Isevisi ye-VPN ihluleka ku-EXEC: qhathanisa i-unit, i-binary ne-sudoers
Ukuhluleka esigabeni se-EXEC kusho ukuthi i-systemd ayikwazanga ukuqala i-binary. Qhathanisa indlela ye-unit, indlela efakiwe kanye nemvume ye-sudoers ngaphambi kokushintsha noma yini.
Izolo umhubhe wawusebenza, futhi namuhla ekuseni i-unit ifile kanti ku-journal kukhona Failed at step EXEC spawning /usr/local/bin/vpnclient. Imininingo yokungena, imizila kanye ne-akhawunti akulokothi kungene kulo musho. I-systemd yaxazulula i-ExecStart yaba yindlela, yacela i-kernel ukuthi iyisebenzise, futhi i-kernel yanqaba, ngokuvamile ngoba akukho lutho kuleyo ndlela noma ifayela alikwazi ukusebenza. Thatha le nkinga njengenkinga yefayela ne-argv kuze kube yilapho umyalelo ohlaziyiwe ubonisa okuphambene.
Kungani i-EXEC yehluleka ngaphambi kokuthi ukuqinisekiswa kuqale
I-systemd ayisebenzisi i-ExecStart nge-shell. Yenza i-fork, yakha i-vector yezimpikiswano kusukela kulayini bese ishaya ucingo i-execve ku-elementi yokuqala. Uma lokho kubiza kwehluleka, isevisi ayikwazi ukufinyelela kukhodi ye-VPN client uqobo, ngakho ukuhlela iphrofayela noma ukuhlola imininingo yokungena akukusizi.
Ikhodi yesimo ihlukanisa lo mkhakha nezingozi ezijwayelekile. I-unit ephuma nge-status=203/EXEC ayikaze iqale inqubo; i-unit eqalayo bese iphuma nge-status=1 kungenzeka yehlulekile ekuqinisekiseni, ku-DNS noma ekuhambeni kwemizila. Funda ikhodi ngaphambi kokufunda ilogi yeklayenti, ngoba esimweni sokuqala ilogi yeklayenti iyoba nalutho.
Indlela eseku-journal yileyo eyasetshenziswa yi-systemd, hhayi ngempela leyo oyishintshile. Amafayela e-drop-in kanye nokuphuma kwe-generator kungadlula ifayela lomthengisi, futhi i-daemon-reload endala ishiya umugqa wakudala enkumbulweni. Yingakho ukuxilonga kokuqala kuwukubuza i-systemd ukuthi ibona umyalelo unjani, esikhundleni sokuvula ifayela olikhumbulayo ukuthi ulishintshile.
Izindawo ezintathu lapho indlela ye-binary ibhalwe khona
Iklayenti le-VPN elifakwe kusuka kuphakethe lokusabalalisa, umbhalo womthengisi kanye ne-tarball yokukhishwa lingawela kuma-prefix amathathu ahlukene. I-unit, umthetho wamalungelo kanye nesifaki ngakunye kwabhala eyodwa yalawa ma-prefix, futhi iphutha livela lapho ezimbili kwezintathu zingavumelani.
| Record | Common value | How to read it |
|---|---|---|
| Unit or drop-in | /usr/local/bin/vpnclient | systemctl cat vpnclient.service |
| Installed binary | /usr/bin/vpnclient | command -v vpnclient, then ls -l the result |
| Sudoers grant | /opt/vpnclient/bin/vpnclient | sudo grep -r vpnclient /etc/sudoers.d/ |
Ukungavumelani okuqondile kubonakala kanje: umbhalo womthengisi ufaka ku-/usr/local/bin, i-tarball yavulwa ngaphansi kwe-/opt, futhi i-unit isabiza indlela endala /usr/bin kusuka kuphakethe eledlule. Kukhona eyodwa kuphela yalawa mafayela, futhi akuvamisile ukuthi yiloyo eseku-ExecStart.
Nquma ukuthi iyiphi indlela egunyaziwe ngaphambi kokushintsha noma yiliphi lamafayela. Uma iphakethe lokusabalalisa lingumnikazi we-binary, indlela yephakethe iyona egunyaziwe futhi i-unit kufanele iyilande. Uma umbhalo womthengisi ungumnikazi, umthetho ofanayo usebenza ku-prefix yomthengisi. Ukukopisha i-binary phakathi kwama-prefix kudala amakhophi amabili azohlukana ekuthuthukisweni okulandelayo.
Lapho umyalelo osemaceleni uba igama lefayela
Indlela yesibili yokuhluleka icashile ngemuva komugqa ofanayo we-journal. Othile ubhala lokhu ku-unit futhi ulindele ukuthi iklayenti lixhumeke phakathi nokuqalisa:
ExecStart=/usr/bin/"vpnclient connect office"I-systemd ihlukanisa inani libe amagama, ngakho igama lokuqala liba yi-/usr/bin/vpnclient connect office, kanti izicaphuno zisuswa njengesintaksi yokuqoqa. Bese i-kernel ifuna ifayela elinezikha egameni laso, futhi alikho. Iphutha liyafana nelokushoda kwe-binary nakuba ifayela lifakiwe.
Isimo esisekelwayo ifayela langempela elisebenzayo elilandelwa izimpikiswano ezihlukene, isibonelo ExecStart=/usr/bin/vpnclient connect office. Uma uhlelo lokusebenza ludinga ngempela ipayipi noma uchungechunge, lubeke kumbhalo bese ubiza umbhalo, ngoba i-ExecStart ayinawo u-&&, ayinawo amapayipi futhi ayinawo ukunwetshwa kwe-glob.
Lungisa i-unit, hhayi uhlelo lwamafayela
Isixazululo esilingayo isixhumanisi somfanekiso sisuka endleleni elindelekile siya ku-binary yangempela. Sisebenza kuze kube yilapho iphakethe lithuthukiswa futhi isixhumanisi sikhomba ifayela elisusiwe, noma kuze kube yilapho ilebula ye-SELinux ingasavumelani nomgomo. Khetha ukuhlela i-unit nge-drop-in ukuze ifayela lomthengisi lihlale lingathintekile futhi ukuthuthukiswa kuhlale kulindelekile.
Umthetho wamalungelo kufanele uvumelane nendlela efanayo kanye nemiyalelo engaphansi efanayo. Umugqa we-sudoers we-/usr/local/bin/vpnclient awugunyazi i-/usr/bin/vpnclient, futhi umugqa ovumela noma iyiphi impikiswano uvumela noma iyiphi inqubo yasendaweni ukuthi iphinde ilungise noma imise umhubhe. Nikeza izenzo ezimbili ezidingwa yi-unit futhi gcina ukuhlakaza ngaphandle kwayo uma ukumisa isevisi sekuvele kuvala isixhumanisi.
Yilapho ukuqhathanisa kukhokha khona: i-unit, isizindalwazi samaphakethe kanye ne-sudoers kufanele zikhulume indlela eyodwa. Uma zenza kanjalo, iphutha le-EXEC liyanyamalala ngaphandle kokuqalisa kabusha nangaphandle kwekhophi le-binary endaweni yesithathu.
Fakazisa umyalelo ohlaziyiwe ngaphambi kokuqalisa kabusha
sudo systemctl daemon-reload
sudo systemctl cat vpnclient.service
systemctl show -p ExecStart vpnclient.service
systemd-analyze verify /etc/systemd/system/vpnclient.service
sudo systemctl restart vpnclient.service
systemctl status vpnclient.service --no-pagersystemctl show umphumela onqumayo ngoba uprinta i-argv eyahlaziywa ngempela yi-systemd, kuhlangene nanoma yikuphi i-drop-in. I-systemd-analyze verify ibamba indlela engekho noma engasebenziseki ngaphambi kokuthi uqalise kabusha, futhi umyalelo we-status ngemuva kokuqalisa kabusha utshela ukuthi inqubo ikhona yini manje.
Uma i-unit iqala bese ihluleka, ushiye umkhakha we-EXEC futhi ungene ekuphathweni kwamaphutha kweklayenti uqobo. Sesha ku-journal umyalezo weklayenti, hhayi okunye ukuhluleka kwe-execve. Gcina i-diff ye-unit kanye ne-diff ye-sudoers ndawonye kurekhodi loshintsho, ukuze ukuthuthukiswa okulandelayo kungabuyisi ngasese indlela ehlukanisiwe.