Ilogi iyakhula kodwa ayinakwenziwa kabusha: hlola i-ACL yefolda
Ukufaka efayeleni akudingi igama elisha kufolda yalo; ukudala kudinga. Qhathanisa i-ACL yokufinyelela namagugu okuzenzakalelayo azuzwe ngaphambi kokwandisa noma yini.
Ilogi eqhubeka nokukhula iyeka ukukhula ngomzuzu lapho okuthile kuyidala kabusha, futhi iphutha lithi imvume inqatshiwe. Isiphetho esihehayo ukuthi ifayela lelogi ngokwalo lidinga izimvume ezengeziwe, kodwa ifayela lingase libe selibhaliwe yi-akhawunti efanayo. Ukufaka egameni elikhona nokudala igama elisha kuyizivivinyo ezimbili ezihlukene, futhi eyesibili kuphela ebuza ifolda.
Ukufaka nokudala kuyizivivinyo ezihlukene
Ukuvula ifayela elikhona ukuze kufakwe kudinga imvume yokubhala kulelo fayela kanye nemvume yokusesha kuyo yonke ifolda esemzileni walo. Ukudala ifayela kudinga ukubhala nokusesha kufolda eliqukethe, ngoba umsebenzi wengeza igama kuyo. Ukushintsha ifayela ngokuqamba kabusha kuthinta zombili izifolda kanye nemithetho yazo ye-sticky bit.
| Operation | What must permit it | Typical failure message |
|---|---|---|
| Append to an existing log | File write access, path traversal | Permission denied on the file |
| Create a missing log | Directory write and search access | Permission denied on the path |
| Rename a replacement into place | Both directories, plus sticky restrictions | Permission denied or operation not permitted |
Isichazi esivele sivuliwe sengeza icala lesine. Inqubo ingabamba isibambo sokubhala esavulwa ngaphambi kokuyeka amalungelo futhi isehluleke ukuvula kabusha umzila ofanayo ngaphansi kobunikazi bayo bakamuva. Ukufaka okuphumelelayo nokudala okuhlulekile kungaba yiqiniso kokubili, ngasikhathi sinye, enqubweni eyodwa.
Ama-ACL okuzenzakalelayo ayazuzwa, awanikezi
Umugqa oqala ngesiqalo sokuzenzakalelayo uchaza lokho izinto ezintsha ezikuzuzayo kufolda. Awunikezi lutho kufolda ngokwayo, futhi awulungisi i-ACL yefayela eselivele likhona.
namei -l /var/log/openvpn/server.log
getfacl -p /var/log/openvpn
getfacl -p /var/log/openvpn/server.logFunda imigqa yokufinyelela ngokwehlukana neyokuzenzakalelayo, futhi funda imaskhi. Umugqa onegama obala amalungelo aphelele usengancishiswa imaskhi, yingakho umbono osebenzayo ubalulekile kunohlamvu lomugqa wokuqala.
Sebenzisa umzila oxazululiwe esikhundleni somzila osemisebenzini. Isixhumanisi somfanekiso, iphuzu lokuxhoma noma ifolda ephenduliwe kungabeka ifayela langempela endaweni lapho imvume oyinikezile ingafinyeleli khona. Hamba umzila ngethuluzi lamagama kuqala, bese uqhathanisa izinga ngalinye ne-akhawunti okukhulunywa ngayo. Ukuqagela ifolda esezingeni eliphezulu yiyo indlela isilungiso esihlala ngayo izinga elilodwa phezulu kakhulu.
Khomba ukuthi ubani obhalayo ngaleso sikhathi
Hlola iyunithi yesevisi, ama-drop-in ayo kanye nezilungiselelo ze-akhawunti zedaemon ngokwayo ngaphambi kokushintsha noma yini. Inqubo efakayo kanye nenqubo edala kabusha kungahluka: umsizi wokuphendula, umbhali wesimo kanye nomfundi wewebhu akuvamisile ukwabelana ngobunikazi.
Ukuhlolwa okugijinywe kusuka ku-shell ye-root akukhiqizi kabusha isevisi ekhawulelwe, futhi kuzophumelela ngenkathi isevisi iqhubeka nokuhluleka. Khiqiza kabusha umsebenzi ohlulekile ngaphansi kweyunithi efanayo, nge-akhawunti efanayo kanye nezilungiselelo zesandbox ezifanayo. Uma ungakwazi, qala iyunithi nge-shell yesikhashana futhi uhlole ubunikazi obukubikayo. Noma yini enye ikala itheminali yakho, hhayi isevisi.
Uma ukudala kudingeka ngempela, nika umbhali imvume yokufinyelela ifolda yelogi ezinikezelwe futhi ugcine imvume yokufunda yabasebenzisi ihlukene. Ukwenza i-akhawunti eyabiwe noma isihlahla sonke sohlelo sibhaleke ukuze kwenelise ukubiza kwelogi elilodwa kushintsha inkinga encane ngenkulu.
Phendula ngaphandle kokuyibuyisela
Odala ifayela kabusha unquma umnikazi nendlela yalo yomjikelezo olandelayo, ngakho hlela isilungiso ngokuhambisana nokucushwa kokuphendula. Okushintshile okudalwe ngaphansi kwe-akhawunti enye, noma nge-ACL entsha, kubuyisela ukwehluleka ngemva kwesilungiso esiphumelelayo.
Setha indlela neqembu ngesikhathi sokudala, hhayi ngemva, futhi qinisekisa ukuphenduka okulandelayo esikhundleni sokufaka okulandelayo. Ukufaka kuphinda kuphela ukuhlolwa osekuvele kwadlula. Uma ithuluzi lokuphendula linikeza isilungiselelo sendlela yokudala, sebenzisa leso esikhundleni se-chmod ngemva kokudala. Igebe phakathi kokudala ne-chmod yiso leso sikhathi lapho ukubhala okulandelayo kungahluleka khona.
Uma ukusika kusahluleka, yeka ukwengeza izimvume
Ukwehluleka ukusika ifayela ongabhala kulo akuchazwa izimvume zefolda, futhi ukwengeza ezinye ngeke kusize. Kunalokho bheka izimfanelo nokuvinjelwa: imfanelo ye-append-only ivumela ukubhala kuphela endleleni yokufaka, futhi ukuxhoma kokufunda kuphela noma isandbox yesevisi kungala umsebenzi ovunyelwe yi-ACL.
Hlola imikhawulo yohlelo lwamafayela lweyunithi kanye nezinketho zokuxhoma zomzila, bese ukhiqiza kabusha umsebenzi oqondile ohlulekile. Ukwandisa imvume engakaze ibuzwe kufihla kuphela ukuthi yimuphi umkhawulo owawungokoqobo. Susa umkhawulo owodwa ngesikhathi kuyunithi elahlwayo, futhi uwubuyisele ngaphambi kokushintsha noma yini engunaphakade.