{"id":78514,"date":"2020-04-20T01:42:32","date_gmt":"2020-04-19T23:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos"},"modified":"2020-04-20T01:42:32","modified_gmt":"2020-04-19T23:42:32","slug":"kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","title":{"rendered":"Hvordan man beskytter processer og udvidelser i macOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hej, Habr! I dag vil jeg gerne tale om, hvordan man kan beskytte processer mod indtr\u00e6ngen fra kriminelle i macOS. For eksempel er dette nyttigt for antivirusprogrammer eller backupsystemer, is\u00e6r i lyset af at der i macOS findes flere metoder til at \"dr\u00e6be\" en proces. L\u00e6s mere om dette og metoderne til beskyttelse nedenfor.<\/p>\n

\"Hvordan<\/a><\/noindex>
\n<\/a><\/noindex><\/p>\n

Den klassiske metode til at \"dr\u00e6be\" en proces<\/h3>\n

\nEn velkendt m\u00e5de at \"dr\u00e6be\" en proces p\u00e5 er at sende et SIGKILL-signal til processen. Gennem bash kan man kalde standard \"kill -SIGKILL PID\" eller \"pkill -9 NAME\" for at dr\u00e6be. Kommandoen \"kill\" har v\u00e6ret kendt siden UNIX-tiden og er tilg\u00e6ngelig ikke kun i macOS, men ogs\u00e5 p\u00e5 andre UNIX-lignende systemer.<\/p>\n

Ligesom i UNIX-lignende systemer tillader macOS at opfange alle signaler til processen bortset fra to - SIGKILL og SIGSTOP. Denne artikel vil prim\u00e6rt fokusere p\u00e5 SIGKILL-signalet, som er det signal, der medf\u00f8rer drab p\u00e5 processen.<\/p>\n

S\u00e6rligheder ved macOS
\n<\/h3>\n

\nI macOS kaldes systemopkaldet kill i XNU-kernen funktionen psignal(SIGKILL, …). Lad os se, hvilke andre brugerhandlinger i userspace der kan kalde funktionen psignal. Vi vil filtrere opkald til funktionen psignal i de interne mekanismer i kernen (selvom de kan v\u00e6re ikke-trivielle, s\u00e5 lad os gemme dem til en anden artikel \ud83d\ude42 \u2014 signaturkontrol, hukommelsesfejl, exit\/terminate behandling, overtr\u00e6delse af filbeskyttelse osv. <\/p>\n

Lad os begynde gennemgangen med funktionen og det relevante systemopkald terminate_with_payload<\/a><\/noindex>. Det ses, at der udover det klassiske kill-opkald ogs\u00e5 findes en alternativ tilgang, som er specifik for macOS og ikke findes i BSD. Principperne for begge systemopkald er ogs\u00e5 n\u00e6rt besl\u00e6gtede. De udg\u00f8r direkte kald til kernens psignal-funktion. Vi bem\u00e6rker ogs\u00e5, at der foretages en kontrol f\u00f8r drab p\u00e5 processen - \"cansignal\" - om processen kan sende et signal til en anden proces, systemet tillader ikke, at nogen applikationer dr\u00e6ber systemprocesser, for eksempel.<\/p>\n

static int\nterminate_with_payload_internal(struct proc *cur_proc, int target_pid, uint32_t reason_namespace,\n\t\t\t\tuint64_t reason_code, user_addr_t payload, uint32_t payload_size,\n\t\t\t\tuser_addr_t reason_string, uint64_t reason_flags)\n{\n...\n\ttarget_proc = proc_find(target_pid);\n...\n\tif (!cansignal(cur_proc, cur_cred, target_proc, SIGKILL)) {\n\t\tproc_rele(target_proc);\n\t\treturn EPERM;\n\t}\n...\n\tif (target_pid == cur_proc->p_pid) {\n\t\t\n\t\t\/*\n\t\t * psignal_thread_with_reason() vil pendere en SIGKILL til den angivne tr\u00e5d eller\n\t\t * returnere, hvis tr\u00e5den og\/eller opgaven allerede er under afslutning. Uanset hvad, vil den\n\t\t * aktuelle tr\u00e5d ikke vende tilbage til brugerrummet.\n\t\t *\/\n\t\tpsignal_thread_with_reason(target_proc, current_thread(), SIGKILL, signal_reason);\n\t} else {\n\t\tpsignal_with_reason(target_proc, SIGKILL, signal_reason);\n\t}\n...\n}\n<\/code><\/pre>\n
<\/p>\n
launchd<\/h3>\n
\nDen standardmetode til at skabe daemons ved systemstart og kontrollere deres levetid er launchd. Jeg vil bem\u00e6rke, at kildeteksterne er for den gamle version af launchctl f\u00f8r macOS 10.10, og kodeeksemplerne er givet som illustration. Den moderne launchctl sender signaler til launchd via XPC, og logikken for launchctl er blevet flyttet ind i dette.<\/p>\n
Lad os se p\u00e5, hvordan applikationer stoppes. Inden der sendes et SIGTERM-signal, fors\u00f8ges applikationen stoppet ved hj\u00e6lp af systemopkaldet \u201cproc_terminate\u201d.<\/p>\n
...\n\terror = proc_terminate(j->p, &sig);\n\tif (error) {\n\t\tjob_log(j, LOG_ERR | LOG_CONSOLE, \"Kunne ikke afslutte jobbet: %d: %s\", error, strerror(error));\n\t\tjob_log(j, LOG_NOTICE | LOG_CONSOLE, \"Bruger fallbackmulighed til at afslutte jobbet...\");\n\t\terror = kill2(j->p, SIGTERM);\n\t\tif (error) {\n\t\t\tjob_log(j, LOG_ERR, \"Kunne ikke signalisere jobbet: %d: %s\", error, strerror(error));\n\t\t} \n...\n<\/code><\/pre>\n
\nUnder motorhjelmen kan proc_terminate, p\u00e5 trods af sit navn, ikke kun sende psignal med SIGTERM, men ogs\u00e5 SIGKILL.<\/p>\n
Indirekte drab \u2014 ressourcebegr\u00e6nsning<\/h3>\n
\nEt mere interessant tilf\u00e6lde kan ses i et andet systemopkald process_policy<\/a><\/noindex>. Standardbrug af dette systemopkald er begr\u00e6nsninger p\u00e5 applikationsressourcer, f.eks. for en indeksator begr\u00e6nses det til en kvote for CPU-tid og hukommelse, s\u00e5 systemet ikke v\u00e6sentligt bremses af filcaching. Hvis applikationen n\u00e5r begr\u00e6nsningen af ressourcer, som man kan se fra funktionen proc_apply_resource_actions, sendes der et SIGKILL-signal til processen.<\/p>\n
Selvom dette systemopkald potentielt kan dr\u00e6be en proces, har systemet ikke korrekt kontrolleret rettighederne for den proces, der kalder systemopkaldet. Faktisk var kontrollen til stede<\/a><\/noindex>, men det er tilstr\u00e6kkeligt at bruge det alternative flag PROC_POLICY_ACTION_SET for at omg\u00e5 denne betingelse.<\/p>\n
Herfra, hvis man \"begr\u00e6nser\" CPU-brugsgr\u00e6nsen til applikationen (for eksempel kun tillader 1 ns at k\u00f8re), kan man dr\u00e6be enhver proces i systemet. P\u00e5 den m\u00e5de kan skadelig software dr\u00e6be enhver proces p\u00e5 systemet, inklusive antivirusprocessen. Effekten ved at dr\u00e6be processen med pid 1 (launchctl) er ogs\u00e5 interessant \u2014 kernel panic opst\u00e5r ved fors\u00f8get p\u00e5 at behandle SIGKILL-signal \ud83d\ude42<\/p>\n
\"Hvordan
\n<\/p>\n
Hvordan l\u00f8ser man problemet?<\/h3>\n
\nDen mest ligefremme m\u00e5de at forhindre drab p\u00e5 processer er at \u00e6ndre pegeren til funktionen i systemkaldtabellen. Desv\u00e6rre er denne metode ikke-trivial af mange \u00e5rsager<\/p>\n
For det f\u00f8rste er symbolet, der repr\u00e6senterer placeringen af sysent i hukommelsen, ikke kun et privat symbol i XNU-kernen, men kan heller ikke findes i kerne-symbolerne. Man m\u00e5 bruge heuristiske metoder til at finde det, for eksempel dynamisk disassembling af funktionen og lede efter pegeren i den.<\/p>\n
For det andet afh\u00e6nger strukturen af posterne i tabellen af de flag, som kernen er bygget med. Hvis flaget CONFIG_REQUIRES_U32_MUNGING er erkl\u00e6ret, \u00e6ndres st\u00f8rrelsen af strukturen \u2014 et ekstra felt tilf\u00f8jes sy_arg_munge32<\/a><\/noindex>. Der skal udf\u00f8res en ekstra kontrol af, hvilket flag kernen er kompileret med; alternativt kan pegerne til funktioner sammenlignes med kendte.<\/p>\n
struct sysent {         \n        \/* system call table *\/\n        sy_call_t       *sy_call;       \/* implementerende funktion *\/\n#if CONFIG_REQUIRES_U32_MUNGING || (__arm__ && (__BIGGEST_ALIGNMENT__ > 4))\n        sy_munge_t      *sy_arg_munge32; \/* system call arguments munger for 32-bit process *\/\n#endif\n        int32_t         sy_return_type; \/* system call return types *\/\n        int16_t         sy_narg;        \/* antal args *\/\n        uint16_t        sy_arg_bytes;   \/* Total st\u00f8rrelse af argumenter i bytes for\n                                         * 32-bit system calls\n                                         *\/\n};\n<\/code><\/pre>\n
\nHeldigvis leverer Apple i moderne versioner af macOS et nyt API til h\u00e5ndtering af processer. Endpoint Security API g\u00f8r det muligt for klienter at godkende mange anmodninger til andre processer. P\u00e5 den m\u00e5de kan man blokere for eventuelle signaler til processer, herunder SIGKILL-signalet ved hj\u00e6lp af det n\u00e6vnte API.<\/p>\n
#include <bsm\/libbsm.h>\n#include <EndpointSecurity\/EndpointSecurity.h>\n#include <unistd.h>\n\nint main(int argc, const char * argv[]) {\n    es_client_t* cli = nullptr;\n    {\n        auto res = es_new_client(&cli, ^(es_client_t * client, const es_message_t * message) {\n            switch (message->event_type) {\n                case ES_EVENT_TYPE_AUTH_SIGNAL:\n                {\n                    auto& msg = message->event.signal;\n                    auto target = msg.target;\n                    auto& token = target->audit_token;\n                    auto pid = audit_token_to_pid(token);\n                    printf("signal '%d' sent to pid '%d'n", msg.sig, pid);\n                    es_respond_auth_result(client, message, pid == getpid() ? ES_AUTH_RESULT_DENY : ES_AUTH_RESULT_ALLOW, false);\n                }\n                    break;\n                default:\n                    break;\n            }\n        });\n    }\n\n    {\n        es_event_type_t evs[] = { ES_EVENT_TYPE_AUTH_SIGNAL };\n        es_subscribe(cli, evs, sizeof(evs) \/ sizeof(*evs));\n    }\n\n    printf("%dn", getpid());\n    sleep(60); \/\/ could be replaced with other waiting primitive\n\n    es_unsubscribe_all(cli);\n    es_delete_client(cli);\n\n    return 0;\n}\n<\/code><\/pre>\n
\nTilsvarende kan man registrere en MAC Policy i kernen, som giver en metode til beskyttelse mod signaler (policy proc_check_signal), men API'et underst\u00f8ttes ikke officielt.<\/p>\n
Kerneudvidelsesbeskyttelse<\/h3>\n
\nUdover at beskytte processerne i systemet er det ogs\u00e5 n\u00f8dvendigt at beskytte selve kernetilf\u00f8jelsen (kext). macOS tilbyder udviklerne et framework til nem udvikling af enhedsdrivere kaldet IOKit. Udover at give muligheder for at arbejde med enheder, tilbyder IOKit metoder til driverstabling (driver stacking) via instanser af C++ klasser. Applikationen i userspace vil kunne \"finde\" den registrerede klasseinstans for at etablere forbindelse mellem kernel og userspace.<\/p>\n
Til at registrere antallet af klasseinstanser i systemet findes v\u00e6rkt\u00f8jet ioclasscount.<\/p>\n
my_kext_ioservice = 1\nmy_kext_iouserclient = 1\n<\/code><\/pre>\n
\nEnhver kernetilf\u00f8jelse, der \u00f8nsker at registrere sig i driverstakken, skal erkl\u00e6re en klasse, som er arvet fra IOService; for eksempel my_kext_ioservice i dette tilf\u00e6lde. Tilslutningen af brugerapplikationer medf\u00f8rer oprettelse af en ny klasseinstans, der er arvet fra IOUserClient, i eksemplet my_kext_iouserclient.<\/p>\n
N\u00e5r man fors\u00f8ger at afbryde driveren fra systemet (kommandoen kextunload), kaldes den virtuelle funktion \u201cbool terminate(IOOptionBits options)\u201d. Det er tilstr\u00e6kkeligt at returnere false ved kaldet af funktionen terminate, n\u00e5r man fors\u00f8ger at afbryde, for at forbyde kextunload.<\/p>\n
bool Kext::terminate(IOOptionBits options)\n{\n\n  if (!IsUnloadAllowed)\n  {\n    \/\/ Afladning er ikke tilladt, returnerer false\n    return false;\n  }\n\n  return super::terminate(options);\n}\n\n<\/code><\/pre>\n
\nFlaget IsUnloadAllowed kan s\u00e6ttes af IOUserClient ved indl\u00e6sning. Hvis afladning begr\u00e6nses, vil kommandoen kextunload returnere f\u00f8lgende output:<\/p>\n
admin@admins-Mac drivermanager % sudo kextunload .\/test.kext\nAdgangskode:\n(kernel) Kan ikke fjerne kext my.kext.test; tjenester kunne ikke afsluttes - 0xe00002c7.\nFejl efter afladning af my.kext.test - (iokit\/common) unsupported function.\n<\/code><\/pre>\n
\nEn lignende beskyttelse skal ogs\u00e5 implementeres for IOUserClient. Klasseinstanser kan aflades ved hj\u00e6lp af userspace funktionen IOKitLib \u201cIOCatalogueTerminate(mach_port_t, uint32_t flag, io_name_t description);\u201d. Man kan returnere false ved kaldet af kommandoen \u201cterminate\u201d, s\u00e5 l\u00e6nge userspace-applikationen ikke \u201cd\u00f8r\u201d, det vil sige ikke kalder funktionen \u201cclientDied\u201d.<\/p>\n
Beskyttelse af filer<\/h3>\n
\nFor file protection, it is sufficient to use the Kauth API, which allows restricting access to files. Apple provides developers with notifications about various events in the scope, and for us, operations KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA, and KAUTH_VNODE_DELETE_CHILD are important. The easiest way to restrict access to files is by path \u2014 we use the API 'vn_getpath' to obtain the path to the file and compare the prefix of the path. Note that to optimize the renaming of folder paths containing files, the system does not authorize access to each file but only to the folder that has been renamed. It is necessary to compare the parent path and restrict KAUTH_VNODE_DELETE for it.<\/p>\n
\"Hvordan
\n
\nA drawback of this approach may be low performance as the number of prefixes increases. To avoid the comparison being O(prefix*length), where prefix is the number of prefixes and length is the string length, a deterministic finite automaton (DFA) constructed from the prefixes can be used. <\/p>\n
Let us consider the method of constructing a DFA for this set of prefixes. We initialize cursors at the beginning of each prefix. If all cursors point to the same character, we increase each cursor by one character and remember that the length of the matching string increases by one. If there are two cursors with different characters, we will divide the cursors into groups based on the character they point to and repeat the algorithm for each group.<\/p>\n
In the first case (when all characters under the cursors are the same), we obtain a DFA state that has only one transition based on the matching string. In the second case, we get a transition table of size 256 (the number of characters and the maximum number of groups) for the subsequent states obtained through a recursive function call.<\/p>\n
Let us consider an example. For the set of prefixes ('\\\/foo\\\/bar\\\/tmp\\\/', '\\\/var\\\/db\\\/foo\\\/', '\\\/foo\\\/bar\\\/aba\\\/', 'foo\\\/bar\\\/aac\\\/'), we can obtain the following DFA. The illustration only shows transitions leading to other states; other transitions will not be terminal.<\/p>\n
\"Hvordan
\n
\nWhen traversing through the states of the DFA, there can be 3 cases.<\/p>\n
    \n
  1. The final state has been reached \u2014 the path is protected, restricting operations KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA, and KAUTH_VNODE_DELETE_CHILD.<\/li>\n
  2. Den endelige tilstand blev ikke n\u00e5et, men stien \"sluttede\" (nul-terminator n\u00e5et) \u2014 stien er parent, KAUTH_VNODE_DELETE skal begr\u00e6nses. Bem\u00e6rk, at hvis vnode er en mappe, skal der tilf\u00f8jes \u2018\/\u2019 til slutningen; ellers kan man begr\u00e6nse til filen \u201c\/foor\/bar\/t\u201d, hvilket er forkert.<\/li>\n
  3. Den endelige tilstand blev ikke n\u00e5et, stien sluttede ikke. Ingen af pr\u00e6fikserne matcher her, vi indf\u00f8rer ingen begr\u00e6nsninger.<\/li>\n<\/ol>\n
    <\/p>\n
    Konklusion<\/h3>\n
    \nM\u00e5let med de udviklede sikkerhedsl\u00f8sninger er at \u00f8ge sikkerhedsniveauet for brugeren og deres data. P\u00e5 den ene side opn\u00e5s dette m\u00e5l gennem udviklingen af Acronis-produktet, som lukker de s\u00e5rbarheder, hvor selve styresystemet er \"svagt\". P\u00e5 den anden side m\u00e5 man ikke fors\u00f8mme at styrke de sikkerhedsaspekter, der kan forbedres p\u00e5 OS-siden, is\u00e6r da lukkede s\u00e5rbarheder \u00f8ger vores egen modstandsdygtighed som produkt. S\u00e5rbarheden blev rapporteret af Apple Product Security Team og blev rettet i macOS 10.14.5 (https:\/\/support.apple.com\/en-gb\/HT210119).<\/p>\n
    \"Hvordan
    \n
    \nAlt dette kan kun g\u00f8res, hvis dit v\u00e6rkt\u00f8j blev officielt installeret i kernen. Det vil sige, at der ikke er nogen omveje for eksterne og u\u00f8nskede programmer. Men som du kan se, kr\u00e6ver det endda lidt arbejde at beskytte legitime programmer s\u00e5som antivirus og backup-systemer. Men til geng\u00e6ld vil de nye Acronis-produkter til macOS nu have ekstra beskyttelse mod at blive udskudt fra systemet.
    \n
    Kilde: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5dan beskytter du processer og kernemoduler i macOS | ProHoster","description":"Hej, Habr! I dag vil jeg gerne tale om, hvordan man kan beskytte processer mod angreb fra ondsindede akt\u00f8rer i macOS.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430 \u0432 macOS | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T23:42:32+00:00","article:modified_time":"2020-04-19T23:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78514","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:56:36","updated":"2022-09-28 22:19:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/78514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=78514"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/78514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/78515"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=78514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=78514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=78514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}