![当且仅当 openvpn 由 systemd 运行时,openvpn 后续脚本才会失败,并显示“操作不允许”](https://linux22.com/image/691390/%E5%BD%93%E4%B8%94%E4%BB%85%E5%BD%93%20openvpn%20%E7%94%B1%20systemd%20%E8%BF%90%E8%A1%8C%E6%97%B6%EF%BC%8Copenvpn%20%E5%90%8E%E7%BB%AD%E8%84%9A%E6%9C%AC%E6%89%8D%E4%BC%9A%E5%A4%B1%E8%B4%A5%EF%BC%8C%E5%B9%B6%E6%98%BE%E7%A4%BA%E2%80%9C%E6%93%8D%E4%BD%9C%E4%B8%8D%E5%85%81%E8%AE%B8%E2%80%9D.png)
我有这个由 openvpn 运行的发布脚本:
#!/bin/bash
echo "I am: `whoami`"
echo "Moving interface into the netns"
ip link set dev "$1" up netns hydrogenvpn mtu "$2"
echo "Listing"
ip netns ls
echo "test"
ip netns exec hydrogenvpn cat /tmp/foobar
如果我使用以下任何命令运行 openvpn:,,,service openvpn start
我会在我的日志中得到这些内容:/etc/init.d/openvpn start
systemctl start [email protected]
Sun Oct 9 11:19:15 2016 us=851109 /sbin/ip link set dev tun-hyd2 up mtu 1500
Sun Oct 9 11:19:15 2016 us=858267 /sbin/ip addr add dev tun-hyd2 10.43.43.3/24 broadcast 10.43.43.255
Sun Oct 9 11:19:15 2016 us=872474 /etc/openvpn/hydrogen_postup.sh tun-hyd2 1500 1542 10.43.43.3 255.255.255.0 init
I am: root
Moving interface into the netns
Listing
novpn (id: 1)
hydrogenvpn (id: 0)
test
setting the network namespace "hydrogenvpn" failed: Operation not permitted
但是,如果我使用与 systemd 完全相同的命令运行 openvpn,它就可以工作:
# systemctl status [email protected] | grep Process
Process: 7722 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid (code=exited, status=0/SUCCESS)
# /usr/sbin/openvpn --daemon ovpn-hydrogen --status /run/openvpn/hydrogen.status 10 --cd /etc/openvpn --config /etc/openvpn/hydrogen.conf --writepid /run/openvpn/hydrogen.pid
# tail /var/log/openvpn.log
Sun Oct 9 11:25:28 2016 us=762617 /sbin/ip addr add dev tun-hyd2 10.43.43.3/24 broadcast 10.43.43.255
Sun Oct 9 11:25:28 2016 us=767131 /etc/openvpn/hydrogen_postup.sh tun-hyd2 1500 1542 10.43.43.3 255.255.255.0 init
I am: root
Moving interface into the netns
Listing
novpn (id: 1)
hydrogenvpn (id: 0)
test
<content of /tmp/foobar>
Sun Oct 9 11:25:28 2016 us=952737 Initialization Sequence Completed
我也尝试使用 systemd 启动 openvpn,然后手动运行脚本,它也有效。
为什么两次运行会有区别?如何让脚本在使用 systemd 启动的 openvpn 运行时正常工作?
版本:Debian 测试版、openvpn 2.3.11-2、systemd 231-9
答案1
这是 OpenVPN 的服务文件():/lib/systemd/system/[email protected]
[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
PrivateTmp=true
KillMode=mixed
Type=forking
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
ProtectSystem=yes
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
[Install]
WantedBy=multi-user.target
有三件事限制了我们可以做的事情:
CapabilityBoundingSet
限制该单元可以执行的操作。“ip netns”可能需要一些功能,但这些功能不在此列。例如,执行需要的ip netns
绑定。mount --bind
CAP_SYS_ADMIN
ProtectSystem
阻止该单元修改文件系统(我不认为它阻止绑定挂载);LimitNPROC
限制单元中的进程数。这可能是问题的根源,但对于复杂的脚本来说,这可能是一个问题。