{"id":78514,"date":"2020-04-20T01:42:32","date_gmt":"2020-04-19T23:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos"},"modified":"2020-04-20T01:42:32","modified_gmt":"2020-04-19T23:42:32","slug":"kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","title":{"rendered":"Kuidas kaitsta protsesse ja kernelilaiendeid macOS-is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere, Habr! T\u00e4na soovin r\u00e4\u00e4kida sellest, kuidas kaitsta protsesse k\u00fcberkurjategijate r\u00fcnnakute eest macOS-is. See on eriti oluline viiruset\u00f5rje v\u00f5i varunduss\u00fcsteemi jaoks, arvestades, et macOS-is on mitmeid v\u00f5imalusi protsessi \"tapmiseks\". Selle ja kaitsemeetodite kohta loe allpool.<\/p>\n

\"Kuidas<\/a><\/noindex>
\n<\/a><\/noindex><\/p>\n

Klassikaline viis protsessi \"tapmiseks\"<\/h3>\n

\nK\u00f5igile tuntud viis protsessi \"tapmiseks\" on saata SIGKILL signaal protsessile. Bash'i kaudu v\u00f5ib kasutada standardseid k\u00e4ske \"kill -SIGKILL PID\" v\u00f5i \"pkill -9 NAME\" tapmiseks. K\u00e4sk \"kill\" on tuntud juba UNIX-i aegadest ja on saadaval mitte ainult macOS-is, vaid ka teistes UNIX-taolistes s\u00fcsteemides.<\/p>\n

Nii nagu UNIX-taolistes s\u00fcsteemides, v\u00f5imaldab macOS salvestada k\u00f5ik protsessile saadetud signaalid, v\u00e4lja arvatud kaks \u2014 SIGKILL ja SIGSTOP. Selles artiklis k\u00e4sitletakse peamiselt SIGKILL signaali, mis p\u00f5hjustab protsessi tapmise.<\/p>\n

macOS-i spetsiifika
\n<\/h3>\n

\nmacOS-is kutses\u00fcsteemi kutse kill XNU tuumas kutsub esile funktsiooni psignal(SIGKILL,...). Vaatame, milliseid kasutaja toiminguid userspace'is v\u00f5ib funktsioon psignal kutsuda. J\u00e4tame k\u00f5rvale psignali kutseid tuuma sisemistes mehhanismides (kuigi need v\u00f5ivad olla keerulised, aga j\u00e4tame need teise artikli jaoks \ud83d\ude42 \u2014 allkirja kontroll, m\u00e4luvead, exit\/terminate t\u00f6\u00f6tlemine, failide kaitse rikkumised jne. <\/p>\n

Alustame \u00fclevaadet funktsiooni ja vastava s\u00fcsteemi kutsega terminate_with_payload<\/a><\/noindex>. N\u00e4ha on, et lisaks klassikalisele kill kutsele on olemas alternatiivne l\u00e4henemine, mis on spetsiifiline macOS operatsioonis\u00fcsteemile ja ei esine BSD-s. M\u00f5lema s\u00fcsteemi kutse t\u00f6\u00f6p\u00f5him\u00f5tted on samuti sarnased. Need on otsesed kutsed psignal tuumafunktsioonile. Samuti tasub m\u00e4rkida, et enne protsessi tapmist tehakse kontroll \u201ccansignal\u201d \u2014 kas protsess saab saata signaali teisele protsessile, s\u00fcsteem ei lase \u00fcksk\u00f5ik millisel rakendusel tappa s\u00fcsteemiprotsesse n\u00e4iteks.<\/p>\n

static int\nterminate_with_payload_internal(struct proc *cur_proc, int target_pid, uint32_t reason_namespace,\n\t\t\t\tuint64_t reason_code, user_addr_t payload, uint32_t payload_size,\n\t\t\t\tuser_addr_t reason_string, uint64_t reason_flags)\n{\n...\n\ttarget_proc = proc_find(target_pid);\n...\n\tif (!cansignal(cur_proc, cur_cred, target_proc, SIGKILL)) {\n\t\tproc_rele(target_proc);\n\t\treturn EPERM;\n\t}\n...\n\tif (target_pid == cur_proc->p_pid) {\n\t\t\/*\n\t\t * psignal_thread_with_reason() will pend a SIGKILL on the specified thread or\n\t\t * return if the thread and\/or task are already terminating. Either way, the\n\t\t * current thread won't return to userspace.\n\t\t *\/\n\t\tpsignal_thread_with_reason(target_proc, current_thread(), SIGKILL, signal_reason);\n\t} else {\n\t\tpsignal_with_reason(target_proc, SIGKILL, signal_reason);\n\t}\n...\n}\n<\/code><\/pre>\n
<\/p>\n
launchd<\/h3>\n
\nTavaline viis s\u00fcsteemide k\u00e4ivitamiseks ja nende eluaja kontrollimiseks on launchd. Tahan r\u00f5hutada, et allpool toodud koodin\u00e4idised on vanema versiooni launchctl'i jaoks enne macOS 10.10, ja need on esitatud illustratiivse n\u00e4itena. Kaasaegne launchctl saadab k\u00e4sklusi launchd'le l\u00e4bi XPC, ning launchctl'i loogika on sinna \u00fcle viidud.<\/p>\n
Vaatame, kuidas rakenduste peatamine tegelikult toimub. Enne SIGTERM signaali saatmist \u00fcritatakse rakendust peatada s\u00fcsteemikutsungi \u201cproc_terminate\u201d abil.<\/p>\n
...\n\terror = proc_terminate(j->p, &sig);\n\tif (error) {\n\t\tjob_log(j, LOG_ERR | LOG_CONSOLE, \"T\u00f6\u00f6 katkestamine eba\u00f5nnestus: %d: %s\", error, strerror(error));\n\t\tjob_log(j, LOG_NOTICE | LOG_CONSOLE, \"Kasutame varuv\u00f5imalust t\u00f6\u00f6 katkestamiseks...\");\n\t\terror = kill2(j->p, SIGTERM);\n\t\tif (error) {\n\t\t\tjob_log(j, LOG_ERR, \"T\u00f6\u00f6 signaalimine eba\u00f5nnestus: %d: %s\", error, strerror(error));\n\t\t} \n...\n<\/code><\/pre>\n
\nKuigi proc_terminate on selline nimi, v\u00f5ib see saata mitte ainult psignale SIGTERM, vaid ka SIGKILL.<\/p>\n
Kaudne tapmine \u2014 ressursipiirangud<\/h3>\n
\nTeise s\u00fcsteemi s\u00fcsteemikutsungi huvitavam juhtum process_policy<\/a><\/noindex>. Selle s\u00fcsteemikutsungi tavaline kasutus on rakenduste ressursipiirangud, n\u00e4iteks indeksija protsessori aja ja m\u00e4lu kvota piiramine, et s\u00fcsteem ei aeglustuks oluliselt faili vahem\u00e4lu toimingutest. Kui rakendus saavutab ressursipiirangu, nagu n\u00e4htav funktsioonis proc_apply_resource_actions, saadetakse protsessile SIGKILL signaal.<\/p>\n
Kuigi see s\u00fcsteemikutsung v\u00f5ib potentsiaalselt protsessi tappa, ei kontrollinud s\u00fcsteem t\u00f5husalt protsessi \u00f5igusi, mis s\u00fcsteemikutsungit kutsus. Tegelikult kontroll oli olemas<\/a><\/noindex>, kuid piisab alternatiivse flagi PROC_POLICY_ACTION_SET kasutamisest selle tingimuse m\u00f6\u00f6daminekuks.<\/p>\n
Siit, kui piirata CPU kasutuskvooti rakenduse poolt (n\u00e4iteks lubada t\u00f6\u00f6tada ainult 1 ns), siis saab tappa \u00fcksk\u00f5ik millise protsessi s\u00fcsteemis. Nii v\u00f5ib pahatahtlik programm tappa \u00fcksk\u00f5ik millise protsessi, sealhulgas ka viiruset\u00f5rje protsessi. Samuti on huvitav efekt, mis tekib protsessi tapmisel, mille pid on 1 (launchctl) \u2014 kernel panic, kui proovida t\u00f6\u00f6delda signaali SIGKILL \ud83d\ude42.<\/p>\n
\"Kuidas
\n<\/p>\n
Kuidas probleemi lahendada?<\/h3>\n
\nOtsem viis protsessi tapmise keelamiseks on asendada viitamine funktsioonile s\u00fcsteemikutsungite tabelis. Kahjuks on see meetod paljuski keeruline erinevatel p\u00f5hjustel.<\/p>\n
Esiteks, s\u00fcmbol, mis vastutab sysent'i asukoha eest m\u00e4lu, ei ole mitte ainult XNU tuuma eraldi s\u00fcmbol, vaid seda ei saa ka leida tuuma s\u00fcmbolitest. Peab kasutama heuristika meetodeid otsimiseks, nagu d\u00fcnaamiline disassembli funktsioon ja viitamise otsimine selles.<\/p>\n
Teiseks, tabeli kirje struktuur s\u00f5ltub lippudest, millega tuum on kokku pandud. Kui lipp CONFIG_REQUIRES_U32_MUNGING on deklareeritud, siis struktuuri suurust muudetakse \u2013 lisatakse t\u00e4iendav v\u00e4li. sy_arg_munge32<\/a><\/noindex>. On oluline teha t\u00e4iendav kontroll, millise lipuga tuum on kompileeritud, n\u00e4iteks v\u00f5rrelda funktsioonide silte tuntud v\u00e4\u00e4rtustega.<\/p>\n
struct sysent {         \/* s\u00fcsteemi k\u00f5ne tabel *\/\n        sy_call_t       *sy_call;       \/* teostav funktsioon *\/\n#if CONFIG_REQUIRES_U32_MUNGING || (__arm__ && (__BIGGEST_ALIGNMENT__ > 4))\n        sy_munge_t      *sy_arg_munge32; \/* s\u00fcsteemi k\u00f5ne argumendi muutja 32-bitiste protsesside jaoks *\/\n#endif\n        int32_t         sy_return_type; \/* s\u00fcsteemi k\u00f5ne tagastamise t\u00fc\u00fcbid *\/\n        int16_t         sy_narg;        \/* argumendi arv *\/\n        uint16_t        sy_arg_bytes;   \/* Argumendi kogusumma baitides 32-bitiste s\u00fcsteemi k\u00f5nede jaoks *\/\n};\n<\/code><\/pre>\n
\n\u00d5nneks pakub Apple kaasaegsetes macOS versioonides uut API-d, mis v\u00f5imaldab t\u00f6\u00f6tada protsessidega. Endpoint Security API v\u00f5imaldab klientidel autoriseerida paljusid p\u00e4ringuid teistele protsessidele. Nii saab blokeerida mis tahes signaalid protsessidele, sealhulgas signaali SIGKILL eelnevalt mainitud API abil.<\/p>\n
#include <bsm\/libbsm.h>\n#include <EndpointSecurity\/EndpointSecurity.h>\n#include <unistd.h>\n\nint main(int argc, const char * argv[]) {\n    es_client_t* cli = nullptr;\n    {\n        auto res = es_new_client(&cli, ^(es_client_t * client, const es_message_t * message) {\n            switch (message->event_type) {\n                case ES_EVENT_TYPE_AUTH_SIGNAL:\n                {\n                    auto& msg = message->event.signal;\n                    auto target = msg.target;\n                    auto& token = target->audit_token;\n                    auto pid = audit_token_to_pid(token);\n                    printf("signal '%d' sent to pid '%d'n", msg.sig, pid);\n                    es_respond_auth_result(client, message, pid == getpid() ? ES_AUTH_RESULT_DENY : ES_AUTH_RESULT_ALLOW, false);\n                }\n                    break;\n                default:\n                    break;\n            }\n        });\n    }\n\n    {\n        es_event_type_t evs[] = { ES_EVENT_TYPE_AUTH_SIGNAL };\n        es_subscribe(cli, evs, sizeof(evs) \/ sizeof(*evs));\n    }\n\n    printf("%dn", getpid());\n    sleep(60); \/\/ could be replaced with other waiting primitive\n\n    es_unsubscribe_all(cli);\n    es_delete_client(cli);\n\n    return 0;\n}\n<\/code><\/pre>\n
\nSarnaselt saab tuumas registreerida MAC-poliitika, mis pakub signaalide kaitse meetodit (poliitika proc_check_signal), kuid API-d ei toetata ametlikult.<\/p>\n
Tuuma laienduse kaitse<\/h3>\n
\nLisaks s\u00fcsteemi protsesside kaitsmisele on h\u00e4davajalik kaitsta ka tuuma laiendust (kext). macOS pakub arendajatele raamistikku IOKit, mis lihtsustab seadmejuhtide arendamist. Lisaks seadmete k\u00e4sitlemise vahenditele tagab IOKit ka draiverite \u00fchendamise (driver stacking) meetodid C++ klasside eksemplaride abil. Kasutusrikkes rakendus suudab \u201eleida\u201d registreeritud klassi eksemplari kernel-userspace'i \u00fchendamiseks.<\/p>\n
S\u00fcsteemis klasside eksemplaride arvu avastamiseks on olemas utiliit ioclasscount.<\/p>\n
my_kext_ioservice = 1\nmy_kext_iouserclient = 1\n<\/code><\/pre>\n
\nIga tuuma laiendus, mis soovib registreerida end draiverite kihis, peab kuulutama klassi, mis on p\u00e4rinud IOService'ist, n\u00e4iteks antud juhul my_kext_ioservice. Kasutajarakenduste \u00fchendamine kutsub esile uue klassi eksemplari loomise, mis p\u00e4randub IOUserClient'ist, n\u00e4ites my_kext_iouserclient.<\/p>\n
Kui proovite draiverit s\u00fcsteemist eemaldada (k\u00e4sk kextunload), kutsutakse virtuaalne funktsioon \"bool terminate(IOOptionBits options)\". Piisab, kui tagastada false terminate-funktsiooni kutsel, et keelata kextunload.<\/p>\n
bool Kext::terminate(IOOptionBits options)\n{\n\n  if (!IsUnloadAllowed)\n  {\n    \/\/ Eemaldamine ei ole lubatud, tagastame false\n    return false;\n  }\n\n  return super::terminate(options);\n}\n\n<\/code><\/pre>\n
\nLipp IsUnloadAllowed v\u00f5ib olla m\u00e4\u00e4ratud IOUserClienti laadimise ajal. Kui laadimine on piiratud, tagastab k\u00e4sk kextunload j\u00e4rgmise v\u00e4ljundi:<\/p>\n
admin@admins-Mac drivermanager % sudo kextunload .\/test.kext\nParool:\n(kernel) Ei saa eemaldada kext my.kext.test; teenused ei suutnud l\u00f5petada - 0xe00002c7.\nEi \u00f5nnestunud eemaldada my.kext.test - (iokit\/common) toetamatud funktsioon.\n<\/code><\/pre>\n
\nSarnane kaitse tuleb rakendada ka IOUserClientile. Klasside eksemplarid saab eemaldada userspace-funktsiooni IOKitLib \"IOCatalogueTerminate(mach_port_t, uint32_t flag, io_name_t description);\" abil. Saate tagastada false \"terminate\"-k\u00e4skluse kutsel, kuni userspace-rakendus ei \"sure\", st kuni kutse \"clientDied\" ei toimu.<\/p>\n
Failide kaitse<\/h3>\n
\nFailide kaitsmiseks piisab Kauth API kasutamisest, mis v\u00f5imaldab piirata juurdep\u00e4\u00e4su failidele. Apple annab arendajatele teateid erinevate s\u00fcndmuste kohta scopis; meie jaoks on olulised operatsioonid KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA ja KAUTH_VNODE_DELETE_CHILD. Failide juurdep\u00e4\u00e4su piiramine on k\u00f5ige lihtsam tee alusel \u2014 kasutame API-d \"vn_getpath\" failitee saamiseks ja teostame tee prefiksi v\u00f5rdlemise. Tuleb m\u00e4rkida, et s\u00fcsteem ei autoriseeri ligip\u00e4\u00e4su iga failile folderitega, vaid ainult nimetatavale kaustale, mille nime on muudetud. Tuleb v\u00f5rrelda vanemat teed ja piirata KAUTH_VNODE_DELETE selle puhul.<\/p>\n
\"Kuidas
\n
\nSelle l\u00e4henemise miinuseks v\u00f5ib olla madal j\u00f5udlus, kui prefiksite arv suureneb. Et v\u00f5rrelda ei oleks O(prefix*length), kus prefix on prefiksite arv ja length on stringi pikkus, v\u00f5ib kasutada prefiksitele p\u00f5hinevat deterministlikku l\u00f5ppautomaat (DFA). <\/p>\n
Vaadakem, kuidas ehitada DKA antud eess\u00f5nade komplektile. Algatame kursorid igas eess\u00f5nas algusesse. Kui k\u00f5ik kursorid osutavad samale s\u00fcmbolile, siis suurendame iga kursori \u00fche s\u00fcmboli v\u00f5rra ja m\u00e4letame, et sama rea pikkus on suurem \u00fche v\u00f5rra. Kui on olemas kaks kursorit, mille all olevad s\u00fcmbolid erinevad, jagame kursorid r\u00fchmadesse s\u00fcmboli j\u00e4rgi, millele nad osutavad, ja kordame algoritmi iga r\u00fchma jaoks.<\/p>\n
Esimesel juhul (kui k\u00f5ik kursorite all olevad s\u00fcmbolid on samad) saame DKA oleku, millel on ainult \u00fcks \u00fcleminek sama rea j\u00e4rgi. Teisel juhul saame \u00fcleminekute tabeli suurusega 256 (s\u00fcmbolite arv ja maksimaalne r\u00fchmade arv) j\u00e4rgmistele olekutele, mis saadakse funktsiooni rekursiivse v\u00e4ljakutse k\u00e4igus.<\/p>\n
Vaatleme n\u00e4idet. Eess\u00f5nade komplekti jaoks (\"\/foo\/bar\/tmp\/\", \"\/var\/db\/foo\/\", \"\/foo\/bar\/aba\/\", \"foo\/bar\/aac\/\") saab luua j\u00e4rgmise DKA. Joonisel on n\u00e4idatud ainult \u00fcleminekud, mis viivad teistesse olekutesse, teised \u00fcleminekud ei ole l\u00f5ppstaadiumid.<\/p>\n
\"Kuidas
\n
\nDKA olekutes liikudes v\u00f5ib esineda 3 olukorda.<\/p>\n
    \n
  1. L\u00f5pufaasi on saavutatud \u2014 tee on kaitstud, piirates KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA ja KAUTH_VNODE_DELETE_CHILD operatsioone.<\/li>\n
  2. L\u00f5pufaasi ei ole saavutatud, kuid tee \"l\u00f5ppes\" (null-terminaator saavutati) \u2014 tee on vanem, KAUTH_VNODE_DELETE tuleb piirata. T\u00f5note, et kui vnode on kaust, tuleb l\u00f5ppu lisada \u2018\/\u2019, vastasel juhul v\u00f5ib piirata faili \u201c\/foor\/bar\/t\u201d, mis on vale.<\/li>\n
  3. L\u00f5pufaasi ei ole saavutatud, tee ei ole l\u00f5ppenud. \u00dckski eelm\u00e4ng ei vasta antud, piiranguid ei kehtestata.<\/li>\n<\/ol>\n
    <\/p>\n
    Kokkuv\u00f5te<\/h3>\n
    \nArendatavatele turvalahendustele on seatud eesm\u00e4rgiks kasutajate ja nende andmete turvalisuse taseme t\u00f5stmine. Esiteks saavutatakse see Acronise tarkvara arendamise kaudu, mis katab neid haavatavusi, kus operatsioonis\u00fcsteem ise on \u00abn\u00f5rk\u00bb. Teiseks ei tohiks unustada ka OS-poolsete turvalisuse aspektide tugevdamist, eriti kuna selliste haavatavuste sulgemine suurendab meie toote enda vastupidavust. Haavatavusest teatas Apple Product Security Team ning see parandati macOS 10.14.5 versioonis (https:\/\/support.apple.com\/en-gb\/HT210119).<\/p>\n
    \"Kuidas
    \n
    \nSeda saab teha ainult juhul, kui teie utiliit on ametlikult installitud tuumasse. See t\u00e4hendab, et v\u00e4lise ja soovimatu tarkvara jaoks pole selliseid k\u00f5rvalteid. Kuid, nagu n\u00e4ete, tuleb isegi legitiimsete programmide, nagu viiruset\u00f5rje ja varunduss\u00fcsteem, kaitsmiseks palju vaeva n\u00e4ha. Kuid n\u00fc\u00fcd saavad uued Acronise tooted macOS-i jaoks lisakaitse s\u00fcsteemist v\u00e4ljakandmise eest.
    \n
    Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Kuidas kaitsta protsesse ja tuuma laiendusi macOS-is | ProHoster","description":"Tere, Habr! T\u00e4na soovin r\u00e4\u00e4kida, kuidas kaitsta protsesse pahatahtlike r\u00fcnnakute eest macOS-is. See on eriti kasulik viiruset\u00f5rje v\u00f5i varunduss\u00fcsteemide puhul, arvestades, et macOS-is on mitmeid viise protsessi \"tappa\". Selle ja kaitsemeetodite kohta lugege allpool.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430 \u0432 macOS | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T23:42:32+00:00","article:modified_time":"2020-04-19T23:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78514","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:56:36","updated":"2022-09-28 22:19:40"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=78514"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/78515"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=78514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=78514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=78514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}