{"id":78514,"date":"2020-04-20T01:42:32","date_gmt":"2020-04-19T23:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos"},"modified":"2020-04-20T01:42:32","modified_gmt":"2020-04-19T23:42:32","slug":"kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","title":{"rendered":"Cum s\u0103 protej\u0103m procesele \u0219i extensiile nucleului \u00een macOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bun\u0103, Habr! Ast\u0103zi a\u0219 dori s\u0103 discut despre cum putem proteja procesele de atacurile infractorilor \u00een macOS. De exemplu, acest lucru este util pentru un antivirus sau un sistem de backup, mai ales av\u00e2nd \u00een vedere c\u0103 \u00een macOS exist\u0103 mai multe modalit\u0103\u021bi de a \u201eomoara\u201d un proces. Citi\u021bi despre asta \u0219i metodele de protec\u021bie \u00een continuare.<\/p>\n

\"Cum<\/a><\/noindex>
\n<\/a><\/noindex><\/p>\n

Metoda clasic\u0103 de a \u201eomoara\u201d un proces<\/h3>\n

\nMetoda cunoscut\u0103 de a \u201eomoara\u201d un proces este s\u0103 trimite\u021bi un semnal SIGKILL procesului. Prin bash, pute\u021bi apela comenzile standard \u201ekill -SIGKILL PID\u201d sau \u201epkill -9 NAME\u201d pentru a-l elimina. Comanda \u201ekill\u201d este cunoscut\u0103 \u00eenc\u0103 din vremurile UNIX \u0219i este disponibil\u0103 nu doar \u00een macOS, ci \u0219i \u00een alte sisteme de tip UNIX.<\/p>\n

La fel ca \u00een sistemele UNIX-like, macOS permite interceptarea oric\u0103rui semnal c\u0103tre un proces, cu dou\u0103 excep\u021bii \u2014 SIGKILL \u0219i SIGSTOP. \u00cen aceast\u0103 articol\u0103, vom examina \u00een principal semnalul SIGKILL, ca semnal care ini\u021biaz\u0103 eliminarea procesului.<\/p>\n

Specifica\u021biile macOS
\n<\/h3>\n

\n\u00cen macOS, apelul de sistem kill \u00een nucleul XNU apeleaz\u0103 func\u021bia psignal(SIGKILL,\u2026). S\u0103 vedem ce alte ac\u021biuni ale utilizatorului \u00een userspace pot apela func\u021bia psignal. Vom exclude apelurile func\u021biei psignal \u00een mecanismele interne ale nucleului (de\u0219i acestea pot fi non-triviale, le vom l\u0103sa pentru un alt articol \ud83d\ude42 \u2014 verificarea semn\u0103turii, erori de memorie, procesarea exit\/terminate, violarea protec\u021biei fi\u0219ierelor etc. <\/p>\n

Vom \u00eencepe recenzia cu func\u021bia \u0219i apelul de sistem corespunz\u0103tor terminate_with_payload<\/a><\/noindex>. Se observ\u0103 c\u0103, pe l\u00e2ng\u0103 apelul clasic kill, exist\u0103 o abordare alternativ\u0103, care este specific\u0103 sistemului de operare macOS \u0219i nu \u00eent\u00e2lnit\u0103 \u00een BSD. Principiile de func\u021bionare ale ambelor apeluri de sistem sunt, de asemenea, apropiate. Acestea reprezint\u0103 apeluri directe ale func\u021biei nucleului psignal. De asemenea, observ\u0103m c\u0103 \u00eenainte de a omor\u00ee un proces se efectueaz\u0103 o verificare \u201ecansignal\u201d \u2013 poate procesul s\u0103 trimit\u0103 un semnal c\u0103tre alt proces, sistemul nu permite oric\u0103rei aplica\u021bii s\u0103 omoare procesele de sistem, de exemplu.<\/p>\n

static int\nterminate_with_payload_internal(struct proc *cur_proc, int target_pid, uint32_t reason_namespace,\n\t\t\t\tuint64_t reason_code, user_addr_t payload, uint32_t payload_size,\n\t\t\t\tuser_addr_t reason_string, uint64_t reason_flags)\n{\n...\n\ttarget_proc = proc_find(target_pid);\n...\n\tif (!cansignal(cur_proc, cur_cred, target_proc, SIGKILL)) {\n\t\tproc_rele(target_proc);\n\t\treturn EPERM;\n\t}\n...\n\tif (target_pid == cur_proc->p_pid) {\n\t\t\n\t\t\/*\n\t\t * psignal_thread_with_reason() va p\u0103r\u0103si un SIGKILL pe firul specificat sau\n\t\t * va returna dac\u0103 firul \u0219i\/sau sarcina sunt deja \u00een proces de terminare. \u00cen orice caz, firul\n\t\t * curent nu se va \u00eentoarce \u00een utilizator.\n\t\t * *\/\n\t\tpsignal_thread_with_reason(target_proc, current_thread(), SIGKILL, signal_reason);\n\t} else {\n\t\tpsignal_with_reason(target_proc, SIGKILL, signal_reason);\n\t}\n...\n}\n<\/code><\/pre>\n
<\/p>\n
launchd<\/h3>\n
\nMetoda standard de a crea demoni la pornirea sistemului \u0219i de a controla timpul lor de via\u021b\u0103 este launchd. Voi sublinia c\u0103 sursele prezentate sunt pentru o versiune veche de launchctl, \u00eenainte de macOS 10.10, exemplele de cod fiind oferite ca ilustra\u021bie. Launchctl-ul modern trimite semnalele launchd prin XPC, iar logica launchctl a fost mutat\u0103 \u00een acesta.<\/p>\n
S\u0103 analiz\u0103m cum se opresc aplica\u021biile. \u00cenainte de a trimite semnalul SIGTERM, aplica\u021bia este \u00eencercat\u0103 s\u0103 fie oprit\u0103 prin apelul de sistem \u201eproc_terminate\u201d.<\/p>\n
...\n\terror = proc_terminate(j->p, &sig);\n\tif (error) {\n\t\tjob_log(j, LOG_ERR | LOG_CONSOLE, \"Could not terminate job: %d: %s\", error, strerror(error));\n\t\tjob_log(j, LOG_NOTICE | LOG_CONSOLE, \"Using fallback option to terminate job...\");\n\t\terror = kill2(j->p, SIGTERM);\n\t\tif (error) {\n\t\t\tjob_log(j, LOG_ERR, \"Could not signal job: %d: %s\", error, strerror(error));\n\t\t} \n...\n<\/code><\/pre>\n
\nSub capot\u0103, proc_terminate, \u00een ciuda numelui s\u0103u, poate trimite nu doar psignal cu SIGTERM, ci \u0219i SIGKILL.<\/p>\n
Uciderea indirect\u0103 \u2014 restric\u021bii privind resursele<\/h3>\n
\nO situa\u021bie mai interesant\u0103 poate fi observat\u0103 \u00eentr-un alt apel de sistem process_policy<\/a><\/noindex>. Utilizarea standard a acestui apel de sistem este restric\u021bionarea resurselor aplica\u021biilor, de exemplu, pentru un indexer restric\u021bionarea la cotele de timp de procesor \u0219i memorie, pentru a evita \u00eencetinirea semnificativ\u0103 a sistemului datorit\u0103 ac\u021biunilor de stocare a fi\u0219ierelor. Dac\u0103 aplica\u021bia a atins limita resurselor, a\u0219a cum se poate observa din func\u021bia proc_apply_resource_actions, procesului i se trimite semnalul SIGKILL.<\/p>\n
\u00cen ciuda faptului c\u0103 acest apel de sistem poate produce poten\u021bial uciderea unui proces, sistemul nu verifica adecvat drepturile procesului care efectueaz\u0103 apelul de sistem. \u00cen realitate, verificarea exista<\/a><\/noindex>, dar este suficient s\u0103 folose\u0219ti un flag alternativ PROC_POLICY_ACTION_SET pentru a o ocoli.<\/p>\n
De aici, dac\u0103 \u201erestric\u021bion\u0103m\u201d cota de utilizare a CPU-ului de c\u0103tre aplica\u021bie (de exemplu, permi\u021b\u00e2ndu-i s\u0103 func\u021bioneze doar 1 ns), putem ucide orice proces din sistem. Astfel, un malware poate omor\u00ee orice proces din sistem, inclusiv procesul antivirus. De asemenea, merit\u0103 men\u021bionat efectul care apare \u00een urma uciderii procesului cu pid 1 (launchctl) \u2014 panic\u0103 de nucleu \u00een \u00eencercarea de a procesa semnalul SIGKILL \ud83d\ude42<\/p>\n
\"Cum
\n<\/p>\n
Cum rezolv\u0103m problema?<\/h3>\n
\nCel mai direct mod de a interzice uciderea unui proces este de a \u00eenlocui indicatorul func\u021biei din tabela apelurilor de sistem. Din p\u0103cate, aceast\u0103 abordare este netrivial\u0103 din multe puncte de vedere.<\/p>\n
\u00cen primul r\u00e2nd, simbolul care r\u0103spunde de pozi\u021bia sysent \u00een memorie nu doar c\u0103 este un simbol privat al nucleului XNU, dar nu poate fi g\u0103sit \u00een simbolurile nucleului. Va trebui s\u0103 utiliz\u0103m metode euristice de c\u0103utare, cum ar fi dezasmblarea dinamic\u0103 a func\u021biei \u0219i c\u0103utarea indicatorului \u00een interiorul acesteia.<\/p>\n
\u00cen al doilea r\u00e2nd, structura \u00eenregistr\u0103rilor din tabel depinde de flag-urile cu care a fost compilat nucleul. Dac\u0103 flag-ul CONFIG_REQUIRES_U32_MUNGING este declarat, atunci dimensiunea structurii va fi modificat\u0103 \u2014 va fi ad\u0103ugat un c\u00e2mp suplimentar. sy_arg_munge32<\/a><\/noindex>. Este necesar s\u0103 se efectueze o verificare suplimentar\u0103 a flag-ului cu care a fost compilat nucleul, ca op\u021biune compar\u00e2nd indicatorii func\u021biilor cu cei cunoscu\u021bi.<\/p>\n
struct sysent {         \n        \/* tabela apelurilor de sistem *\/\n        sy_call_t       *sy_call;       \/* func\u021bia care implementeaz\u0103 *\/\n#if CONFIG_REQUIRES_U32_MUNGING || (__arm__ && (__BIGGEST_ALIGNMENT__ > 4))\n        sy_munge_t      *sy_arg_munge32; \/* munger pentru argumentele apelului de sistem pentru procesele de 32 de bi\u021bi *\/\n#endif\n        int32_t         sy_return_type; \/* tipurile de returnare ale apelului de sistem *\/\n        int16_t         sy_narg;        \/* num\u0103rul de argumente *\/\n        uint16_t        sy_arg_bytes;   \/* Dimensiunea total\u0103 a argumentelor \u00een octe\u021bi pentru\n                                         * apeluri de sistem de 32 de bi\u021bi *\/\n};\n<\/code><\/pre>\n
\nDin fericire, \u00een versiunile moderne de macOS, Apple ofer\u0103 un nou API pentru gestionarea proceselor. Endpoint Security API permite clien\u021bilor s\u0103 autorizeze multe solicit\u0103ri c\u0103tre alte procese. Astfel, se pot bloca orice semnale c\u0103tre procese, inclusiv semnalul SIGKILL prin intermediul API-ului men\u021bionat anterior.<\/p>\n
#include <bsm\/libbsm.h>\n#include <EndpointSecurity\/EndpointSecurity.h>\n#include <unistd.h>\n\nint main(int argc, const char * argv[]) {\n    es_client_t* cli = nullptr;\n    {\n        auto res = es_new_client(&cli, ^(es_client_t * client, const es_message_t * message) {\n            switch (message->event_type) {\n                case ES_EVENT_TYPE_AUTH_SIGNAL:\n                {\n                    auto& msg = message->event.signal;\n                    auto target = msg.target;\n                    auto& token = target->audit_token;\n                    auto pid = audit_token_to_pid(token);\n                    printf("signal '%d' sent to pid '%d'n", msg.sig, pid);\n                    es_respond_auth_result(client, message, pid == getpid() ? ES_AUTH_RESULT_DENY : ES_AUTH_RESULT_ALLOW, false);\n                }\n                    break;\n                default:\n                    break;\n            }\n        });\n    }\n\n    {\n        es_event_type_t evs[] = { ES_EVENT_TYPE_AUTH_SIGNAL };\n        es_subscribe(cli, evs, sizeof(evs) \/ sizeof(*evs));\n    }\n\n    printf("%dn", getpid());\n    sleep(60); \/\/ could be replaced with other waiting primitive\n\n    es_unsubscribe_all(cli);\n    es_delete_client(cli);\n\n    return 0;\n}\n<\/code><\/pre>\n
\n\u00cen mod similar, \u00een nucleu poate fi \u00eenregistrat\u0103 o Politic\u0103 MAC, care ofer\u0103 o metod\u0103 de protec\u021bie \u00eempotriva semnalelor (policy proc_check_signal), totu\u0219i API-ul nu este sus\u021binut oficial.<\/p>\n
Protec\u021bia extensiei nucleului<\/h3>\n
\nPe l\u00e2ng\u0103 protec\u021bia proceselor din sistem, este esen\u021bial\u0103 \u0219i protec\u021bia extinderii nucleului \u00een sine (kext). macOS ofer\u0103 dezvoltatorilor un cadru pentru dezvoltarea u\u0219oar\u0103 a drivere-lor pentru dispozitive IOKit. \u00cen afar\u0103 de furnizarea de instrumente pentru lucrul cu dispozitivele, IOKit asigur\u0103 metode pentru stivuirea driverelor (driver stacking) prin intermediul instan\u021belor de clase C++. Aplica\u021bia din userspace va putea \u201eg\u0103si\u201d o instan\u021b\u0103 de clas\u0103 \u00eenregistrat\u0103 pentru a stabili o leg\u0103tur\u0103 \u00eentre kernel \u0219i userspace.<\/p>\n
Pentru a detecta num\u0103rul de instan\u021be de clase \u00een sistem, exist\u0103 utilitarul ioclasscount.<\/p>\n
my_kext_ioservice = 1\nmy_kext_iouserclient = 1\n<\/code><\/pre>\n
\nOrice extensie a nucleului care dore\u0219te s\u0103 se \u00eenregistreze \u00een stiva driverelor trebuie s\u0103 declare o clas\u0103 mo\u0219tenit\u0103 din IOService, de exemplu, my_kext_ioservice \u00een acest caz. Conectarea aplica\u021biilor utilizator genereaz\u0103 o nou\u0103 instan\u021b\u0103 a unei clase mo\u0219tenite din IOUserClient, \u00een exemplul my_kext_iouserclient.<\/p>\n
Atunci c\u00e2nd se \u00eencearc\u0103 desc\u0103rcarea driverului din sistem (comanda kextunload), se apeleaz\u0103 func\u021bia virtual\u0103 \u201ebool terminate(IOOptionBits options)\u201d. Este suficient s\u0103 returnezi false la apelul func\u021biei terminate pentru a interzice desc\u0103rcarea cu kextunload.<\/p>\n
bool Kext::terminate(IOOptionBits options)\n{\n\n  if (!IsUnloadAllowed)\n  {\n    \/\/ Desc\u0103rcarea nu este permis\u0103, return\u00e2nd false\n    return false;\n  }\n\n  return super::terminate(options);\n}\n\n<\/code><\/pre>\n
\nFlagul IsUnloadAllowed poate fi setat de IOUserClient la \u00eenc\u0103rcare. \u00cen cazul restric\u021biei la desc\u0103rcare, comanda kextunload va returna urm\u0103torul mesaj:<\/p>\n
admin@admins-Mac drivermanager % sudo kextunload .\/test.kext\nParola:\n(kernel) Nu pot elimina kext my.kext.test; serviciile nu au reu\u0219it s\u0103 se termine - 0xe00002c7.\nE\u0219ec la desc\u0103rcarea my.kext.test - (iokit\/common) func\u021bie nesuportat\u0103.\n<\/code><\/pre>\n
\nO protec\u021bie similar\u0103 trebuie aplicat\u0103 \u0219i pentru IOUserClient. Instan\u021bele de clase pot fi desc\u0103rcate cu ajutorul func\u021biei din userspace IOKitLib \u201eIOCatalogueTerminate(mach_port_t, uint32_t flag, io_name_t description);\u201d. Se poate returna false la apelul comenzii \u201eterminate\u201d p\u00e2n\u0103 c\u00e2nd aplica\u021bia din userspace nu \u201emoare\u201d, adic\u0103 p\u00e2n\u0103 nu se apeleaz\u0103 func\u021bia \u201eclientDied\u201d.<\/p>\n
Protec\u021bia fi\u0219ierelor<\/h3>\n
\nPentru protec\u021bia fi\u0219ierelor, este suficient s\u0103 utiliz\u0103m Kauth API, care permite restric\u021bionarea accesului la fi\u0219iere. Apple ofer\u0103 dezvoltatorilor notific\u0103ri despre diverse evenimente \u00een scope, iar pentru noi sunt importante opera\u021biile KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA \u0219i KAUTH_VNODE_DELETE_CHILD. Restric\u021bionarea accesului la fi\u0219iere este cel mai u\u0219or de realizat prin intermediul c\u0103ii \u2014 folosim API-ul \u201cvn_getpath\u201d pentru a ob\u021bine calea c\u0103tre fi\u0219ier \u0219i efectu\u0103m compara\u021bia prefixului c\u0103ii. Observ\u0103m c\u0103, pentru optimizarea redenumirii c\u0103ilor folderelor cu fi\u0219iere, sistemul nu autorizeaz\u0103 accesul la fiecare fi\u0219ier, ci doar la folderul \u00een sine, care a fost redenumit. Este necesar s\u0103 facem compara\u021bia c\u0103ii p\u0103rinte \u0219i s\u0103 restric\u021bion\u0103m KAUTH_VNODE_DELETE pentru acesta.<\/p>\n
\"Cum
\n
\nUn dezavantaj al acestei abord\u0103ri poate fi performan\u021ba sc\u0103zut\u0103 odat\u0103 cu cre\u0219terea num\u0103rului de prefixe. Pentru a evita ca compara\u021bia s\u0103 fie O(prefix*length), unde prefix este num\u0103rul de prefixe, iar length este lungimea \u0219irului, putem folosi un automat finit determinist (DFA) construit pe baza prefixelor. <\/p>\n
S\u0103 analiz\u0103m metoda de construire a DFA-ului pentru acest set de prefixe. Ini\u021bializ\u0103m cursori la \u00eenceputul fiec\u0103rui prefix. Dac\u0103 to\u021bi cursori indic\u0103 acela\u0219i simbol, atunci m\u0103rim fiecare cursor cu un simbol \u0219i re\u021binem c\u0103 lungimea \u0219irului identic este mai mare cu unu. Dac\u0103 exist\u0103 doi cursori, simbolurile sub care se afl\u0103 sunt diferite, \u00eemp\u0103r\u021bim cursori \u00een grupuri \u00een func\u021bie de simbolul pe care \u00eel indic\u0103 \u0219i repet\u0103m algoritmul pentru fiecare grup.<\/p>\n
\u00cen primul caz (toate simbolurile de sub cursori sunt identice) ob\u021binem un stadiu DFA, care are doar o singur\u0103 tranzi\u021bie pe un \u0219ir identic. \u00cen al doilea caz, ob\u021binem o tabel\u0103 de tranzi\u021bii de dimensiuni 256 (num\u0103rul simbolurilor \u0219i num\u0103rul maxim de grupuri) c\u0103tre st\u0103rile urm\u0103toare, ob\u021binute prin apeluri recursive ale func\u021biei.<\/p>\n
S\u0103 lu\u0103m un exemplu. Pentru setul de prefixe (\u201c\/foo\/bar\/tmp\/\u201d, \u201c\/var\/db\/foo\/\u201d, \u201c\/foo\/bar\/aba\/\u201d, \u201cfoo\/bar\/aac\/\u201d) putem ob\u021bine urm\u0103torul DFA. \u00cen desen sunt indicate doar tranzi\u021biile care duc c\u0103tre alte st\u0103ri, celelalte tranzi\u021bii nu vor fi considerat\u0103 finale.<\/p>\n
\"Cum
\n
\n\u00cen timpul parcurgerii st\u0103rilor DFA-ului, pot exista 3 cazuri.<\/p>\n
    \n
  1. A fost atins stadiul final \u2014 calea este protejat\u0103, restric\u021bion\u0103m opera\u021biile KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA \u0219i KAUTH_VNODE_DELETE_CHILD.<\/li>\n
  2. Starea final\u0103 nu a fost atins\u0103, dar calea \u201es-a terminat\u201d (a fost atins un terminator zero) \u2014 calea este p\u0103rinte, trebuie limitat KAUTH_VNODE_DELETE. Observ\u0103m c\u0103, dac\u0103 vnode este un director, trebuie s\u0103 ad\u0103ug\u0103m la sf\u00e2r\u0219it \u2018\/\u2019, altfel poate fi aplicat\u0103 o limitare la fi\u0219ierul \u201c\/foor\/bar\/t\u201d, ceea ce este gre\u0219it.<\/li>\n
  3. Starea final\u0103 nu a fost atins\u0103, calea nu s-a sf\u00e2r\u0219it. Niciunul dintre prefixe nu corespunde acestuia, nu introducem limit\u0103ri.<\/li>\n<\/ol>\n
    <\/p>\n
    Concluzie<\/h3>\n
    \nScopul solu\u021biilor de securitate dezvoltate este de a spori nivelul de securitate al utilizatorului \u0219i al datelor sale. Pe de o parte, acest scop este asigurat prin dezvoltarea produsului software Acronis, care \u00eenchide acele vulnerabilit\u0103\u021bi \u00een care sistemul de operare este \u201eslab\u201d. Pe de alt\u0103 parte, nu trebuie neglijate aspectele de securitate care pot fi \u00eembun\u0103t\u0103\u021bite din partea OS, mai ales c\u0103 \u00eenchiderea unor astfel de vulnerabilit\u0103\u021bi cre\u0219te propria noastr\u0103 rezisten\u021b\u0103 ca produs. Vulnerabilitatea a fost raportat\u0103 echipei de securitate a produselor Apple \u0219i a fost corectat\u0103 \u00een macOS 10.14.5 (https:\/\/support.apple.com\/en-gb\/HT210119).<\/p>\n
    \"Cum
    \n
    \nToate acestea pot fi realizate doar dac\u0103 utilitarul dvs. a fost instalat oficial \u00een kernel. Cu alte cuvinte, pentru software-ul extern \u0219i nedorit nu exist\u0103 astfel de porti\u021be. Cu toate acestea, dup\u0103 cum pute\u021bi vedea, chiar \u0219i pentru protec\u021bia programelor legitime, cum ar fi antivirusele \u0219i sistemele de backup, este nevoie de efort. Dar, acum, noile produse Acronis pentru macOS vor avea o protec\u021bie suplimentar\u0103 \u00eempotriva desc\u0103rc\u0103rii din sistem.
    \n
    Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 protejezi procesele \u0219i extensiile kernelului \u00een macOS | ProHoster","description":"Salut, Habr! Ast\u0103zi a\u0219 dori s\u0103 discut despre cum pot fi protejate procesele \u00eempotriva atacurilor infractorilor cibernetici \u00een macOS.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430 \u0432 macOS | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T23:42:32+00:00","article:modified_time":"2020-04-19T23:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78514","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:56:36","updated":"2022-09-28 22:19:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/78514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=78514"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/78514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/78515"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=78514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=78514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=78514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}