/dev/net/tun ayikho ngenkathi i-tun ilayishiwe: lungisa inodi yedivayisi

OpenVPN iyama ngokukhononda kwe-errno 2 mayelana ne- /dev/net/tun kuyilapho lsmod ibala imojuli ye-tun ngokukhululeka. Womabili amaqiniso ayiqiniso ngasikhathi sinye. Imojuli inikeza umshayeli, futhi indlela umklami ayivulayo iyindawo yenodi yedivayisi okufanele yenziwe okunye. Ukuziphatha njengento eyodwa yikho okwenza ukulungisa okusobala kokulayisha imojuli kabusha kungashintshi lutho.

Izinto ezimbili, abanikazi ababili abehlukene

Imoduli ye-kernel nenodi yedivayisi yizinto ezizimele ezinemijikelezo yempilo ezimele. Ukulayisha imojuli kubhalisa umshayeli, futhi kusistimu ene-devtmpfs i-kernel icela ukuthi inodi ehambisanayo yenziwe. Kusistimu engenayo i-devtmpfs akukho okwenza lutho, futhi umshayeli uhlala lapho ngaphandle kwanoma iyiphi indlela ekhomba kuwo. Imojuli ingaba ilayishiwe, iphilile futhi ingafinyeleleki ngokuphelele ngohlelo lwamafayela ngasikhathi sinye.

Yingakho umbhalo wephutha nohlu lwamajuli kungaphikisani. Umklami uvula indlela, indlela ayikho, futhi i-kernel ibuyisela i-ENOENT ngaphambi kokuba umshayeli we-tun abuzwe. Ukulayisha imojuli kabusha akukwazi ukulungisa indlela engekho, futhi ukwakha indlela akukwazi ukulungisa umshayeli ongekho.

lsmod | grep -w tun
stat -c "%F %t:%T" /dev/net/tun
grep " /dev " /proc/mounts

i-devtmpfs ngokumelene ne-mknod ecacile

Ngokuvamile izindlela ezimbili zakha leyondawo, futhi ukwazi ukuthi iyiphi okufanele ibe nomthwalo kukutshela okumele ukulungise. I-devtmpfs ivumela i-kernel ukuthi yakhe amanodi edivayisi kusibonelo esigxumisiwe, futhi i-udev isebenzisa ubunikazi nezimvume phezu kwawo. I- mknod ecacile iyindlela yesandla yezithombe nezikhala zamagama lapho kungekho khona okusebenzayo ngesikhathi sokuqalisa.

Qhathanisa imiphumela hhayi izinhloso. Uma i-devtmpfs igxumisiwe ku- /dev futhi inodi ingekho, umshayeli akusiwo lowo ocabangayo, noma kukhona okususe inodi ngemva kokuqalisa. Uma i- /dev iyisikhombisi esijwayelekile ngaphakathi kwe-rootfs evuliwe, ayikho indlela ezenzakalelayo futhi lowo owakha isithombe kufanele akhe inodi.

stat -c "%F major=%t minor=%T" /dev/net/tun
# expect: character special file major=a minor=c8

Lapho kungekho ndlela isebenzayo, inodi kufanele yenziwe ngesandla, futhi ukulandelana kubalulekile. Qala ngokwakha isikhombisi somzali, ngoba i- mknod ayikwazi ukuyicabanga, bese kuba idivayisi yezinhlamvu, bese kuba imodi eshiya kuphela i-root ikwazi ukubhala. Layisha imojuli kabusha ngaphambi kokwakha inodi, futhi susa indlela ekhona kuphela ngemva kokuba i- ls ikhombisile ukuthi iyisikhombisi hhayi idivayisi.

sudo modprobe tun
sudo mkdir -p /dev/net
sudo mknod /dev/net/tun c 10 200
sudo chmod 600 /dev/net/tun
ls -l /dev/net/tun

Isihlukanisi esisheshayo inhlobo evezwa yi- stat , futhi isikhombisi kuleyondlela yikho okumangaza kakhulu ezithombeni ezincane. I- mkdir ebhalwe ngenhliziyo enhle ku-Dockerfile ishiya kanye lokho, futhi akukho nani lokulayisha amajuli elingashintsha isikhombisi ngedivayisi yezinhlamvu. I-Major 10 ne-minor 200 iyipheya ebhalisiwe ye-tun, evezwa nge-hexadecimal njengo-a no-c8.

Izimpawu ezine, izizathu ezine

Izizathu ezine zichaza cishe zonke izimo, futhi ngasinye sishiya uphawu oluhlukile kumarekhodi. Qala endaweni yokuqalisa. Izithombe ezingenayo idiski, amabhodi afakiwe nezigaba ze-initramfs ngokuvamile azigxumisi i-devtmpfs noma i- /develawulwa yi-udev, ngakho akukho nqubo ebhala inodi. Bese ufunda izinketho zokugxumisa zalokho okusingatha i- /dev, ngoba i- nodev ivumela indlela ukuthi ibekhona kodwa iyale ukukuvula, futhi ukugxumisa kwe-bind okuthathwe kumsingathi oqinisiwe kuthwala leli fulegi ngaphandle kokuzimemezela. Ukugxumisa kokufunda kuphela kwehluleka kusenesikhathi nangomsindo omkhulu: i- mknod ibuyisela i-EROFS lapho, kuyilapho i-EPERM isho ukuthi inqubo ayinamandla, hhayi ukuthi uhlelo lwamafayela luzivikela. Ekugcineni, i-runtime yamakhontheyna ene- /dev tmpfs yayo kufanele inodi ifakwe esikhaleni sayo samagama, futhi i-cgroup yayo yedivayisi kufanele ivumele ipheya le-major ne-minor.

Hlola isendlalelo senqubomgomo ngaphambi kokushintsha izimvume futhi. I-SELinux ne-AppArmor zingala ukuvula okuvunyelwa yizici zefayela zonke, futhi lokho kwala kuvela kumarekhodi okuhlola hhayi ekuphumeni komklami. Ukushintsha kwezimvume okungaveli nakancane ekwaleni kuyisikhathi esichithwe esendlalelweni esingalungile neze.

sudo journalctl -k -n 20 --no-pager
sudo ausearch -m AVC -ts recent | tail -5

Kufakazela ngesixhumi, hhayi ngohlu

Uhlu oluyimpumelelo lufakazela ukuthi indlela ikhona futhi akukho okunye. Vula inodi ye-tun ephilile ukuze ifundwe, futhi ucingo lubuya nephutha, ngoba idivayisi ayinayo incazelo yokufunda futhi ayiyona ifayela elijwayelekile. Lelo phutha liyisiginali yempumelelo lapha, futhi ukulibona kukuvimbela ekulandeleni njengephutha.

head -c 1 /dev/net/tun
head: error reading '/dev/net/tun': File descriptor in bad state

Isivivinyo esinqumayo sakha isixhumi, ngoba sihlola umshayeli, inodi namalungelo akho esitebhisini esisodwa. Uma ukwengezwa kuphumelela futhi isixhumanisi sivele, womathathu bayasebenza. Uma kwehluleka, i-errno ihlukanisa izizathu: i-ENOENT isho ukuthi ayikho inodi esebenzisekayo, i-EPERM ikhomba emandleni, kumafulegi okugxumisa noma kunqubomgomo, futhi i-EBUSI isho ukuthi enye inqubo isivele ingumnikazi wesixhumi.

sudo ip tuntap add dev tun7 mode tun
ip -brief link show tun7
sudo ip tuntap del dev tun7 mode tun

Gijima lesosivivinyo esimweni esihluleka ngempela, ngoba iyunithi yensiza, ikhontheyna noma umsebenzi ohleliwe kungase kuthwale iqoqo lamandla elihlukile kunegobolondo lakho lokungena. Isivivinyo esiphumelela esimweni esingalungile asifakazeli lutho ngalokho okwehlulekayo.

Lapho idivayisi ingeyona inkinga

Uma isivivinyo sesixhumi siphumelela futhi umklami usahluleka, inkinga esele iphrofayela, isimo sensiza noma umzila, futhi idivayisi ilungile. Leso yisikhathi sokuyeka ukuhlela amanodi edivayisi, ngoba ezinye izinguquko zandisa kuphela ibanga kusistimu esebenzayo.

Gijima lezo zivivinyo ezinhlanu ezifanayo ngaso sonke isikhathi esikhundleni sokwakha entsha: imojuli ilayishiwe ngaphandle kwemojuli eyimbangi, indlela iyidivayisi yezinhlamvu ene-major ne-minor efanele, izinketho zokugxumisa zihlanzekile, isimo senqubo sithwala amandla, futhi kukhona ukwaliwa kwenqubomgomo esikhathini sokwehluleka. Iphutha eliphila kuzo zinhlanu akuyona inkinga yedivayisi, noma ngabe umyalezo usho ini.