chroot yehluleka ku-OpenVPN: umthetho we-AppArmor noma amandla?

I-daemon ibhala ukuhluleka kwe-chroot futhi iphrofayela isivele ibonakala ivulekile, ngakho isixazululo esihehayo ukwandisa umthetho wendlela bese uqala kabusha. Lokho ngokuvamile akushintshi lutho, ngoba i-chroot ivinjwe ilungelo iphrofayela engakaze ikwazi ukulinikeza. Ukuze unqume ukuthi iyiphi ingqimba okufanele uyithinte, kudingeka izihlolo ezintathu, futhi zishibhile: lokho inqubo evunyelwe ukukugcina, lokho inqubomgomo eyikuvumayo, kanye nalokho umqalisi akususa ngaphambi kokuba noma yikuphi kulokho kube nokubaluleka.

Izivalo ezimbili ezihlukene, futhi esisodwa kuphela esingesika-AppArmor

I-chroot idinga i-CAP_SYS_CHROOT esikhaleni samagama somsebenzisi lapho inqubo igijima khona. Lokho kuyilungelo elivamile le-Linux, elihlolwa i-kernel ngaphambi kokuba ucingo lwenze noma yini ngezindlela. Ngokuhlukile, iphrofayela ye-AppArmor eqinisekisayo inganqaba amandla ngisho lapho inqubo inawo, ngoba inqubomgomo eyimpoqo ibhekwa ngaphezu kobufakazi bokuqinisekisa, hhayi esikhundleni salokho. Umehluko ubalulekile empilweni yangempela: izingqimba ezimbili zihlala kumafayela ahlukene futhi ngokuvamile zilondolozwa abantu abahlukene.

Lezo zivalo zimbili zehluleka nge-errno efanayo. Zombili zikhiqiza i-EPERM, futhi zombili zivela njengesikhalazo esijwayelekile semvume kusigcino se-daemon, yikho ukuzicabangela okuqukethwe kwephrofayela kuchitha isikhathi esingaka. Umthetho wendlela owawuzofaka ulawula ukufinyelela kwamafayela ngemva kokuba i-chroot iphumelele; awunakho ukuxhumana nokuthi umsebenzi uvunyelwe yini nhlobo.

Isivalo sesithathu sisezansi kwezinye zombili. Uma umphathi wesevisi noma umgoqo uqale inqubo ngaphandle kwalelo lungelo eqoqweni lomngcele wayo, akukho shintsho lwe-AppArmor olungayibuyisela, futhi ukwengeza amandla kuphrofayela kumane kubhala inhloso i-kernel engayigcwalisi.

Funda isimo selungelo ngaphambi kokuhlela inqubomgomo

Qala enqubeni egijimayo, hhayi kusilungiselelo ocabanga ukuthi siyasebenza. Ifayela lesimo likhombisa amamaskhi amahlanu amandla kanye nefulegi ye-no-new-privileges, futhi aphendula imibuzo ehlukene:

grep -E '^(CapInh|CapPrm|CapEff|CapBnd|CapAmb|NoNewPrivs):' /proc/$(pidof openvpn)/status
sudo aa-status | grep -i openvpn

I-CapEff iyiqoqo elibalulekile ocingweni: amandla akhona ku-CapBnd kodwa engekho ku-CapEff avunyelwe umkhathi ophezulu futhi okwamanje awagcinwanga. I-CapAmb ibalulekile lapho i-binary ingenalo ilungelo ngomqondo ojwayelekile we-setuid, ngoba amandla ezungezile ayindlela isevisi egcina ngayo ilungelo ngale kwe-exec ngaphandle kwamandla efayela. I-CapInh igcina amabhithi angase azuzwe njengefa ngale kwe-exec, kodwa kuphela lapho iqoqo lefa lefayela elisetshenziswayo livuma, ngakho ibhithi lalapho lodwa alinikezi lutho.

Bese uqinisekisa ukuthi iyiphi iphrofayela exhunywe ngempela. Inqubo ingavinjelwa yigama lephrofayela obungalilindele, ikakhulukazi lapho ukusabalalisa kuletha i-unit yaso kanye nephrofayela yaso ndawonye, futhi ukufunda i-/proc/PID/attr/current kuxazulula lokho emugqeni owodwa. Ukuqhathanisa ifayela lakho elihleliwe nephrofayela ekubikwa yi-kernel yikho umehluko phakathi kokulungisa imbangela nokuhlela ifayela okungekho noyedwa oyilayishayo.

Faka umthetho wamandla kuphela lapho umkhondo wokucwaninga usho kanjalo

Amarekhodi e-kernel nawokucwaninga abeka igama lengqimba eyenqabile. Funa ukunqatshwa okuphethe umsebenzi othi capable kanye negama elithi sys_chroot, kanye nephrofayela eyikhiqizile. Uma lowo mrekhodi ukhona, inqubo yayivele inawo amandla futhi i-AppArmor yanqaba, futhi ushintsho oluqondile umthetho wamandla ngaphakathi kwephrofayela yangempela:

capability sys_chroot,

Ligcine liyisicucu kuphrofayela exhunywe ngempela, futhi uhlole igama elingukhiye encwadini yereferensi yephrofayela ye-apparmor.d esikhundleni sokukopisha umthetho kusifundo esingahlobene. Ukulifaka ku-include eyabiwayo kunikeza lelo lungelo yonke inhlelo evinjelwe elayisha lelo fayela, futhi ukushintshela iphrofayela kumodi ye-complain kufihla ukunqatshwa okulandelayo esikhundleni sokuxazulula lokhu. Umthetho waphrofayela ususa ukunqatshwa kwenqubomgomo; awudali ilungelo, ngakho inqubo engakaze ibe ne-CAP_SYS_CHROOT eqoqweni layo elisebenzayo izophinde yehluleke ngisho umthetho ukhona.

Uma irekhodi lokucwaninga lingakhombisi nhlobo ukunqatshwa kwe-AppArmor, yeka ukuhlela iphrofayela. Ubhekene nenkinga yobufakazi bokuqinisekisa, futhi umsebenzi osele usemfanekisweni we-unit noma kunqubo engumzali, hhayi olimini lwenqubomgomo.

Umphathi wesevisi ugcina umkhathi wakhe ophezulu

I-systemd ibeka iqoqo lomngcele wamandla kusevisi ngayinye, futhi ngokuzenzakalelayo lelo qoqo lincane. Noma yini ekhishiwe lapho ayitholakali enqubeni kungakhathaliseki ukuthi iphrofayela ithini, yikho amayunithi aqinisisiwe engase ehluleke emsebenzini owawusebenza lapho i-daemon iqalwa ngesandla. Imiyalelo efanele kulula ukuyifunda ku-unit futhi kulula ukuyikhohlwa lapho uhlelo lokusebenza ngokwalo lubika iphutha. Ama-drop-in akhishwa iphakethe lokusabalalisa ayiwona umthombo ojwayelekile womkhathi ophezulu okungekho muntu okhumbulayo ukuthi wawusilungisile.

Ukuphakamisa umkhathi ophezulu nokunikeza amandla kuyizinguquko ezimbili, hhayi eyodwa. Umbhalo eqoqweni lomngcele uthi inqubo ingagcina amandla; awawengezi eqoqweni elisebenzayo, futhi i-NoNewPrivs ingavimbela ukukhushulwa kwakamuva ukuba kuphumelele ngisho konke okunye kuhambisana. Faka kuphela lokho umsebenzi okudingayo, gcina okunye ukuqiniswa kunjalo, futhi umelane nendlela emfishane yokunikeza wonke amandla ukuze ucingo olulodwa lwedlule.

Ukulandelana kubalulekile nalapha. Shintsha umkhathi we-unit kuqala, qinisekisa ukuthi i-CapEff isinayo leyo bhithi, bese kuthi ngemva kwalokho unqume ukuthi i-AppArmor isanqaba yini. Ukwenza zombili izinguquko ngesikhathi esisodwa kukushiya ucabanga futhi uma ukuhluleka kuqhubeka.

Lapho ukunqatshwa sekuphelile, hlola ijele ngokwalo

I-chroot ephumelelayo ihambisa impande, ngakho yonke indlela i-daemon eyithintayo ngemva kwalokho ixazululwa ngaphakathi kwesihlahla esisha. Isilungiselelo esingekho, inodi yedivayisi engekho noma umkhombandlela wezitifiketi ongakopishwanga manje kuzovela njengephutha lefayela, futhi lelo phutha inkinga yokuhlelwa, hhayi yamandla. Funda umcimbi olandelayo esikhundleni sokwengeza enye imvume ebanzi. Ukuhambisa kushintsha futhi incazelo yendlela ehlobene, yikho imihlahlandlela yokuqinisa igcizelela izindlela eziphelele kusilungiselelo se-daemon.

Kuyasiza futhi ukukhumbula lokho i-chroot engakwenzi. Ingumngcele wendlela, hhayi i-sandbox: inqubo egcina ilungelo ingaphuma kuyo, yikho amandla ngokuvamile elahlelwa ngemva kocingo nokuthi kungani ukuvinjwa kufanele kuhlale kuzungeze i-daemon. Ukugcina ndawonye iphrofayela ye-AppArmor, iqoqo lomngcele wamandla kanye nemikhawulo yohlelo lwamafayela kuyinjongo yalo msebenzi wokuzilolonga, hhayi insalela okufanele isuswe lapho isevisi iqala.

Umthetho wesinqumo mfushane. Uma irekhodi lokucwaninga libiza i-AppArmor, faka umthetho owodwa wamandla kuphrofayela exhunyiwe. Uma iqoqo elisebenzayo lingenalutho, lungisa umkhathi we-unit nokulandelana kokulahla ilungelo. Uma iphrofayela kungeyona leyo oyihlelile, yeka ukuhlela bese uthola eyangempela.