Kungani i-hook ye-OpenVPN ingayitholi ifayela eliseduze kweskripthi sayo

Ama-hook asebenza ngaphandle kwephutha kodwa abike ifayela elahlekile ngokuvamile abheka endaweni engafanele, awahluleki emsebenzini wawo. Izindlela ezihlobene kuskripthi zixazululwa ngokubhekise kudirectory yokusebenza yonqubo, futhi insiza iqala ngedirectory yokusebenza ongayikhethanga. Ifayela eliseduze kweskripthi kanye nefayela elivulwa yinqubo kuyinto efanayo kuphela lapho okuthile kubopha kubo. Lelo gebe lichaza ingxenye enkulu yokwehluleka kwama-hook okufundwa ngokungalungile njengezinkinga zezimvume.

Hlola indlela ngaphambi kwezimvume, ngoba iphutha lemvume efayeleni elingalungile lisafayela elingalungile.

Indlela ehlobene ixazululwa ngokubhekise kunqubo, hhayi kufayela

Lapho iskripthi sibiza open("policy.json"), i-kernel ixazulula igama ngokubhekise kudirectory yokusebenza yamanje yonqubo. Akukho lutho endaweni yeskripthi uqobo oluhlanganyelayo kulokho kusesha. OpenVPN iqala ama-hook kudirectory elikhetha ngokwalo, futhi inketho cd ingayishintsha, ngakho iskripthi esihlolwe ngesandla kusuka kufolda yaso siziphatha ngendlela ehlukile lapho i-daemon isisebenzisa. Ukuhlolwa ngesandla kuyaphasa, ukusebenza kwensiza kuyahluleka, futhi umugqa welogi usho kuphela igama elilahlekile.

I-Python iveza indawo yeskripthi njenge-__file__, futhi yikho okwenza ukubopha kwenzeke. Path(__file__).resolve().parent / "policy.json" yakha indlela kusuka kufayela hhayi kunqubo. Lowo mugqa owodwa ususa ukuncika kudirectory yokusebenza ngaphandle kokushintsha lutho emalungelweni.

Bopha indlela ngamabomu, bese uhlola ukuthi i-resolve yenzani

resolve() ilandela izixhumanisi ezingokomfanekiso, ngakho ukufakwa okuxhumanisa i-hook endaweni yayo kubopha emhlosweni wesixhumanisi, hhayi kudirectory ephethe isixhumanisi. Lokho ngokuvamile yikho okufunayo ekusetshenzisweni okunamaversini, futhi akulungile kusakhiwo esilindele idatha eduze kwesixhumanisi esingokomfanekiso. Nquma ukuthi ukusetshenziswa kusho ukuthini, futhi bhala ikhodi ngokuhambisana nakho esikhundleni sokuthola umehluko ekukhiqizeni. Path(__file__).parent ngaphandle kwe-resolve() igcina idirectory yesixhumanisi uqobo.

Uma idatha ingeyomkhakhi hhayi eyohlelo, thatha indlela ephelele kusuka kusilungiselelo. Ukufaka indawo ngekhodi eqinile kubopha i-hook esakhiweni esisodwa sesisetshezi.

Dlula imingcele emine ngokulandelana

Qala ngedirectory yokusebenza: qhathanisa WorkingDirectory, inketho cd ye-OpenVPN kanye nanoma yisiphi isembozo esishintsha idirectory ngaphambi kwe-exec. Bese uqinisekisa indawo exazululiwe, ngoba ifayela elinegama elifanayo ekusetshenzisweni okunye lingaphendula ukusesha futhi lifihle iphutha. Okulandelayo umbono wesistimu yamafayela: i-chroot noma isikhala samagama se-mount sensiza kungenza indlela ephelele yomhambukeli ibe engekho nje. Ekugcineni ubunikazi bokufinyelela, okuwumbuzo ohlukile ekubonakaleni.

ProtectHome ne-PrivateTmp kufihla izindawo ezihlukene, futhi akukho kuzo okubonakala kuhlu lwedirectory oluthathwe kumhambukeli. Indlela ekhona ye-root ku-shell ingase ingabonakali ngaphakathi kwesikhala samagama seyunithi, futhi yikho ukuhlola umyalo ofanayo ngaphandle kwensiza kufakazela okuncane kangaka.

Lungisa ukusesha ngaphandle kokwandisa insiza

Ukubopha indlela kuxazulula kuphela umngcele wokuqala. Akudaluli idirectory insiza eyifihlayo, futhi akunikezi i-akhawunti engenamalungelo ukufinyelela efayeleni elingelika-root kuphela. Ukukhuphula script-security kushintsha ukuthi iyiphi imibhalo i-OpenVPN ezoyisebenzisa; akunamthelela wakho ekutheni igama elihlobene lixazululwa kuphi. Ukushintsha idirectory yokusebenza yonke insiza kubanzi kunezinkinga, ngoba yonke enye indlela ehlobene yesitifiketi, ilogi noma umsizi ihamba nayo.

Khetha ukulungiswa okuncane: indlela eqinisekile kuskripthi, inani lesilungiselelo elicacile ledatha yomkhakhi, nobunikazi befayela obuhambisana ne-akhawunti i-hook esebenza ngaphansi kwayo ngempela.

Rekhoda ubufakazi obubiza umngcele

Umbiko wokwehluleka owusizo uqukethe izinto ezintathu: indlela eqondile i-hook eyizamile, indawo eyikhiqizile, nokuthi yimuphi umngcele owenqabile. Phrinta indlela exazululiwe kanye nokuhlukile ngaphandle kokuthela okuqukethwe kwefayela. Lokho kuthathu kuhlukanisa ukubopha okungalungile kusuka ku-mount efihliwe nasekunqatshweni kwemvume, okuyizilungiso ezintathu ezihlukene.

Isimangalo sokuthi i-root ingafunda ifayela kusuka kutheminali siphendula owodwa wale mibuzo hhayi nanye kweminye. Esikhundleni salokho hlola kusuka kumongo wensiza uqobo.