiyar da ExecStart ta hanyar shell. Yana yin fork, yana gina vector ɗin hujjoji daga layin, sannan yana kiran execve a kan sashi na farko. Idan wannan kiran ya kasa, sabis ɗin ba ya taɓa isa ga lambar nasa na abokin ciniki VPN, don haka gyaran profile ko duba takardun shiga ba zai taimaka ba.

Lambar matsayi ta raba wannan rukuni daga faɗuwar yau da kullum. Unit da ya fita da status=203/EXEC bai taɓa tada wani tsari ba; unit da ya tashi sannan ya fita da status=1 mai yiyuwa ya kasa a tabbatarwa, DNS ko hanyar sadarwa. Karanta lambar kafin ka karanta log ɗin abokin ciniki, domin a yanayin farko log ɗin abokin ciniki zai kasance fanko.

Hanyar da ke cikin journal ita ce da systemd ya yi amfani da ita, ba lallai ba ita da ka gyara. Fayilolin drop-in da fitowar janareta na iya maye gurbin fayil ɗin mai kaya, kuma tsohon daemon-reload yana barin tsohon layin a cikin ƙwaƙwalwa. Shi ya sa binciken farko shi ne ka tambayi systemd abin da yake tsammanin umarnin, maimakon buɗe fayil ɗin da ka tuna ka canza.

Wurare uku da aka rubuta hanyar binary ɗin

Abokin ciniki VPN da aka shigar daga fakitin rarraba, rubutun mai kaya da tarball ɗin fitowa na iya sauka a cikin prefixes uku daban-daban. Unit, ka’idar izini da mai shigarwa kowanne ya rubuta ɗaya daga cikin waɗannan prefixes, kuma kuskuren yana bayyana lokacin da biyu daga cikin uku ba su daidaita ba.

Rashin daidaito na zahiri yana kama da haka: rubutun mai kaya yana shigarwa zuwa /usr/local/bin, an buɗe tarball ɗin ƙarƙashin /opt, kuma unit ɗin har yanzu yana ambaton tsohuwar hanyar /usr/bin daga fakitin baya. Ɗaya ne kawai daga cikin waɗannan fayilolin yake wanzuwa, kuma ba kasafai ne ya zama wanda ke cikin ExecStart ba.

Ka yanke shawara wace hanya ce ta asali kafin ka canza ɗaya daga cikin fayilolin. Idan fakitin rarraba ne ya mallaki binary ɗin, hanyar fakitin ita ce ta asali kuma unit ɗin ya kamata ya bi ta. Idan rubutun mai kaya ne ya mallake shi, wannan ka’idar ɗaya ta shafi prefix ɗin mai kaya. Kwafin binary tsakanin prefixes yana ƙirƙirar kwafi biyu da za su rabu a sabuntawa na gaba.

Lokacin da umarni cikin alamun zance ya zama sunan fayil

Wata hanyar kasawa ta biyu tana ɓoye a bayan wannan layin journal. Wani ya rubuta wannan cikin unit ɗin kuma yana tsammanin abokin cinikin zai haɗu yayin tashin na’urar:

ExecStart=/usr/bin/"vpnclient connect office"

systemd yana raba darajar zuwa kalmomi, don haka kalma ta farko ta zama /usr/bin/vpnclient connect office, yayin da ake cire alamun zance a matsayin tsarin haɗawa. Sannan kernel yana neman fayil da sunansa ke ɗauke da sarari, kuma babu irin wannan. Kuskuren daidai yake da na binary ɗin da ya ɓace, duk da cewa an shigar da binary ɗin.

Sigar da ake tallafawa ita ce ainihin fayil mai aiwatarwa wanda hujjoji daban-daban ke biye da shi, misali ExecStart=/usr/bin/vpnclient connect office. Idan aikin da gaske yana buƙatar bututu ko sarkar, saka shi cikin rubutu kuma ka kira rubutun, domin ExecStart ba shi da &&, ba shi da bututu kuma ba shi da faɗaɗa glob.

Gyara unit ɗin, ba tsarin fayil ba

Gyaran da ke jaraba shi ne mahaɗin alama daga hanyar da ake tsammani zuwa ainihin binary ɗin. Yana aiki har sai fakitin ya sabunta kuma mahaɗin ya nuna fayil da aka cire, ko har sai alamar SELinux ta daina dacewa da manufa. Gara ka gyara unit ɗin ta hanyar drop-in domin fayil ɗin mai kaya ya kasance ba a taɓa shi ba kuma sabuntawa su kasance da tabbaci.

Ka’idar izini dole ta dace da wannan hanya da waɗannan ƙananan umarni. Shigarwar sudoers don /usr/local/bin/vpnclient ba ta ba da izinin /usr/bin/vpnclient ba, kuma shigarwar da ke yarda da kowace hujja tana barin kowane tsari na gida ya sake saita ko ya dakatar da tunnel ɗin. Ba da kalmomin aiki biyu da unit ɗin ke buƙata kuma ka ajiye wargajewa a wajensa idan dakatar da sabis ɗin ya riga ya rufe ma’amala.

Anan ne kwatancen ke biya: unit, bayanan fakitoci da sudoers ya kamata duk su ambaci hanya ɗaya. Idan sun yi haka, kuskuren EXEC yana ɓacewa ba tare da sake tayarwa ba kuma ba tare da kwafin binary a wuri na uku ba.

Tabbatar da umarnin da aka nazarta kafin sake tayarwa

sudo systemctl daemon-reload
sudo systemctl cat vpnclient.service
systemctl show -p ExecStart vpnclient.service
systemd-analyze verify /etc/systemd/system/vpnclient.service
sudo systemctl restart vpnclient.service
systemctl status vpnclient.service --no-pager

systemctl show ita ce fitowa mai yanke hukunci domin tana buga argv ɗin da systemd ya yi nazari da gaske, gami da kowane drop-in. systemd-analyze verify yana kama hanyar da ta ɓace ko ba za a iya aiwatarwa ba kafin ka sake tayarwa, kuma umarnin matsayi bayan sake tayarwa yana gaya maka ko tsarin yana nan yanzu.

Idan unit ɗin ya tashi sannan ya kasa, ka bar rukunin EXEC kuma ka shiga cikin sarrafa kuskure na abokin ciniki. Duba journal ɗin don saƙon abokin ciniki, ba wani gazawar execve ba. Riƙe diff ɗin unit da diff ɗin sudoers tare a cikin rikodin canji domin sabuntawa na gaba kada ya dawo da hanyar da ta rabu cikin shiru.