Kungani ukuhambisa isitifiketi se-VPN kuphula ilebula yaso ye-SELinux

Amatifiketi angaba kusikhombisi-mbhalo esifanele ngemodi efundekayo nobunikazi be-root, futhi insizakalo isengabika ukuthi ayikwazi ukuvula ifayela. Kusistimu ye-SELinux leyo nhlanganisela ikhomba emshinini othile, hhayi emalungelweni. Ilebula yahamba nefayela, ngoba ukuqamba kabusha akudali into entsha. I-inode yagcina umongo wokuphepha eyayinawo endleleni endala, futhi inqubomgomo yendlela entsha ayizange ithole ithuba lokwabela eyayo.

Ukuqamba kabusha kwenzani ngempela elebuleni

Ifayela lithwala umongo walo we-SELinux njengedatha yesici exhunywe ku-inode. Ukuqamba kabusha ngaphakathi kwesistimu yefayela eyodwa kushintsha ingeno yesikhombisi-mbhalo futhi akukho okunye, lokhu kuyashesha futhi kuyi-athomu, futhi yisizathu sokuthi umongo uhlale ukhona ngemva kokuhanjiswa. Akukho nqubomgomo ebuzwayo, akukho okuzenzakalelayo okusetshenziswayo, futhi akukho saxwayo esiphrintwayo.

Ukukopisha kuziphatha ngendlela ehlukile. Ikhophi idala i-inode entsha kusikhombisi-mbhalo okuyiwa kuso, futhi inqubomgomo yabela umongo ngohlobo lwalowo sikhombisi-mbhalo, ngakho isitifiketi esikotshiwe sivame ukugcina ilebula efanele kanti esihanjisiwe sihlala singalungile. Yilo mehluko owodwa ochaza ingxenye enkulu yokudideka kulolu hlobo lwethikithi.

Ukuhambisa phakathi kwezistimu zefayela kubuyela emuva emqondweni wokukopisha, ngakho umyalo ofanayo ungaziphatha ngendlela ehlukile emishinini emibili kuye ngokuthi i-/etc ihlezi kuvolumu yayo yini. Hlola lokho ngaphambi kokuphetha ngokuthi ithuluzi alithembekile. Ukubuka kanye kuthebula le-mount kukutshela ukuthi wenza uhlobo luni lokuhambisa.

Funda ilebula yamanje uma iqhathaniswa neyokulindelekile

Imiyalo emithathu yokufunda kuphela iphendula umbuzo ngaphandle kokushintsha lutho. Eyokuqala ikhombisa ukuthi ifayela linakho manje, eyesibili ibika ukuthi inqubomgomo ilindele ini kuleyo ndlela ngqo, eyesithathu ibala wonke amafayela ngaphansi kwesikhombisi-mbhalo ilebula yawo ehlukile.

ls -lZ /etc/openvpn/client/office-ca.crt
matchpathcon /etc/openvpn/client/office-ca.crt
restorecon -Rn -v /etc/openvpn/client

Okufanele kuthenjwe ukugijima okomile, ngoba kubalula wonke amafayela umongo wawo ophambuka kunqubomgomo futhi kushiye isistimu ingathintekile. Uma isitifiketi sivele kulolo hlu, uthole ukungafani phakathi kwalokho okushiwo yindlela nalokho okushiwo yifayela. Uma singaveli, ilebula isivele iyilokho inqubomgomo ekufunayo, futhi isikhathi sakho singesinye isikhathi.

Bese uhlobanisa umehluko nokwenqatshwa kwangempela. Ukungafani kuwubufakazi belebula engalungile, hhayi ubufakazi bokuthi insizakalo yehlulekile ngenxa yayo, futhi isilungiso esisetshenziswe ngaphandle kokwenqatshwa okuhambisanayo kurekhodi inguqulo enezinyathelo ezengeziwe.

Buyisela ukumephu esikhundleni sokwakha okuhlukile

Endaweni evamile inqubomgomo isivele imephula indlela, ngakho i-restorecon iyisebenzisa futhi umsebenzi uphelile. Gcina ububanzi kusikhombisi-mbhalo osilungisayo; ukulebula kabusha yonke isistimu yefayela kuyephuza, kuyaphazamisa, futhi kufihla iphutha lokuqala ngaphansi koshintsho olukhulu kakhulu.

Kusikhombisi-mbhalo esiqondisiwe ukulandelana kubalulekile, futhi ukukuhlanekezela kuveza umyalo obika impumelelo ngaphandle kokushintsha lutho. Ukumephu kungokwenqubomgomo, ukulebula kabusha kungokwaphetha, futhi ukugijima okomile kungokwangaphambi kwakho kokubili. Ukweqa leyo ngxenye yokugcina yindlela indlela engakaze ibe ngalungile esagcinwa ngayo ilebula kabusha.

semanage fcontext -a -t openvpn_etc_t '/etc/openvpn/custom(/.*)?'
restorecon -Rv /etc/openvpn/custom

I-restorecon isebenzisa ukumephu; ayikwazi ukwakha okukodwa. Uma kungekho mthetho ochaza indlela, akukho okungabuyiselwa, yingakho ukumephu okuhlala njalo kufanele kube khona ngaphambi kokulebula kabusha. Bhala ukuthi iyiphi ikhophi yokuhlela ephethe lokho kumephu, ngoba uma kungenjalo ukuhambisa kamuva, ukubuyekeza iphakethe noma ukulebula kabusha kudala iphutha futhi umuntu olandelayo uqala kusifro.

Kungani i-chcon ingesona isixazululo

I-chcon ibhala umongo ngqo efayelini. Isebenza ngokushesha futhi iyisinqumo esingahlali isikhathi eside kunazo zonke ezikhona, ngoba ukulebula kabusha kwesistimu yefayela kusebenzisa inqubomgomo futhi kulahla izinguquko zemanuwali ngaphandle kokubuza. Ifayela libonakala lilungisiwe futhi isilungiso sinosuku lokuphelelwa umuntu ongakaze asibhale. Lokho okufunayo esikhundleni salokho umthetho ochaza indlela, ukuze wonke amafayela afika lapho athole ukwelashwa okufanayo ngokuzenzakalela.

Okubi nakakhulu, kufundisa isifundo esingalungile: ukumephu okuyisisekelo kusashoda, ngakho iphutha libuya emasontweni kamuva ngaphandle kwesicathulo esicacile nangaphandle kwenkumbulo yaleyo ndlela yokugwema. Sebenzisa i-chcon kuphela njengokuhlola kwesikhashana ukuqinisekisa umbono, bese uyishintsha ngokumephu okuhlala isikhathi eside ekulebuleni kabusha okulandelayo, futhi uhlole ukuthi okushintshiwe kukude ngempela endaweni yako.

Uma ilebula ilungile futhi ukufinyelela kusahluleka

Qala ngezikhombisi-mbhalo ezingamazinyane. Ilungelo lokudlula lihlolwa engxenyeni ngayinye yendlela, ngakho isitifiketi esinelebula efanele ngaphakathi kwesikhombisi-mbhalo insizakalo engakwazi ukungena kuso sihlala singafundeki. Kokubili i-SELinux nelungelo elivamile kufanele kuvume isinyathelo ngasinye, futhi ukulungisa okukodwa akukulungisi okunye.

Bese uhlola ubunikazi benqubo kanye ne-sandbox yensizakalo uqobo. Iyunithi ene-sandbox evimbelayo inganqaba ukufinyelela efayelini inqubomgomo ebingayivumela ngentokozo, futhi kusuka emugqeni werekhodi izizathu ezimbili zibonakala zifana. Qinisekisa ukuthi iyiphi inqubo ebuzayo ngempela, hhayi leyo ocabanga ukuthi iyabuza.

Khumbula ukuthi imithetho ye-dontaudit ingacindezela imilayezo yokwenqaba, ngakho irekhodi lokuhlola elingenalutho liwubufakazi obuthaka hhayi ubufakazi. Uma inqubomgomo ibonakala ilungile futhi ukufinyelela kusahluleka, phenya ngaphambi kokukhiqiza imojuli yemvume ebanzi, futhi ungacishi i-SELinux ukuze uphawu lonyamalale. Zombili izindlela ezimfushane ziveza isistimu ebonakala isebenza kanye nesimo sokuphepha okungekho muntu ongakuchaza. Uphenyo olufushane lungcono kunakho kokubili.