Nika i-OpenVPN i-CAP_NET_ADMIN ngaphandle kokuyinika i-root

Isevisi iyaqala, ilogi ikhononda ngokuthi ayikwazi ukuvula idivayisi ye-tun, futhi imizila ayikaze ivele. Sebenzisa capsh --print kushel yakho futhi cap_net_admin ikhona lapho, okwenza ukwehluleka kubonakale kungenakwenzeka. Okwehlukile phakathi kweshel yakho neyunithi ukudlula kwamalungelo, hhayi ukuzimisela kwe-kernel ukunikeza ikhono. Dlula ekuhloleni okune ngezansi ngokulandelana futhi ume kokokuqala okuchaza igebe.

Hlukanisa ikhono elingekho nedivayisi efihliwe

Ukwehluleka okubili kubonakala kufana kumugqa welogi. Inqubo engenayo i-CAP_NET_ADMIN ayikwazi ukwakha noma ukumisa isixhumi se-tunnel, futhi inqubo esihlabathi sayo sifihla i-/dev/net/tun ayikwazi ukuyivula nhlobo. Ukwengeza amakhono ngeke kulungise icala lesibili.

Hlola ukuthi idivayisi ikhona yini ngaphakathi kwendawo yamagama yesevisi ngaphambi kokuhlela noma yini. I-PrivateDevices=yes iwumugqa wokuqinisa ojwayelekile osusa ngokuphelele inodi ye-tun, futhi i-ProtectSystem evimbayo ingenza indlela yokumisa ibe yokufunda kuphela ngendlela efundeka njengephutha lemvume. Kokubili kukhiqiza imigqa yelogi ekhuluma nge-tunnel, yingakho amakhono ehlangwa nalo. Qinisekisa kuqala ukuthi inodi ikhona futhi iyavuleka, bese uqhubeka.

Yazi ukuthi yisiphi isethi samakhono osibhekile

I-Linux igcina amasethi avunyelwe, asebenzayo, azuzwayo, avimbayo kanye awendawo, futhi isethi yendawo yiyo ephuma phambili ngemva kwe-exec yomsebenzisi ongelona i-root. Amakhono efayela ku-binary angadlulisa amalungelo avunyelwe nasebenzayo ngesikhathi se-exec, kodwa kuphela uma kungekho lutho kuketanga oluvimbayo lokho kudluliswa.

Yilapho i-sudo idukisa khona abantu. Umyalo oqaliswa nge-sudo -u uqala ukudlula okusha kwamalungelo futhi isethi yendawo iyanyamalala, ngakho ukuhlola okufanayo okuphumelelayo njenge-root kuyahluleka lapho. Umphathi wesevisi ungenye futhi indlela yokudlula, futhi akanikezi lutho lwendawo ngaphandle uma iyunithi isho kanjalo.

Nikeza ikhono kuyunithi, hhayi kusembozo

Isigaba sesevisi esincane se-tunnel edinga ukwakha idivayisi nokufaka imizila sibukeka kanje.

[Unit]
Description=OpenVPN client, office profile
After=network-online.target

[Service]
Type=notify
User=openvpn
Group=openvpn
NoNewPrivileges=yes
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/office.conf

I-AmbientCapabilities ibeka ilungelo kusethi yendawo ngaphambi kokuthi inqubo iqale, futhi i-CapabilityBoundingSet ivimbela inqubo ukuthi ingabambi lutho ngaphandle kwalolo hlu. I-NoNewPrivileges=yes ivimbela ukuthola amalungelo nge-setuid noma amakhono efayela, kuyilapho ikhono elinikezwa ngokusobala yiyunithi lisaqhubeka lisebenza. Engeza i-CAP_NET_BIND_SERVICE kuphela uma isevisi kufanele ibophe imbobo ephansi, futhi ungalokothi wengeze i-CAP_SYS_ADMIN ngenxa nje yokuthi umucu weforum wenze kanjalo.

Uma iyunithi isonga i-binary ku-sudo, susa isembozo. I-systemd isivele isebenzisa i-User=, futhi lolo ungqimba olwengeziwe yisizathu esikwenzeka kakhulu sokuthi isethi yendawo ingenalutho.

Qinisekisa ngokuqhathanisa nenqubo ephilayo, hhayi ngefayela leyunithi

Funda ukuthi umphathi usebenzise ini ngempela, bese ufunda inqubo ayizalele.

unit=openvpn-client@office
systemctl show -p User -p AmbientCapabilities "$unit"
systemctl show -p MainPID --value "$unit" | xargs -r getpcaps
grep -E '^Cap(Eff|Amb)' /proc/$(systemctl show -p MainPID --value "$unit")/status

Uma iyunithi ibala ikhono futhi i-CapEff ingakabi nalo, i-drop-in ethile yeqa isilungiselelo noma isinyathelo se-ExecStartPre sishintsha indawo. Sesha igama leyunithi kumafolda e-drop-in ngaphambi kokuthatha ukuthi ifayela eliyinhloko linegunya, ngoba ifayela eliza kamuva liyawina buthule. Uma iyunithi nenqubo zombili zikhombisa ikhono futhi i-tunnel isehluleka, buyela ekuhloleni kwedivayisi nendlela esikhundleni sokwandisa isethi evimbayo. Ukusandisa kwaso kufihla imbangela yangempela futhi kushiya isevisi inamalungelo amaningi kunakuqala.

Khetha ukushiya amalungelo ngemva kokuqala

OpenVPN ingaqala inamalungelo bese yehla iye ku-akhawunti engenawo amalungelo ngokusebenzisa izinketho zayo i-user ne-group, kanti i-persist-key ne-persist-tun zigcina i-tunnel isebenzeka ngemva kwalokho. Lokho kuhlelo kunciphisa iwindi inqubo enegunya kulo, futhi ngokuvamile kufaneleka kakhulu kunokuqalisa yonke i-daemon ingenamalungelo ngamakhono ahlala njalo.

Noma yimuphi umodeli oyikhethayo, qalisa kabusha iyunithi futhi uphindise ukuhlola ngemva kokuqalisa kabusha, ngoba isevisi esebenza isuka kushel ye-root ehlanganayo kodwa ehluleka ekuqaleni ngokuvamile iwumehluko wamakhono, wedivayisi noma wemvume yefayela. Bhala izilungiselelo zeyunithi eceleni kokuphuma kwamakhono kwenqubo ukuze umhloli olandelayo abone ukuthi ukubuyekezwa kwephakethe noma i-drop-in kususile umngcele yini.