Sebenzisa isenzo ngemuva koxhumano lwe-VPN njengomsebenzisi, hhayi njenge-daemon

Ukuguquguquka kwemvelo okuthi USER=alice akukushintshi ukuthi i-hook isebenza ngaphansi kwaluphi i-akhawunti. Hlukanisa umcimbi, isicushi nesenzo, bese ufakazela i-UID.

Ama-hook okuxhumana ku-daemon ye-VPN asebenza njenge-daemon, futhi lokho ngokuvamile kusho ukuthi asebenza njenge-root. Ngesikhathi esisodwa lapho elinye lala ma-hook libhala kumqulu wasekhaya womuntu noma liqala kabusha umsizi wedeskithophu, usunikeze umcimbi wenethiwekhi amandla okusebenza njenganoma yimuphi umsebenzisi wendawo. Indlela emfushane ejwayelekile, ukufunda igama lomsebenzisi kusuka kokuguquguqukayo kwemvelo bese ukudlulisela, akukulungisi lokho. Kufaka ilebula kabusha isenzo ngaphandle kokushintsha ukuthi iyiphi i-akhawunti esisebenzisayo. Okusebenzayo ukudluliselwa kwezigaba ezintathu, lapho isinyathelo esinegunya sisho ukuthi kwenzekeni khona futhi iyunithi ehlukile yenza isenzo ngaphansi kobunikazi obufanele.

Igama lomsebenzisi emvelweni akusona isishintshi sobunikazi

I-Unix inquma ukuthi inqubo ingathinta ini ngokususelwa ku-ID yomsebenzisi esebenzayo, hhayi emicabeni esemvelweni yayo. Ukusetha USER=alice noma ukukhipha LOGNAME kushintsha lokho isofthiwe enganaki eyikushicilela emiphumeleni yayo; akushintshi lutho ekuhlolweni kobunikazi bamafayela. I-hook esebenza njenge-root ngalokho kuguquguqukayo isavula amafayela ka-Alice njenge-root.

Amagama nawo awelona igama elifanayo. Ukungena kokufinyelela kude, i-akhawunti ye-Unix yendawo kanye negama elijwayelekile lesitifiketi kuyizihlonzi ezintathu ezivame ukuhambelana futhi ngezinye izikhathi zingahambelani. Umsebenzisi oqinisekisa njengo-a.smith kungenzeka abe ngelona i-akhawunti yendawo, noma ehlelwe ku-asmith ngokusebenzisa isevisi yomqulu. Noma yikuphi ukuklama okucabanga ukuthi umucu owodwa usebenza kuzo zontathu izindima kuzophuka kumuntu wokuqala oqashiwe.

Ngakho umbuzo wokuqala awuwona «umuphi umsebenzisi oxhunyiwe» kodwa «iyiphi i-akhawunti yendawo evunyelwe ukwenza lesi senzo». Phendula lokho kusuka kusizindalwazi sakho sama-akhawunti, hhayi kulokho okuthunyelwe iklayenti:

id -u alice
getent passwd alice | cut -d: -f1,3,6
stat -c '%U:%G %a %n' /home/alice/.local/state/vpn-status.json

Umyalo wesithathu yiwona ogxunyekwa abantu. Uma ifayela okuhlosiwe lingelika-root ngoba i-hook edlule yalidala, isenzo somsebenzisi esilungiswe kahle sizohluleka ngephutha lemvume elibonakala njengenkinga ye-systemd futhi kungeyona.

I-daemon ihlala lapho ikhona

Ukushintsha i-User= yesevisi ye-VPN uqobo ibe ngu-Alice kuyisikhiwo esingalungile. Kushintsha indlela i-daemon ehlanganisa ngayo izinsiza, efunda ngayo okhiye, ebhala ngayo ifayela layo lesimo futhi iphatha ngayo imizila, futhi kudlulisela yonke leyo ngozi kuphasela. I-daemon idinga amalungelo ayo; isenzo esilandelayo asiwadingi.

Bheka ukuthi iyunithi yenzani ngempela ngaphambi kokuyithinta. Imiyalo emibili ikutshela ubunikazi bokusebenza kanye nemigqa yemiyalo eqondile esebenzayo, kuhlanganisa nakho konke okwengezwe ukubhala phezu:

systemctl show -p User -p Group -p ExecStart openvpn-server@server
systemctl cat openvpn-server@server

Ekufakweni kwephakethe okuzenzakalelayo i-daemon iyi-root, futhi umbhalo we---up uyizuzela lokho. Kuqinisekisa esikhundleni sokucabanga, ngoba ukusabalalisa okuqinisiwe kungenzeka ukuthi kuyidlulisile ku-akhawunti ezinikezelwe, futhi i-drop-in ebhalwe ngesandla ingasebenzisa i-hook ngokusebenzisa isisonge esineminye imithetho.

Izingxenye ezintathu ezinamagama, isicushi esisodwa esincane

Isakhiwo esidlula ukunakekelwa sinesigameko, isicushi nesenzo. I-daemon ibika ukuthi isikhathi esithile esiqanjiwe senyukile. Isicushi samukela lelo qiniso elincane futhi sicela isenzo esisodwa esinqunyiwe. Isenzo sisebenza ngaphansi kwe-akhawunti yendawo engumnikazi wamafayela esiwathintayo. Akukho lutho kuketanga olwamukela umzila womyalo ongafanele.

Isenzo ngokwaso siyiqoqo lesevisi elivamile, futhi ubunikazi buyisiyalo esisodwa ngaphakathi kwaso:

[Service]
Type=oneshot
User=alice
Group=alice
ExecStart=/usr/local/bin/refresh-vpn-status --slot %i

Qaphela ukuthi i-User=alice isebenza kuyo yonke iyunithi, futhi i-systemd ibhala okukodwa okuhlukile okufanele kwaziwe: umyalo onesiqalo se-+ usebenza ngamalungelo aphelele kungakhathaleki lokho. Leso siqalo siyithuluzi elisemthethweni lesinyathelo esisodwa esinegunya futhi siyindlela elula yokuhlehlisa ukwahlukanisa osanda kukwakha, ngakho phatha noma yikuphi i-+ kuleyo yunithi njengento okufanele isekelwe ekubuyekezweni.

Gcina okokufaka kwesicushi kuncane futhi kungayimfihlo. Isihlonzi sesikhathi, i-akhawunti ekhonjisiwe kanye nesitembu sesikhathi ngokuvamile yikho konke okudingekayo. Ungalokothi udlulise ngaphesheya komngcele ucezu lwe-shell, umzila wefayela elisebenzayo noma ibhlokhi yemvelo enikezwe iklayenti, ngoba uhlangothi olwamukelayo alunayo indlela yokuhlukanisa inani elisemthethweni kunalelo elifakiwe.

Qinisekisa ubunikazi obusebenze ngempela

Ukubuyekezwa kokulungiswa akusona ubufakazi. Ngemuva koxhumano lwesivivinyo olugunyaziwe, qinisekisa i-UID eyathinta ifayela kanye ne-UID esetshenziswa yi-daemon namanje:

stat -c '%U %G %y %n' /home/alice/.local/state/vpn-status.json
ps -o user=,pid=,cmd= -p "$(pgrep -o -f 'openvpn --daemon')"
systemd-run --uid=alice --pipe /usr/local/bin/refresh-vpn-status --dry-run

Umgqa wokuqala kufanele ukhombise u-Alice nesitembu sesikhathi ngaphakathi kwewindi lakho lesivivinyo. Owesibili kufanele usakhombisa i-root noma i-akhawunti yesevisi yephakethe, okufakazela ukuthi i-daemon ayinyakazanga. Owesithathu iyindlela eshibhe kakhulu yokuhlola imvume yesenzo ngaphandle kokulinda ukuxhumana kabusha kwangempela.

Uma umnikazi wefayela engu-Alice kodwa iqembu noma imodi yalo yashintsha phakathi kokusebenza, funa i-UMask= noma umehluko wemvume yomqulu esikhundleni sephutha lokucabanga. Uma isitembu sesikhathi singanyakazanga nhlobo, isicushi asizange sikhulume, futhi isinyathelo esilandelayo esiwusizo yi-journalctl -u yeyunithi yesenzo hhayi ukuxhumana kabusha kweklayenti.

Lokho umcimbi woxhumano ongakafakazeli kona

Umhubhe osunguliwe uyiqiniso elilodwa. Akusho ukuthi isikhathi sedeskithophu sivuliwe, ibhasi yesikhathi iyafinyeleleka noma ukuthi insiza eyimfihlo efiswa yisenzo isivele itholakala. Iyunithi ye-oneshot ngaphansi kwe-UID ka-Alice inobunikazi bakhe futhi ayinalutho oluvela esikhathini sakhe, ngakho konke okudinga ibhasi yezithombe kufanele kudlule kumshini wesikhathi somsebenzisi osekelwayo futhi kuchaze ukuthi kwenzekani lapho ephumile.

Ukuxhumana kabusha nakho kuyaphindaphinda. Ikhompyutha ephathekayo elele esitimeleni ingakhiqiza ishumi lemcimbi woxhumano ngaphakathi kwehora, futhi i-hook engeza umugqa njalo iguqula ifayela lesimo libe yirekhodi okungekho ongalifunda. Yenza isenzo sibe yi-idempotent, noma siyeke sithathe indawo yerekhodi elilodwa elikhiyiwe ngesikhathi.

Ekugcineni, nciphisa irediyasi yomonakalo kuyunithi ngokwayo: umbono wefayela lesistimu ofundwa kuphela ngaphandle komqulu wesimo, akukho malungelo amasha, kanye nesikhathi sokulinda esicacile. Ukwahlukaniswa phakathi kwe-daemon nesenzo somsebenzisi kuyazifaneleka, kodwa kubaluleke kakhulu lapho isenzo singakwazi ukwenza lutho ngaphandle kwaleyo nto eyodwa oyigunyazile.

Izihloko ezihlobene