Chapter 13 ¨t²Î¦w¥þ½g

Biing Jong Lin
13.1. ¤°»ò¬O sandbox¡H
13.2. ¤°»ò¬O securelevel?
13.3. BIND (named) °£¤F¦b³q°T°ð 53 ¥H¥~¤]¦b ¨ä¥L°ª½s¸¹³q°T°ð (high-numbered port) ²âÅ¥ (Listen)¡C ³o¬O«ç»ò¦^¨Æ¡H
13.4. Sendmail °£¤F¦b¼Ð·Çªº³q°T°ð 25 ¥~¤]¦b³q°T°ð 587 ²âÅ¥¡I³o¬O«ç »ò¦^¨Æ¡H
13.5. §Úµo²{¤F³o­Ó UID 0 toor ±b¸¹¡A³o¬O¤°»ò ¸J¿|¡H§Ú³Q¶Â±¼¤F¶Ü¡H
13.6. ¬°¤°»ò suidperl µLªk¥¿±`¹B§@¡H

13.1. ¤°»ò¬O sandbox¡H

¡§Sandbox¡¨ ¬O¨t²Î¦w¥þ¥Îªº³N»y¡A¦³¨â­Ó·N¸q¡G

  • ©ñ¦b¬Y¨ÇµêÀÀ¨¾Å@Àð¸Ìªº°õ¦æµ{§Ç¡A³o¨Ç¨¾Å@Àð¬O¥Î¨Óªý¤î ¬Y¨Ç¤H«I¤J³o¹Dµ{§Ç¡A¶i¦Ó¥X¤J©ó§ó¤jªº¨t²Î¤¤¡C

    ³o¹Dµ{§Ç¥i¥H§¹¥þ¦b¨¾Å@Àð¸Ì ¡§°Ê§@¡¨¡C¤]´N ¬O»¡¡A¥¦©Ò°õ¦æªº¥ô¦óµ{¦¡¤£¥i¯à·|º¯³z¨ìÀ𪺥~­±¡C©Ò¥H¦pªG ±z¹ï¥¦¦³¦w¥þ¤WªºÅU¼{¡A¨Ã¤£»Ý­n¯S§O¥hºÊÅ¥¥¦ªº¤@Á|¤@°Ê¡A¤Ï ¥¿¥¦¥u¯à¦bÀ𤺬¡°Ê¡C

    Á|¨Ò¨Ó»¡¡A¥i¥H¥Î userid ¨Ó°µ³o¹D¨¾Å@Àð¡A³o¥¿¬O security ©M named »¡©ú¤å¥ó¤¤ªº©w¸q¡C

    ²{¦b´N¥Î ntalk ³o­ÓªA°È§@»¡©ú¡]¨£ /etc/inetd.conf¡^¡C³o­ÓªA°È¥H«eªº userid ¬O root¡A²{¦b°õ¦æ®É«h¬O¥Î tty¡Ctty ³o­Ó¨Ï¥ÎªÌ´N¬O¤@­Ó sandbox¡A¦pªG¦³¤H¯à°÷¶¶§Q¥Î ntalk «I¤J¨t²Î¡A²{¦b¥L´Nºâ¶i±o¨Ó¤]¥u¯à¥Î³o­Ó userid¡C

  • ©ñ¦b¬Y­Ó¼ÒÀÀ¾÷¾¹¸Ìªºµ{¦¡¡A³o¤ñ¤W­z¨Ó±o§óÄY±K¡C°ò¥»¤W ³oªí¥Ü¯à«I¤J¸Óµ{¦¡ªº¤H¬Û«H¥L¯à¦A¶i¤J©ÒÄݪº¾÷¾¹¡A¦ý¨Æ¹ê¤W ¥u·|¶i¤J¼ÒÀÀ¥X¨Óªº¾÷¾¹¡AµLªk¶i¤@¨B­×§ï¥ô¦ó¯u¹êªº¸ê®Æ¡C

    ¹F¨ì³o­Ó¥Øªº³Ì±`¥Îªº¤èªk¡A´N¬O¦b¬Y­Ó¤l¥Ø¿ý¤U°µ¥X¼ÒÀÀªº Àô¹Ò¡AµM«á¥Î chroot °õ¦æ¸Óµ{¦¡¡A³o¼Ë¸Óµ{¦¡ªº®Ú¥Ø¿ý«K¬O³o­Ó ¤l¥Ø¿ý¡A¦Ó«D¨t²Î¯u¥¿ªº®Ú¥Ø¿ý¡C

    ¥t¤@­Ó±`¨£§@ªk¬O±N¬Y­ÓÀɮרt²Î mount ¦¨°ßŪ¡A¦ý¦b¥¦ ¤W­±¥t¥~»s³y¥Xµ{¦¡¥H¬°¥i¥H¼g¤JªºÀɮרt²Î¡C³o­Óµ{¦¡·|¬Û«H ¥¦¥i¥H¹ï¨ä¥LÀÉ®×Ū¼g¡A¦ý¥u¦³¥¦¬Ý¤£¨ì³o­Ó°ßŪ®ÄÀ³ - ¨t²Î °õ¦æªº¤@¯ëµ{¦¡³£¬Ý±o¨ì¡C

    §Ú­Ì¸Õ¹Ï±N³oÃþ sandbox ºÉ¶q³z©ú¤Æ¡AÅý¨Ï¥ÎªÌ©Î«I¤JªÌ µLªk¬Ý¨ì¥L¬O§_¦b¬Y­Ó sandbox ¸Ì­±¡C

UNIX ¹ê§@¨âºØ sandbox¡A¤@­Ó¦bµ{¦¡¼h­±¡A¥t¤@­Ó«h¬O¥Ñ userid ¨Ó¹F¦¨¡C

¨C­Ó UNIX °õ¦æµ{§Ç·|¥Î¨¾¤õÀð±N¥¦©M©Ò¦³¨ä¥Lµ{§Ç¹j¶}¡A¬Y­Óµ{§Ç ¤£¥i¥HÀH·N­×§ï¨ä¥Lµ{§Ç¦ì§}ªº¸ê®Æ¡C³o©M Windows ¤¤¡Aµ{¦¡¥i¥H»´©ö ­×§ï¨ä¥L¦ì§}¸ê®Æ¡Aµ²ªG¾É­P·í¾÷ªº±¡§Î¤j¤£¬Û¦P¡C

¨C­Ó UNIX µ{§Ç³£ÄÝ©ó¬Y­Ó¯S©wªº userid¡C¦pªG¸Ó userid ¤£¬O root¡A´N·|±N¥¦©M¨ä¥L¨Ï¥ÎªÌªºµ{§Ç¹j¶}¡C Userid ¦P®É¤]¥Î©óµwºÐ¸ê®Æªº¦s¨úÅv¤W¡C

13.2. ¤°»ò¬O securelevel?

securelevel ¬O®Ö¤ß¤¤©Ò¹ê§@ªº¤@­Ó¦w¥þ¾÷¨î¡C°ò¥»¤W·í securelevel ¬O¥¿­È®É¡A®Ö¤ß·|­­¨î¬Y¨Ç¤u§@¡F§Y¨Ï¬O superuser (¤]´N¬O root) ¤]µLªk§¹¦¨¨º¨Ç¤u§@¡C¦b¼¶¼g ¥»¤å®É¡Asecurelevel ¾÷¨î¦b¤@¯ëªº­­¨î¥~¡AÁÙ¯à°÷­­¨î¥H¤Uªº¥\¯à¡G

  • ²M°£¬Y¨Ç¯S©wªºÀɮ׺X¼Ð¡A¨Ò¦p schg (¨t²Î°ßŪ¼ÐºX, the system immutable flag)

  • ¸g¥Ñ /dev/mem »P /dev/kmem¡A ±N¸ê®Æ¼g¤J¦Ü®Ö¤ß°O¾ÐÅ餤

  • ¸ü¤J®Ö¤ß¼Ò²Õ

  • §ó°Ê ipfirewall(4) ³W«h¡C

·Q­nÀˬd¦b¬Y­Ó¹B§@¤¤ªº¨t²Îªº securelevel ª¬ºA¡A¥u­n°õ¦æ¥H¤U ©R¥O§Y¥i¡G

# sysctl kern.securelevel

¿é¥Xªºµ²ªG·|¥]§t¤@­Ó sysctl(8) ÅܼƦWºÙ (¦b³o­Ó¨Ò¤l¤¤¡A ¥¦¬O kern.securelevel) ¥H¤Î¤@­Ó¼Æ¦r¡C«áªÌ§Y¬O ¥Ø«eªº securelevel ­È¡C¦pªG¥¦¬O¤@­Ó¥¿­È (¤]´N¬O¤j©ó 0)¡Aªí¥Ü¦Ü¤Ö ¦³¤@¨Ç securelevel ªº«OÅ@¾÷¨î¤w¸g¶}±Ò¤F¡C

§A¨S¦³¿ìªk­°§C¤@­Ó¹B§@¤¤ªº¨t²Îªº securelevel¡F¦pªG¥i¥Hªº¸Ü¡A ´N¥¢¥h¤F³o­Ó¾÷¨îªº·N¸q¤F¡C¦pªG§A­n§@¤@¨Ç»Ý­n securelevel ¬° «D¥¿­È¤~¥i¥Hªº°Ê§@ªº¸Ü (¨Ò¦p installworld ©Î§ó°Ê¤é´Á)¡A§A»Ý­n­×§ï /etc/rc.conf ¤ºªº securelevel ³]©w (§ä§ä kern_securelevel ©M kern_securelevel_enable ÅܼÆ)¡AµM«á­«·s¶}¾÷¡C

·Q­nª¾¹D§ó¦h¦³Ãö©ó securelevel »P¦U­Ó¤£¦Pµ¥¯Å¼vÅTªº²Ó¸`¡A ½Ð°Ñ¦Ò init(8) »¡©ú¤å¥ó¡C

Warning: securelevel ¥i¤£¬O¸UÆF¤¦¡F¥¦¦³³\¦h¤wª¾ªº¯Ê³´¡A©¹©¹³y¦¨ ¤@ºØ¦w¥þªº°²¶H¡C

¥¦¤@­Ó³Ì¤jªº°ÝÃD¡A´N¬O­nÅý³o­Ó¥\¯à§¹¥þ¦³®Äªº¸Ü¡A¦b securelevel µo´§§@¥Î«eªº±Ò°Ê¹Lµ{¤¤¡A©Ò¦³¨Ï¥Î¨ìªºÀɮ׳£ ¥²¶·³Q«OÅ@°_¨Ó¡C¦pªG¤@­Ó§ðÀ»ªÌ¦b securelevel ¦³®Ä«e (¥Ñ©ó ¦³¨Ç¨t²Î¦b±Ò°Ê¤¤©Ò§@ªº¨Æ±¡¡AµLªk¦b¸û°ªªº securelevel ¤¤ ¥¿±`¹B§@¡A©Ò¥H³o·|¦b±Ò°Ê¹Lµ{¤¤«á´Á¤~·|¹B§@)¡A¯àÅý¥L­Ìªºµ{¦¡ ³Q°õ¦æªº¸Ü¡Asecurelevel ªº«OÅ@´N§¹¥þµL®Ä¤F¡C«OÅ@±Ò°Êµ{§Ç ¤¤©Ò¦³ªºÀɮצb§Þ³N¤W¬O¥i¦æªº¡A¦ý¬O¦pªG¯uªº³o¼Ë§@ªº¸Ü¡A¨t²Î ºûÅ@±N·|Åܦ¨¤@³õ¹ÚÆL¡C§Y¨Ï¥u¬O­×§ï¤@­Ó³]©wÀÉ¡A¤]¥²¶·±N¾ã­Ó ¨t²ÎÃö³¬¡A¦Ü¤Ö¤]±o¨ì³æ¤H¼Ò¦¡¡C

°£¤F³oÂI¡AÁÙ¦³³\¦h¨ä¥¦ªºªF¦è³£¦b³q«H½×¾Â¤W°Q½×¡A¤×¨ä¬O freebsd-security¡C½Ð¨ì ³o¸Ì ·j´M¥H«eªº °Q½×¡C¦³¨Ç¤H§Æ±æ securelevel ¯à°÷¾¨§Ö®ø¥¢¡A¥Ñ¥t¤@­Ó§óÀu¨qªº ¾÷¨î¨ú¥N¡A¤£¹L¾÷·|¦³ÂI´ù¯í¡C

­·ÀI¦Û¦æ©Ó¾á¡C

13.3. BIND (named) °£¤F¦b³q°T°ð 53 ¥H¥~¤]¦b ¨ä¥L°ª½s¸¹³q°T°ð (high-numbered port) ²âÅ¥ (Listen)¡C ³o¬O«ç»ò¦^¨Æ¡H

FreeBSD 3.0 «áªºª©¥»¨Ï¥Î¤@­Ó¯S®íªº BIND ª©¥»¡A³o­Óª©¥»·|¨Ï ¥ÎÀH¾÷ªº°ª½s¸¹³q°T°ð¨Ó¦^À³¥~³¡ªº¬d¸ß¡C¦pªG§A¦]¬°­n¾A¦X¨¾¤õÀ𪺠³]©w©Î¬O³æ¯Âªº·QÅý¦Û¤v¬Ý¨ÓµÎªA¤@ÂI¦Ó·Q¥Î 53 ³q°T°ð¦^À³¥~³¡¬d¸ß¡A ¨º»ò§A¥i¥H¹Á¸Õ§ó§ï¥H¤UÀɮ׬ÛÃö¤º®e /etc/namedb/named.conf¡G

options {
        query-source address * port 53;
};

§A¤]¥i¥H±N * §ó§ï¬°¯S©w IP address¡A ÂÇ¥H¥[±j±±¨î±ø¥ó¡C

¶¶«K®¥³ß§A¡C¯à°÷Ū¨ú§A¨t²Î¤Wªº sockstat(1) ³ø§i¨Ã¥Bª`·N ¤£¥¿±`ª¬ªp¬O¤@¥ó¦n¨Æ¡I

13.4. Sendmail °£¤F¦b¼Ð·Çªº³q°T°ð 25 ¥~¤]¦b³q°T°ð 587 ²âÅ¥¡I³o¬O«ç »ò¦^¨Æ¡H

¸û·sª©¥»ªº Sendmail ¤ä´© mail submission ³o¶µ¥\¯à¡A¨Ã¥B¨Ï ¥Î³q°T°ð 587¡C³o¶µ¥\¯àÁÙ¨S¦³³Q¼sªx¤ä´©¦ý¬O¤ä´©ªº¼Æ¥Ø¥¿¦b¼Wªø ¤¤¡C

13.5. §Úµo²{¤F³o­Ó UID 0 toor ±b¸¹¡A³o¬O¤°»ò ¸J¿|¡H§Ú³Q¶Â±¼¤F¶Ü¡H

©ñ¤ß¡Ctoor ¬O¤@­Ó ¡§alternative¡¨ ºÞ²zªÌ±b¸¹ (toor ¬O root ªºÂà¦V«÷ªk)¡C ¥H©¹¬O¸òÀH bash(1) ¦w¸Ë¦Ó«Ø¨îªº¡A«á¨Ó«h¦¨¬°¨t²Î¤º©w«Ø¨îªº¤@ ­Ó±b¸¹¡C³o­Ó±b¸¹±N¦ñÀH¤@­Ó«D¼Ð·Çªº shell ´ú¸Õ¨Ï¥Î¡A Åý§A¤£»Ý­n¥h §ó§ï¨ì root ªº¤º«Ø shell¡C¦]¬°³o¨Ç¨ä¥Lªº shell ¨Ã¨S¦³¸òÀH¨t²Î¹w³]­È¦w¸Ë (Á|¨Ò¨Ó»¡¡A¬Y¨Ç¥Ñ ports ¦w¸Ëªº shell package)¡A¦Ó³Q¤º©w¦w¸Ë¦b /usr/local/bin ¥Ø¿ý¤U¡A¦³¥i¯à¦s¦b¤£¦PªºÀɮרt²Î¤¤¡C ­Õ­Y root ªº shell ³Q©ñ¦b /usr/local/bin¡A¥B /usr (©Î¬O¨ä¥L¥]§tµÛ /usr/local/bin ³o­Ó¤l¥Ø¿ýªºÀɮרt²Î) ¦]¬°¬Y¨Ç­ì¦]¨Ã¨S¦³³Q¥¿±`ªº mount °_¨Óªº¸Ü¡Aroot ±NµLªk¥¿±`ªºµn¤J¨t²Î¶i¦æºû­× (ÁöµM»¡§A­«¶}¾÷¦¨³æ¤H¼Ò¦¡´N·|°Ý§A­n ¸ü¤J­þ­Ó shell)¡C

¦³¨Ç¤H¨Ï¥Î toor ±b¸¹¶i¦æ¨C¤éªº root ºûÅ@¤u§@¡A¦p¦¹¥i¥H¨Ï¥Î«D¼Ð·Çªº shell¡A¦Ó root ¥i¥H«O¯d¼Ð·Ç shell¡A ¥H¦]À³³æ¤@¨Ï¥ÎªÌ¼Ò¦¡ (single user mode) ©Îºò«æª¬ªp³B²z¡C ¨Ì·Ó¨t²Î¤º©w­È¡A§A±NµLªk¨Ï¥Î toor µn¤J¡A ¦]¬°³o­Ó±b¸¹©|¥¼§ó§ï±K½X³]©w¡C¦]¦¹§A¦pªG§A·Q±Ò°Ê³o­Ó±b¸¹¡A§A»Ý­n ¨Ï¥Î root µn¤J¨t²Î¨Ã¥B­×§ï toor ªº±K½X¡C

13.6. ¬°¤°»ò suidperl µLªk¥¿±`¹B§@¡H

¦]¬°¬Y¨Ç¦w¥þªº¦Ò¡Asuidperl ¤º©wªº¦w¸Ë ¨Ã¨S¦³³]©w suid bit¡C¨t²ÎºÞ²zªÌ¥i¥H¨Ì·Ó¥H¤U©R¥O±Ò°Ê suid ³]©w¡C

# chmod u+s /usr/bin/suidperl

¦pªG§A·Q­n¦b¥Ñ source ¤É¯Å®É suidperl ¤º©w ±Ò°Ê suid ¥\¯àªº¸Ü¡A½s¿è /etc/make.conf ¥[¤J ENABLE_SUIDPERL=true µM«á°õ¦æ make buildworld¡C

¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C

­Y¦³ FreeBSD ¤è­±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß <questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C