Kungani i-nosuid ivimbela umsizi we-VPN ukuba abe root

Ukubethelwa kwediski kanye ne-nosuid mount kuzwakala njengezinhlobo zomqondo owodwa, futhi azihlobene nhlobo. Okunye kuvikela idatha esemile, kanti okunye kunquma ukuthi i-kernel izohlonipha ibhithi yelungelo ngesikhathi uhlelo luqala. Umsizi ongafinyeleli ubunikazi obuwulindele ukhala ngokwesibili. Umcabango wokuthi owokuqala unecala uthumela abantu ukuthi bafake kabusha amaklayenti angakaze aphuke.

Izici Ezimbili Ezingahlobene

Ukubethelwa kwediski kuphendula ukuthi ubani angafunda amabhulokhi lapho umshini ucishiwe. Inketho ye-mount iphendula ukuthi i-kernel izokwenzani ngamabhithi emodi yefayela lapho othile eyisebenzisa. Akukho lutho kokokuqala okukhawulela okwesibili, futhi ikhompyutha ephathekayo ebethelwe ngokuphelele ingafaka uhlelo lwamafayela ngenkathi yonke imikhawulo isendaweni yayo.

Ukuzifunda njengesici esisodwa yikho okudala umbono wokuthi ikhaya elibethelwe livimbela ukufinyelela kwe-root. Lowo mbono uhlala khona ngoba izimpawu ezimbili zivela emshinini owodwa, hhayi ngoba zabelana ngembangela eyodwa.

Yini Ngempela Ecindezela Ukudlula

Incwadi ye-execve ichaza ukuthi ifayela elisebenzisekayo eline-set-user-ID lishintsha kanjani ubunikazi obusebenzayo benqubo entsha bube sobumnini befayela. Ikhasi elifanayo libala izimo ezicindezela lokho kudlula kanye nokulingana kwazo kuzihlonzi zeqembu: isethingi ye-no_new_privs, uhlelo lwamafayela olufakwe nge-nosuid, kanye nenqubo elandelelwayo. Amandla efayela ayashaywa indiva ngaphansi kwalezo zimo. Lezo zemithetho emine zihlanganisa cishe yonke imibiko yalolu hlobo.

Lolo hlu luchaza ukuthi kungani imodi ephrintwa yi-ls ingekho ingxenye yonke yendaba yokugunyazwa. Ayikutsheli ukuthi yisiphi isimo esidale umlayezo othile wokwehluleka, futhi uhlelo lungase lubike umsebenzi wokuqinisekisa ongahlobene ngalawo magama. Bhala phansi uhlelo olunembile, isiqalisi kanye nokulandelana kwamaphutha ngaphambi kokuphetha.

Khomba ifayela elisebenzisekayo elifakwe yiphakethe elisekelwayo, umnikazi walo, indlela yalo yangempela kanye nenqubomgomo yohlelo lwamafayela oluligcinile. Ikhophi esegumbini lokulanda ayilona umsizi ofakiwe, noma imodi yayo ithini.

Okungamelwe Kwenziwe

Ukubeka amabhithi e-set-user-ID kubhinari engaqinisekisiwe nokuyihambisa yonke indawo kuze kunyamalale umkhawulo akulona ukulungisa. Kufaka esikhundleni senqubomgomo ongayiqondanga ilungelo ongeke ukwazi ukulihlola, futhi indlela efanayo isetshenziswa kumsizi iyindlela eyaziwayo yokukhuphuka. Ukususa i-nosuid ku-mount kubi kakhulu, ngoba kuthinta yonke inhlelo kulelo hlelo lwamafayela, hhayi eyodwa kuphela.

Indlela esekelwayo ukufakwa okubhaliwe komsizi noma kwensizakalo yiklayenti, okwenziwa umphathi, okubeka ibhinari lapho inqubomgomo ikulindele. Lokhu kugcina indlela eyodwa yelungelo esikhundleni sezimbili.

Qinisekisa Isimo Sangempela Sokuqalisa

Ngemva kokulungiswa okugunyaziwe, sebenzisa umsizi ngendlela umkhiqizo awusebenzisa ngayo hhayi kusuka ku-shell ye-root. Ukuphumelela njenge-root akufakazi lutho mayelana nendlela umsebenzisi ojwayelekile ayithathayo, futhi umehluko phakathi kwalezi zimo ezimbili yiwo owawuyisihloko sokwehluleka.

Bese uqinisekisa umsebenzi wenethiwekhi umsizi okhona ngawo. Umsizi oqalayo kodwa ongakwazi ukuhlela i-interface usudlulisele inkinga isigaba esisodwa phambili, akayixazululanga.

findmnt -no TARGET,OPTIONS /home
getcap /usr/libexec/openvpn-helper 2>/dev/null; ls -l /usr/libexec/openvpn-helper

Bhala izinketho ze-mount kanye nobumnini bomsizi encwadini eyodwa. Uma kungenjalo umuntu olandelayo ozolungisa lokhu uzophinda umbono wokubethela kusukela ekuqaleni.