Ikhonteyina ye-LXD ayikwazi ukuvula i-/dev/net/tun? Hlola umugqa we-unix-char

I-LXD iveza idivayisi yezinhlamvu yesihambisi ekhonteyinini ngokwengeza indawo yedivayisi, hhayi ngokufundisa isivakashi ukuthi yenze yona. Uma ikhonteyina ingenayo i-/dev/net/tun, idivayisi ingaba khona kusihambisi futhi isivakashi sehluleke ukuyivula. Umugqa we-unix-char uyingxenye yalolu hambo ohlangothini lombusi, futhi ngamabomu mncane kune khonteyina enegunya. Yingakho indawo yesihambisi nendawo yekhonteyina zifanele ukuhlolwa ngokwehlukana.

Indlela imfushane ngokwanele ukuba igcinwe emehlweni: i-LXD ixazulula indlela kusihambisi, yenza indawo ehambisanayo ngaphakathi kwesibonelo futhi yengeza idivayisi ku-cgroup yamadivayisi ekhonteyina. Ngemuva kwalokho inqubo yesivakashi idinga imvume yayo namandla ayo ukuze isebenzise indawo ngakunoma yini.

Yini umugqa we-unix-char ewushintshayo ngempela

Idivayisi ye-unix-char itshela i-LXD ukuthi iveze idivayisi eyodwa yezinhlamvu yesihambisi endleleni ekhethiwe ngaphakathi kwekhonteyina. Umugqa unezingxenye ezintathu ezibalulekile: ilebula yedivayisi esetshenziswa umbusi, indlela ye-source kusihambisi kanye ne-path ebonwa isivakashi. Kuphela ezimbili zokugcina ezichaza idivayisi uqobo. Iphutha lokuthayipha kwelinye lazo lenza indawo endaweni iklayenti engayivuli.

Kusihambisi idivayisi ngokuvamile iyi-/dev/net/tun. Ngaphakathi kwekhonteyina ungagcina indlela efanayo noma ukhethe enye, kodwa indlela kufanele ihambisane nalokho okulindelwe yiklayenti ye-VPN. Ukugcina i-/dev/net/tun kugwema inkinga yesibili yokuhlela, ngoba amaklayenti amaningi avula leyo ndlela ngaphandle kokubuza.

Umbusi usebenzisa umugqa lapho isibonelo siqala noma lapho idivayisi ixhunywa ishisa. Awukopishi isidluliseli esivakashini futhi awudali isixhumi somhubhe. Kwenza indawo ibonakale futhi kuvumele ukufinyelela ngeqembu lokulawula amadivayisi ekhonteyina.

Memeza idivayisi esibonelweni, hhayi ngaphakathi kwesivakashi

Engeza umugqa kusuka kumongo wokuphatha we-LXD, usho isibonelo nelebula ozokwazi ukuyibona kamuva. Kukhonteyina ebizwa nge-vpnbox, umyalo uthi:

lxc config device add vpnbox tun unix-char source=/dev/net/tun path=/dev/net/tun
lxc config device show vpnbox

Ilebula ye-tun yeyendawo kuhlelo lwesibonelo. Akulona igama lesixhumi futhi akudingeki ihambisane nanoma yini esivakashini. Uma iphrofayela isivele ihlinzeka ngedivayisi efanayo, ukwengeza umugqa wesibili kwenza ukungqubuzana hhayi ukweqile, ngakho qala ukuhlola ukuhlela okusebenzayo.

Ukuhlela amafayela ngaphakathi kwekhonteyina kuyizinga elingalungile. I-mknod kusikripthi sokuqala ingabonakala isebenza kukhonteyina enegunya, bese inyamalala ekudalweni kabusha noma yehluleke kwenye enegunya elincane. Isethi yamadivayisi yesibonelo iphethwe umbusi; ake neyendawo ibe ngaphansi kwakhe.

Fanisa ubunikazi nemodi nenqubo yesivakashi

Umugqa we-unix-char ungasebenzisa i-uid, i-gid ne-mode endaweni engaphakathi kwekhonteyina. Zisebenzise ukuze zihambisane ne-akhawunti eqhuba iklayenti ye-VPN, esikhundleni sokuvula idivayisi kubo bonke abasebenzisi noma ukushintsha ikhonteyina kwimodi enegunya.

Ukubonakala akufani nemvume. Indawo ephethwe i-root enemodi engu-600 ibonakala kusevisi esebenza njengomsebenzisi ongenalo igunya futhi noma kunjalo ayikwazi ukuyivula. Hlola i-akhawunti yesivakashi kuqala, bese ubeka ubunikazi kuleyo akhawunti, futhi ugcine imodi ingabanzi kunalokho iklayenti elikudingayo.

Inqubo futhi idinga ikhono lokuhlela isixhumi somhubhe, ngokuvamile i-CAP_NET_ADMIN endaweni yamagama yenethiwekhi yekhonteyina. Ukudlulisa idivayisi akunikezi lelo khono, futhi ukunikeza ikhono akuhlinzeki idivayisi; lezi yizimfuno ezizimele.

Yazi ukuthi umugqa awukunikezi ini

Indawo ebonakalayo akuyona i-VPN esebenzayo. Iphakethe leklayenti kusamele lifakwe, iphrofayela kusamele ivumeleke, futhi isevisi kusamele iqale. Ukuqinisekisa, imizila ne-DNS kuhlala kuwumsebenzi weklayenti, futhi ukwehluleka lapho akubona ubufakazi bokuthi umugqa wedivayisi awulungile.

I-systemd ingengeza omunye umkhawulo. Iyunithi ene-DeviceAllow noma inqubomgomo yamadivayisi eqinisiwe ingala ukufinyelela endaweni enikezwe umbusi wekhonteyina. Hlola inqubomgomo yamadivayisi yeyunithi lapho indawo ikhona kodwa isevisi ibika iphutha lemvume, futhi ushintshe leyo nqubomgomo esikhundleni sokwandisa ikhonteyina.

Ukuxhuma okushisayo kungokuzikhethela futhi kucacile. Umugqa one-required=false udinga indlela yomthombo futhi ungavela noma unyamalale njengoba idivayisi yesihambisi ishintsha. Lowo mjikelezo wokuphila ulingana nehardware engena futhi iphuma; kudivayisi ye-TUN edingwa yi-VPN ekuqaleni, umugqa wokuzikhethela ungashiya isevisi iqala ngaphambi kokuba isimo saso sikhona.

Qinisekisa ukubonakala, ukuvuleka nesixhumi ngalelo hlelo

Kuqala qinisekisa indawo engaphakathi kwekhonteyina ehlosiwe. Indlela, izinombolo ezinkulu nezincane kanye nobunikazi kufanele zihambisane nedivayisi yesihambisi nomugqa owengezile. Indawo engekho isho ukuthi umbusi akawusebenzisanga umugqa, noma uwusebenzise kwesinye isibonelo.

lxc exec vpnbox -- ls -l /dev/net/tun
lxc exec vpnbox -- sh -c 'test -c /dev/net/tun && echo char-device-ok'

Ngemuva kwalokho qinisekisa ukuthi i-akhawunti yesevisi iyavula. Ukuhlolwa okufushane njengaleya akhawunti kuhlukanisa inkinga yobunikazi nenkinga yesevisi. Ekugcineni, qala iklayenti futhi uqinisekise ukuthi isixhumi somhubhe siyavela; yisinyathelo sesithathu kuphela esifakazela lonke uhambo, ngoba ezimbili zokuqala zingaphumelela kuyilapho iphrofayela noma amandla eklayenti kusalungile.

Rekhoda isibonelo, ilebula yedivayisi, umthombo kusihambisi, indlela esivakashini ne-akhawunti engumnikazi lapho ushintsho lugunyazwa. Lawo manani amahlanu yiwo okufanele ukugcinwe ukudalwa kabusha, ukufuduka noma ukushintshwa kwephrofayela kamuva, futhi kulula kakhulu ukuwaqhathanisa kunephutha lemvume elingenamongo.