I-root kuyitheminali, inqatshiwe ngaphansi kwe-SELinux: kungani i-hook yehluleka

Uqalisa iskripthi se-up njenge-root, siyaphela, futhi sona leso skripthi siyahluleka lapho isevisi isibiza. Akukho okushintshile ezimvumweni zefayela, ngakho isinyathelo esilandelayo esingokwemvelo ukuzikhulula futhi, okungalungisi lutho. Kusibambeli se-SELinux into enqumayo ivamise ukungeyona ukuthi inqubo ingubani, kodwa ukuthi isebenza kusiphi isizinda, futhi i-root ngaphakathi kwesizinda esikhawulelwe isahlala ikhawulelwe.

Umyalo ofanayo, izizinda ezimbili ezihlukene zokuphepha

Ukuphoqelelwa kohlobo kuhlola isizinda somthombo, ilebula yomgomo kanye nomsebenzi oceliwe ndawonye. Iseshini yakho yetheminali isebenza esizindeni esingakhawulelwe noma sokulawula, kanti i-daemon isebenza esizindeni esabelwe iyunithi yayo. Ngakho imiyalo efanayo inikeza izinqumo ezihlukene, futhi umehluko uhlosiwe hhayi iphutha kwinqubomgomo.

Yingakho ukuqhathanisa ukusebenza okubili kuwusizo kuphela uma uqhathanisa izimo zawo. Qalisa umyalo ofanayo kusuka ku-shell nakwi-hook, futhi inguqulo ye-shell ikhombisa ukuthi i-binary ikhona nokuthi izimpikiswano zilungile; ayikhombisi lutho mayelana nokuthi isevisi ivunyelwe ukuyisebenzisa yini. Yisebenzise ngezindlela zombili futhi uqhathanise izizinda, hhayi amakhodi okuphuma kuphela. Yilokho kuqhathanisa okuguqula isikhalo semvume esingacacile sibe umbuzo oqondile mayelana nesizinda esisodwa nelebula eyodwa.

Isimo esivamile sale phutha umsizi obiza ithuluzi langaphandle. I-hook ngokwayo ingase ivunyelwe, kuyilapho ithuluzi elilibizayo liphethe ilebula isizinda sesevisi esingakwazi ukuyisebenzisa, noma libhala kufolda ilebula yalo ekuvimbayo.

Funda irekhodi le-AVC eduze kwephutha le-hook

Ukunqatshwa kwe-AVC kusho izinkambu ezinquma icala: umongo womthombo wenqubo, umongo womgomo wento, isigaba sento kanye nemvume ethile enqatshiwe. Funda konke okune ngaphambi kokwakha ithiyori, ngoba ukunqatshwa kokusebenza nokunqatshwa kokubhala kunezilungiso ezihluke ngokuphelele.

ausearch -m AVC,USER_AVC -ts recent
ls -Z /usr/local/sbin/vpn-up.sh
ps -eZ | grep openvpn

Umongo womthombo kufanele uhambisane nesizinda isevisi esisebenza kuso ngempela, kanti umongo womgomo kufanele uhambisane nelebula yefayela noma yefolda okuthintwe umsebenzi. Uma okunye kwalokhu kungahambisani nephutha olisukelayo, ufunda esinye isigameko.

Eduze kwerekhodi bhala inguqulo yenqubomgomo nendlela eqondile yefayela elisebenzisekayo. Igama lesizinda elivela kunqubomgomo yokusabalalisa okukodwa liwubufakazi mayelana nalokho kufaka, hhayi isiqiniseko sokuthi okunye ukwakhiwa kuletha imithetho efanayo. Yilo mongo ovumela omunye umuntu ukuthi aphindise isiphetho sakho kusibambeli sakhe. Ngaphandle kwawo, irekhodi lifundwa njengendaba hhayi njengobufakazi.

Ilebula, ukumiswa noma inqubomgomo: izilungiso ezintathu

Isilungiso sokuqala ilebula engahambisani nendawo efakwe kuyo ifayela. Iskripthi esikhutshelwe endaweni yaso nge-cp noma esibhalwe umhleli singase siphathe ilebula ezenzakalelayo isizinda sesevisi esingakwazi ukuyisebenzisa, futhi ukubuyisela umongo obulindelekile kuyalungisa lokho ngaphandle kokuthinta inqubomgomo.

Lesibili ukumiswa. Ukusabalalisa kungase kunikeze indlela esekelwayo yokusebenzisa umsebenzi, ifolda ebhalisiwe yomsizi, noma iphakethe lenqubomgomo elibuyekeziwe elivele likuvumela. Ukushintsha ukuhlelwa kwakho kuye kokusekelwayo kushibhe ukubhala inqubomgomo futhi kuhlala ezibuyekezweni.

Lesithathu umthetho ogabukile ngempela, futhi kufanele kube yisinyathelo sokugcina. Khiqiza umuntu oyisicelo ngamathuluzi okuhlola, funda ukuthi kuvumela ini ngempela, kunciphise emsebenzini nasesizindeni osibonile, futhi ucele omunye umuntu ukuthi akubuyekeze ngaphambi kokuba kusondele ekukhiqizeni.

Kungani imojuli ye-allow endala ingeyona impendulo

Imiphumela yokusesha yaleli phutha igcwele amamojuli alungisiwe, imvamisa eyethuluzi i-hook engasalibizi. Ukufaka elilodwa kunikeza izimvume okungenzeka zingahlobene nokunqatshwa kwakho, futhi kushiya ukungahambisani kwangempela endaweni yakhona ngenkathi kunezela imbobo engunaphakade.

Kubuye kufihle ukwehluleka okulandelayo. Imojuli evumela isigaba esibanzi semisebenzi izokwenza leli phutha linyamalale futhi iguqule elilandelayo libe into enzima kakhulu ukuyihlobanisa. Ukususa imojuli kamuva nakho kuyinguquko okungekho muntu ofuna ukuyihlela, ngakho indlela emfushane ivamise ukuba ngunaphakade.

Ukuqhathanisa okunesiyalo kungukuthi phakathi kokunqatshwa ongakufunda nokuguqulwa okukuhlongozayo. Umhlahlandlela we-Red Hat wokuxazulula izinkinga ze-SELinux ubeka ukuhlolwa kwelebula nokumiswa ngaphambi kwenqubomgomo ekhiqiziwe ngesizathu esifanayo. Uma kungekho kunqatshwa okuhambisanayo erekhodini, i-SELinux cishe akusiyo inkinga yakho, futhi izinkinga zendlela, i-sandbox noma izimvume zisavulekile.