Indlela yokuthola ukuthi iyiphi i-systemd sandbox eyenqaba i-hook yakho ye-OpenVPN

I-hook iyasebenza uma uyisebenzisa ngesandla njenge-root futhi ibuyisela Operation not permitted ngesikhathi isevisi iyiqalayo. Ifayela alizange lishintshe phakathi kwaleyo misebenzi; imvelo yashintsha. i-systemd inikeza inqubo umhlaba omncane: amandla amancane, /dev ehlukile, izindlela zefayela lesistimu zokufunda kuphela kanye nophahla lwemisebenzi. Funda ukwehluleka njengomngcele owenqabe umsebenzi othile, hhayi njenge-script ephukile.

Qala emsebenzini owenqatshiwe

Umugqa we-log othi i-unit yehlulekile awukutsheli cishe lutho. Umugqa owusizo ubiza ukubiza okwenqatshiwe: i-node yedivaysi engavulekanga, idayirekhithri okungabhalwanga kuyo, i-namespace engadalwanga. Thola lokho kubiza ngaphambi kokuthinta ngisho isiqondiso esisodwa, ngoba ngasinye sihambisana nomkhawulo ohlukile. Bese ufunda i-unit eyasebenza ngempela, kuhlanganise nama-drop-in, esikhundleni sefayela elathunyelwa iphakethe.

Umbuzo ongezansi uphrinta indlela ye-fragment, iziqondiso ze-drop-in kanye nezakhiwo ezibalulekile ekwenqatshweni kwedivaysi noma kwefayela lesistimu. Zifunde zonke ngaphambi kokunquma ukuthi umuphi umngcele ofanele:

systemctl show "[email protected]" -p FragmentPath -p DropInPaths -p PrivateDevices -p DevicePolicy -p DeviceAllow -p ProtectHome -p ProtectSystem -p TasksMax
journalctl -u "[email protected]" -b --no-pager | grep -iE 'operation not permitted|permission denied|cannot open|failed'

Akukho lutho kulelo qoqo olubhalayo. Uma ukubiza okwenqatshiwe kungekho kujenali, phakamisa izinga lemininingwane ye-client emsebenzini owodwa esikhundleni sokuqagela iziqondiso. Inqubo esebenzayo ikhombisa ukuthi i-unit yaqala, hhayi ukuthi i-hook yasebenza ngamalungelo ewendiludingayo.

I-namespace idinga amalungelo e-mount i-TUN device engakaze iwasebenzise

Imisebenzi emibili ebukeka ifana ngaphakathi kwe-hook eyodwa inamaphrofayili ahlukile emvume. Ukuvula /dev/net/tun nokudala i-interface kudinga ukuphathwa kwenethiwekhi kanye nokufinyelela kuleyo node. Ukudala i-namespace yenethiwekhi enegama nakho kudinga umsebenzi ohlobene ne-mount, ngoba ithuluzi le-namespace li-mounta /sys umbono omusha futhi libophela idayirekhithri lesimo endaweni yalo. i-unit ye-client ephezulu ngamabomu ishiya ukuphathwa kwe-mount ngaphandle kwesethi yayo yomkhawulo, ngakho isigaba se-namespace siyenqatshwa kuyilapho i-tunnel uqobo yayizosebenza.

Yingakho ukunikeza i-node yedivaysi kungasindisi i-script. Imvume yedivaysi iphendula umbuzo owodwa, ukuthi le nqubo ingavula le node, futhi umbuzo we-namespace uhlukile. Hlanganisa ukubiza okwehlulekayo namandla ayo ngaphambi kokunweba noma yini.

Ukuhlolwa ku-shell yakho kuthola wonke amandla anayo i-root engavinjelwe, futhi i-unit ithola lokho okugcinwe isethi yayo yomkhawulo. Le misebenzi emibili iyizivivinyo ezihlukile ngisho noma i-binary iyafana.

Amadivaysi, izindlela ezivikelwe kanye nophahla lwemisebenzi

Uma umsebenzi owenqatshiwe waziwa, amaqembu amathathu emiyalelo achaza iningi lokwehluleka. Ukufinyelela kwedivaysi kulawulwa PrivateDevices, eshintsha /dev ngesethi encane yamadivaysi mbumbulu, futhi nge- DevicePolicy ne- DeviceAllow, ezinquma lokho i-cgroup ekugunyazayo. /dev/net/tun akuyona ingxenye yalelo sethi elincane, ngakho i-unit ene- PrivateDevices=yes ayikwazi ukuyivula noma ngabe umgomo wedivaysi uthini.

Ukuvikelwa kwefayela lesistimu kuphendula umbuzo wesibili. ProtectHome=yes kwenza /home, /root ne- /run/user kungafinyeleleki, futhi ProtectSystem=full kwenza /usr, /boot ne- /etc kufundwe kuphela. Ngakho i-hook ebhala eceleni kwefayela layo lokucwangciswa iyasebenza ku-shell yakho futhi yehluleke ngaphansi kwe-unit, ngendlela efanayo yemvume njengamandla angekho. Hambisa okokufaka okubhalekayo endleleni umgomo oyigunyazayo, noma engeza ReadWritePaths= umhla omncane.

Imikhawulo yezinsiza iyiqembu lesithathu, futhi engacaci kakhulu. TasksMax= ikhawulela ukuthi i-unit ingakha imisebenzi emingaki, futhi uphahla lwedeskriptha yefayela lusebenza ngendlela efanayo kuma-socket namahandle. Ukusatshalaliswa okwedlula uphahla kwehluleka ngephutha lezinsiza hhayi iphutha lemvume, yingakho umlayezo oqondile usabalulekile.

Hambisa isigaba se-namespace ngaphandle kwe-hook

Ukulungiselela okudinga ilungelo i-client okungafanele ibe nalo kungokwe-unit yayo. I-oneshot esebenza ngaphambi kwe-client, egcina umphumela wayo futhi ehlelwe ngaphambi kokuxhuma, inikeza isigaba se-namespace lokho esikudingayo ngaphandle kokunikeza lawo malungelo kunqubo ye-tunnel. I-client bese ibhekisela kuleyo unit esikhundleni sokushayela i-script kusukela ku-up hook yayo.

Isifanekiso esingezansi siwukuma kokuqala, hhayi into esetshenziswa ngaphandle kokufundwa. Sigcina ukulungiselela lapho ilungelo lihlala khona futhi sishiya i-unit ye-tunnel ingathintwanga:

# /etc/systemd/system/[email protected]
[Unit]
Description=Namespace preparation for %i
Before=openvpn-client@%i.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/netns-up.sh %i
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
[Install]
WantedBy=multi-user.target

Engeza ukuhlela nge-drop-in esikhundleni sokuhlela i-unit ephakethiwe, ukuze ukuthuthukisa kungalahli ushintsho lwakho buthule. Indawo yamafayela iboshelwe egameni le-instance, ngakho iphrofayili yesibili idinga ifayela layo:

sudo mkdir -p /etc/systemd/system/[email protected]
sudo tee /etc/systemd/system/[email protected]/10-namespace.conf >/dev/null <<'CONF'
[Unit]
[email protected]
[email protected]
CONF
sudo systemctl daemon-reload

Phinda ukubiza okufanayo ngemuva koshintsho

Ukulungiswa kuqinisekiswa kuphela lapho ukubiza okufanayo kukhiqiza umphumela ohlukile. Qala kabusha womabili ama-unit, sebenzisa umsebenzi owehlulekile, futhi uqhathanise umphumela wawo nomugqa wejenali owugcine ngaphambi koshintsho. I-unit eqala kuyilapho i-hook ingasasebenzi futhi akuwona ukulungiswa.

Ukulandelana okungezansi kugcina ukuqhathanisa kuthembekile, ngoba kuhlola ukubiza okwenqatshiwe hhayi umbala we-unit. Gcina okukhishiwe kwayo eceleni komugqa wejenali okuwuthwebule ngaphambi koshintsho:

sudo systemctl restart "[email protected]" "[email protected]"
systemctl status "[email protected]" --no-pager
journalctl -u "[email protected]" -b --no-pager | grep -c 'Operation not permitted'
ip -brief addr show tun0

Bala ukwenqatshwa esikhundleni sokufunda umugqa wokugcina, ngoba i-hook ingehluleka, iphinde izame futhi iphumelele, futhi inombolo kuphela ekhombisa ukuthi umngcele usuthuthukile. Shiya umbono ku-drop-in obiza isiqondiso osikhululile kanye nesizathu, ngoba ukuthuthukisa okulandelayo kuqhathanisa ukucwangciswa kwakho nokumisiwe okuphakethiwe. I-unit eqala kuphela uma zonke izivikelo zivaliwe ayikalungiswa.