¡§Sandbox¡¨ ¬O¨t²Î¦w¥þ¥Îªº³N»y¡A¦³¨âÓ·N¸q¡G
©ñ¦b¬Y¨ÇµêÀÀ¨¾Å@Àð¸Ìªº°õ¦æµ{§Ç¡A³o¨Ç¨¾Å@Àð¬O¥Î¨Óªý¤î ¬Y¨Ç¤H«I¤J³o¹Dµ{§Ç¡A¶i¦Ó¥X¤J©ó§ó¤jªº¨t²Î¤¤¡C
³o¹Dµ{§Ç¥i¥H§¹¥þ¦b¨¾Å@Àð¸Ì ¡§°Ê§@¡¨¡C¤]´N ¬O»¡¡A¥¦©Ò°õ¦æªº¥ô¦óµ{¦¡¤£¥i¯à·|º¯³z¨ìÀ𪺥~±¡C©Ò¥H¦pªG ±z¹ï¥¦¦³¦w¥þ¤WªºÅU¼{¡A¨Ã¤£»Ýn¯S§O¥hºÊÅ¥¥¦ªº¤@Á|¤@°Ê¡A¤Ï ¥¿¥¦¥u¯à¦bÀ𤺬¡°Ê¡C
Á|¨Ò¨Ó»¡¡A¥i¥H¥Î userid ¨Ó°µ³o¹D¨¾Å@Àð¡A³o¥¿¬O security ©M named »¡©ú¤å¥ó¤¤ªº©w¸q¡C
²{¦b´N¥Î ntalk ³oÓªA°È§@»¡©ú¡]¨£ /etc/inetd.conf¡^¡C³oÓªA°È¥H«eªº userid ¬O root¡A²{¦b°õ¦æ®É«h¬O¥Î tty¡Ctty ³oӨϥΪ̴N¬O¤@Ó sandbox¡A¦pªG¦³¤H¯à°÷¶¶§Q¥Î ntalk «I¤J¨t²Î¡A²{¦b¥L´Nºâ¶i±o¨Ó¤]¥u¯à¥Î³oÓ userid¡C
©ñ¦b¬YÓ¼ÒÀÀ¾÷¾¹¸Ìªºµ{¦¡¡A³o¤ñ¤Wz¨Ó±o§óÄY±K¡C°ò¥»¤W ³oªí¥Ü¯à«I¤J¸Óµ{¦¡ªº¤H¬Û«H¥L¯à¦A¶i¤J©ÒÄݪº¾÷¾¹¡A¦ý¨Æ¹ê¤W ¥u·|¶i¤J¼ÒÀÀ¥X¨Óªº¾÷¾¹¡AµLªk¶i¤@¨B×§ï¥ô¦ó¯u¹êªº¸ê®Æ¡C
¹F¨ì³oӥتº³Ì±`¥Îªº¤èªk¡A´N¬O¦b¬YÓ¤l¥Ø¿ý¤U°µ¥X¼ÒÀÀªº Àô¹Ò¡AµM«á¥Î chroot °õ¦æ¸Óµ{¦¡¡A³o¼Ë¸Óµ{¦¡ªº®Ú¥Ø¿ý«K¬O³oÓ ¤l¥Ø¿ý¡A¦Ó«D¨t²Î¯u¥¿ªº®Ú¥Ø¿ý¡C
¥t¤@Ó±`¨£§@ªk¬O±N¬YÓÀɮרt²Î mount ¦¨°ßŪ¡A¦ý¦b¥¦ ¤W±¥t¥~»s³y¥Xµ{¦¡¥H¬°¥i¥H¼g¤JªºÀɮרt²Î¡C³oÓµ{¦¡·|¬Û«H ¥¦¥i¥H¹ï¨ä¥LÀÉ®×Ū¼g¡A¦ý¥u¦³¥¦¬Ý¤£¨ì³oÓ°ßŪ®ÄÀ³ - ¨t²Î °õ¦æªº¤@¯ëµ{¦¡³£¬Ý±o¨ì¡C
§Ú̸չϱN³oÃþ sandbox ºÉ¶q³z©ú¤Æ¡AÅý¨Ï¥ÎªÌ©Î«I¤JªÌ µLªk¬Ý¨ì¥L¬O§_¦b¬YÓ sandbox ¸Ì±¡C
UNIX ¹ê§@¨âºØ sandbox¡A¤@Ó¦bµ{¦¡¼h±¡A¥t¤@Ó«h¬O¥Ñ userid ¨Ó¹F¦¨¡C
¨CÓ UNIX °õ¦æµ{§Ç·|¥Î¨¾¤õÀð±N¥¦©M©Ò¦³¨ä¥Lµ{§Ç¹j¶}¡A¬YÓµ{§Ç ¤£¥i¥HÀH·N×§ï¨ä¥Lµ{§Ç¦ì§}ªº¸ê®Æ¡C³o©M Windows ¤¤¡Aµ{¦¡¥i¥H»´©ö ×§ï¨ä¥L¦ì§}¸ê®Æ¡Aµ²ªG¾ÉP·í¾÷ªº±¡§Î¤j¤£¬Û¦P¡C
¨CÓ UNIX µ{§Ç³£ÄÝ©ó¬YÓ¯S©wªº userid¡C¦pªG¸Ó userid ¤£¬O root¡A´N·|±N¥¦©M¨ä¥L¨Ï¥ÎªÌªºµ{§Ç¹j¶}¡C Userid ¦P®É¤]¥Î©óµwºÐ¸ê®Æªº¦s¨úÅv¤W¡C
securelevel ¬O®Ö¤ß¤¤©Ò¹ê§@ªº¤@Ó¦w¥þ¾÷¨î¡C°ò¥»¤W·í securelevel ¬O¥¿È®É¡A®Ö¤ß·|¨î¬Y¨Ç¤u§@¡F§Y¨Ï¬O superuser (¤]´N¬O root) ¤]µLªk§¹¦¨¨º¨Ç¤u§@¡C¦b¼¶¼g ¥»¤å®É¡Asecurelevel ¾÷¨î¦b¤@¯ëªº¨î¥~¡AÁÙ¯à°÷¨î¥H¤Uªº¥\¯à¡G
²M°£¬Y¨Ç¯S©wªºÀɮ׺X¼Ð¡A¨Ò¦p schg (¨t²Î°ßŪ¼ÐºX, the system immutable flag)
¸g¥Ñ /dev/mem »P /dev/kmem¡A ±N¸ê®Æ¼g¤J¦Ü®Ö¤ß°O¾ÐÅ餤
¸ü¤J®Ö¤ß¼Ò²Õ
§ó°Ê ipfirewall(4) ³W«h¡C
·QnÀˬd¦b¬YÓ¹B§@¤¤ªº¨t²Îªº securelevel ª¬ºA¡A¥un°õ¦æ¥H¤U ©R¥O§Y¥i¡G
# sysctl kern.securelevel
¿é¥Xªºµ²ªG·|¥]§t¤@Ó sysctl(8) ÅܼƦWºÙ
(¦b³oÓ¨Ò¤l¤¤¡A ¥¦¬O kern.securelevel
)
¥H¤Î¤@ӼƦr¡C«áªÌ§Y¬O ¥Ø«eªº securelevel È¡C¦pªG¥¦¬O¤@Ó¥¿È (¤]´N¬O¤j©ó 0)¡Aªí¥Ü¦Ü¤Ö
¦³¤@¨Ç securelevel ªº«OÅ@¾÷¨î¤w¸g¶}±Ò¤F¡C
§A¨S¦³¿ìªk°§C¤@Ó¹B§@¤¤ªº¨t²Îªº securelevel¡F¦pªG¥i¥Hªº¸Ü¡A
´N¥¢¥h¤F³oÓ¾÷¨îªº·N¸q¤F¡C¦pªG§An§@¤@¨Ç»Ýn securelevel ¬° «D¥¿È¤~¥i¥Hªº°Ê§@ªº¸Ü (¨Ò¦p
installworld ©Î§ó°Ê¤é´Á)¡A§A»Ýn×§ï /etc/rc.conf ¤ºªº securelevel ³]©w (§ä§ä kern_securelevel
©M kern_securelevel_enable
ÅܼÆ)¡AµM«á«·s¶}¾÷¡C
·Qnª¾¹D§ó¦h¦³Ãö©ó securelevel »P¦UÓ¤£¦Pµ¥¯Å¼vÅTªº²Ó¸`¡A ½Ð°Ñ¦Ò init(8) »¡©ú¤å¥ó¡C
Warning: securelevel ¥i¤£¬O¸UÆF¤¦¡F¥¦¦³³\¦h¤wª¾ªº¯Ê³´¡A©¹©¹³y¦¨ ¤@ºØ¦w¥þªº°²¶H¡C
¥¦¤@ӳ̤jªº°ÝÃD¡A´N¬OnÅý³oÓ¥\¯à§¹¥þ¦³®Äªº¸Ü¡A¦b securelevel µo´§§@¥Î«eªº±Ò°Ê¹Lµ{¤¤¡A©Ò¦³¨Ï¥Î¨ìªºÀɮ׳£ ¥²¶·³Q«OÅ@°_¨Ó¡C¦pªG¤@Ó§ðÀ»ªÌ¦b securelevel ¦³®Ä«e (¥Ñ©ó ¦³¨Ç¨t²Î¦b±Ò°Ê¤¤©Ò§@ªº¨Æ±¡¡AµLªk¦b¸û°ªªº securelevel ¤¤ ¥¿±`¹B§@¡A©Ò¥H³o·|¦b±Ò°Ê¹Lµ{¤¤«á´Á¤~·|¹B§@)¡A¯àÅý¥L̪ºµ{¦¡ ³Q°õ¦æªº¸Ü¡Asecurelevel ªº«OÅ@´N§¹¥þµL®Ä¤F¡C«OÅ@±Ò°Êµ{§Ç ¤¤©Ò¦³ªºÀɮצb§Þ³N¤W¬O¥i¦æªº¡A¦ý¬O¦pªG¯uªº³o¼Ë§@ªº¸Ü¡A¨t²Î ºûÅ@±N·|Åܦ¨¤@³õ¹ÚÆL¡C§Y¨Ï¥u¬O×§ï¤@Ó³]©wÀÉ¡A¤]¥²¶·±N¾ãÓ ¨t²ÎÃö³¬¡A¦Ü¤Ö¤]±o¨ì³æ¤H¼Ò¦¡¡C
°£¤F³oÂI¡AÁÙ¦³³\¦h¨ä¥¦ªºªF¦è³£¦b³q«H½×¾Â¤W°Q½×¡A¤×¨ä¬O freebsd-security¡C½Ð¨ì ³o¸Ì ·j´M¥H«eªº °Q½×¡C¦³¨Ç¤H§Æ±æ securelevel ¯à°÷¾¨§Ö®ø¥¢¡A¥Ñ¥t¤@Ó§óÀu¨qªº ¾÷¨î¨ú¥N¡A¤£¹L¾÷·|¦³ÂI´ù¯í¡C
·ÀI¦Û¦æ©Ó¾á¡C
13.3. BIND (named) °£¤F¦b³q°T°ð 53 ¥H¥~¤]¦b ¨ä¥L°ª½s¸¹³q°T°ð (high-numbered port) ²âÅ¥ (Listen)¡C ³o¬O«ç»ò¦^¨Æ¡H
FreeBSD 3.0 «áªºª©¥»¨Ï¥Î¤@Ó¯S®íªº BIND ª©¥»¡A³oÓª©¥»·|¨Ï ¥ÎÀH¾÷ªº°ª½s¸¹³q°T°ð¨Ó¦^À³¥~³¡ªº¬d¸ß¡C¦pªG§A¦]¬°n¾A¦X¨¾¤õÀ𪺠³]©w©Î¬O³æ¯Âªº·QÅý¦Û¤v¬Ý¨ÓµÎªA¤@ÂI¦Ó·Q¥Î 53 ³q°T°ð¦^À³¥~³¡¬d¸ß¡A ¨º»ò§A¥i¥H¹Á¸Õ§ó§ï¥H¤UÀɮ׬ÛÃö¤º®e /etc/namedb/named.conf¡G
options { query-source address * port 53; };
§A¤]¥i¥H±N * §ó§ï¬°¯S©w IP address¡A ÂÇ¥H¥[±j±±¨î±ø¥ó¡C
¶¶«K®¥³ß§A¡C¯à°÷Ū¨ú§A¨t²Î¤Wªº sockstat(1) ³ø§i¨Ã¥Bª`·N ¤£¥¿±`ª¬ªp¬O¤@¥ó¦n¨Æ¡I
¸û·sª©¥»ªº Sendmail ¤ä´© mail submission ³o¶µ¥\¯à¡A¨Ã¥B¨Ï ¥Î³q°T°ð 587¡C³o¶µ¥\¯àÁÙ¨S¦³³Q¼sªx¤ä´©¦ý¬O¤ä´©ªº¼Æ¥Ø¥¿¦b¼Wªø ¤¤¡C
©ñ¤ß¡Ctoor ¬O¤@Ó ¡§alternative¡¨ ºÞ²zªÌ±b¸¹ (toor ¬O root ªºÂà¦V«÷ªk)¡C ¥H©¹¬O¸òÀH bash(1) ¦w¸Ë¦Ó«Ø¨îªº¡A«á¨Ó«h¦¨¬°¨t²Î¤º©w«Ø¨îªº¤@ Ó±b¸¹¡C³oÓ±b¸¹±N¦ñÀH¤@Ó«D¼Ð·Çªº shell ´ú¸Õ¨Ï¥Î¡A Åý§A¤£»Ýn¥h §ó§ï¨ì root ªº¤º«Ø shell¡C¦]¬°³o¨Ç¨ä¥Lªº shell ¨Ã¨S¦³¸òÀH¨t²Î¹w³]Ȧw¸Ë (Á|¨Ò¨Ó»¡¡A¬Y¨Ç¥Ñ ports ¦w¸Ëªº shell package)¡A¦Ó³Q¤º©w¦w¸Ë¦b /usr/local/bin ¥Ø¿ý¤U¡A¦³¥i¯à¦s¦b¤£¦PªºÀɮרt²Î¤¤¡C ÕY root ªº shell ³Q©ñ¦b /usr/local/bin¡A¥B /usr (©Î¬O¨ä¥L¥]§tµÛ /usr/local/bin ³oÓ¤l¥Ø¿ýªºÀɮרt²Î) ¦]¬°¬Y¨Çì¦]¨Ã¨S¦³³Q¥¿±`ªº mount °_¨Óªº¸Ü¡Aroot ±NµLªk¥¿±`ªºµn¤J¨t²Î¶i¦æºû× (ÁöµM»¡§A«¶}¾÷¦¨³æ¤H¼Ò¦¡´N·|°Ý§An ¸ü¤JþÓ shell)¡C
¦³¨Ç¤H¨Ï¥Î toor ±b¸¹¶i¦æ¨C¤éªº root ºûÅ@¤u§@¡A¦p¦¹¥i¥H¨Ï¥Î«D¼Ð·Çªº shell¡A¦Ó root ¥i¥H«O¯d¼Ð·Ç shell¡A ¥H¦]À³³æ¤@¨Ï¥ÎªÌ¼Ò¦¡ (single user mode) ©Îºò«æª¬ªp³B²z¡C ¨Ì·Ó¨t²Î¤º©wÈ¡A§A±NµLªk¨Ï¥Î toor µn¤J¡A ¦]¬°³oÓ±b¸¹©|¥¼§ó§ï±K½X³]©w¡C¦]¦¹§A¦pªG§A·Q±Ò°Ê³oÓ±b¸¹¡A§A»Ýn ¨Ï¥Î root µn¤J¨t²Î¨Ã¥B×§ï toor ªº±K½X¡C
¦]¬°¬Y¨Ç¦w¥þªº¦Ò¡Asuidperl ¤º©wªº¦w¸Ë ¨Ã¨S¦³³]©w suid bit¡C¨t²ÎºÞ²zªÌ¥i¥H¨Ì·Ó¥H¤U©R¥O±Ò°Ê suid ³]©w¡C
# chmod u+s /usr/bin/suidperl
¦pªG§A·Qn¦b¥Ñ source ¤É¯Å®É suidperl ¤º©w ±Ò°Ê suid
¥\¯àªº¸Ü¡A½s¿è /etc/make.conf ¥[¤J ENABLE_SUIDPERL=true
µM«á°õ¦æ make
buildworld¡C
¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C
Y¦³ FreeBSD ¤è±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß
<questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C