{"id":78514,"date":"2020-04-20T01:42:32","date_gmt":"2020-04-19T23:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos"},"modified":"2020-04-20T01:42:32","modified_gmt":"2020-04-19T23:42:32","slug":"kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","title":{"rendered":"Si t\u00eb mbroni proceset dhe zgjerimet e b\u00ebrtham\u00ebs n\u00eb macOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje, Habr! Sot do t\u00eb doja t\u00eb flisja p\u00ebr m\u00ebnyrat se si mund t\u00eb mbrohen proceset nga sulmet e keqb\u00ebr\u00ebsve n\u00eb macOS. P\u00ebr shembull, kjo \u00ebsht\u00eb e dobishme p\u00ebr antivirusin ose sistemin e backup-it, sidomos n\u00eb drit\u00ebn e faktit se n\u00ebn macOS ekzistojn\u00eb disa m\u00ebnyra p\u00ebr \"t\u00eb vrar\u00eb\" nj\u00eb proces. Lexoni m\u00eb posht\u00eb p\u00ebr k\u00ebt\u00eb dhe p\u00ebr metodat e mbrojtjes.<\/p>\n

\"Si<\/a><\/noindex>
\n<\/a><\/noindex><\/p>\n

M\u00ebnyra klasike p\u00ebr \"t\u00eb vrar\u00eb\" nj\u00eb proces<\/h3>\n

\nM\u00ebnyra e njohur p\u00ebr t\u00eb \"vrar\u00eb\" nj\u00eb proces \u00ebsht\u00eb d\u00ebrgimi i sinjalit SIGKILL procesit. N\u00ebp\u00ebrmjet bash-it, mund t\u00eb thirret standardi \"kill -SIGKILL PID\" ose \"pkill -9 NAME\" p\u00ebr t\u00eb vrar\u00eb. Komanda \"kill\" \u00ebsht\u00eb e njohur q\u00eb nga koha e UNIX dhe \u00ebsht\u00eb e disponueshme jo vet\u00ebm n\u00eb macOS, por edhe n\u00eb sistemet e tjera UNIX-like.<\/p>\n

Ashtu si n\u00eb sistemet UNIX-like, macOS lejon kapjen e \u00e7do sinjali p\u00ebr procesin p\u00ebrve\u00e7 dy - SIGKILL dhe SIGSTOP. N\u00eb k\u00ebt\u00eb artikull do t\u00eb shqyrtohet kryesisht sinjali SIGKILL, si nj\u00eb sinjal q\u00eb shkakton vrasjen e procesit.<\/p>\n

Spezifikimi i macOS
\n<\/h3>\n

\nN\u00eb macOS, thirrja sistemike kill n\u00eb b\u00ebrtham\u00ebn XNU aktivizon funksionin psignal(SIGKILL, ...). Le t\u00eb shohim se cilat veprime t\u00eb tjera t\u00eb p\u00ebrdoruesit n\u00eb userspace mund t\u00eb aktivizojn\u00eb funksionin psignal. Do t\u00eb p\u00ebrjashtojm\u00eb thirrjet e funksionit psignal brenda mekanizmave t\u00eb brendsh\u00ebm t\u00eb b\u00ebrtham\u00ebs (edhe pse ato mund t\u00eb jen\u00eb sfiduese, por do t'i l\u00ebm\u00eb p\u00ebr nj\u00eb artikull tjet\u00ebr \ud83d\ude42 \u2014 verifikimi i n\u00ebnshkrimit, gabimet e memories, menaxhimi i exit\/terminate, shkeljet e mbrojtjes s\u00eb skedar\u00ebve, etj.). <\/p>\n

T\u00eb fillojm\u00eb shqyrtimin me funksionin dhe thirrjen e p\u00ebrkatshme t\u00eb sistemit terminate_with_payload<\/a><\/noindex>. \u00cbsht\u00eb e qart\u00eb se p\u00ebrve\u00e7 thirrjes klasike t\u00eb kill, ekziston nj\u00eb qasje alternative, q\u00eb \u00ebsht\u00eb specifike p\u00ebr sistemin operativ macOS dhe nuk gjendet n\u00eb BSD. Principe e funksionimit t\u00eb t\u00eb dy thirrjeve t\u00eb sistemit jan\u00eb gjithashtu t\u00eb ngjashme. Ato p\u00ebrb\u00ebjn\u00eb thirrje t\u00eb drejtp\u00ebrdrejta t\u00eb funksionit t\u00eb b\u00ebrtham\u00ebs psignal. Gjithashtu, v\u00ebm\u00eb re se p\u00ebrpara se t\u00eb vras\u00eb nj\u00eb proces b\u00ebhet nj\u00eb kontroll \"cansignal\" - a mund t\u00eb d\u00ebrgoj\u00eb procesi nj\u00eb sinjal tek nj\u00eb proces tjet\u00ebr, sistemi nuk lejon asnj\u00eb aplikacion t\u00eb vras\u00eb proceset sistemike, p\u00ebr shembull.<\/p>\n

static int\nterminate_with_payload_internal(struct proc *cur_proc, int target_pid, uint32_t reason_namespace,\n\t\t\t\tuint64_t reason_code, user_addr_t payload, uint32_t payload_size,\n\t\t\t\tuser_addr_t reason_string, uint64_t reason_flags)\n{\n...\n\ttarget_proc = proc_find(target_pid);\n...\n\tif (!cansignal(cur_proc, cur_cred, target_proc, SIGKILL)) {\n\t\tproc_rele(target_proc);\n\t\treturn EPERM;\n\t}\n...\n\tif (target_pid == cur_proc->p_pid) {\n\t\t\td\/*\n\t\t * psignal_thread_with_reason() will pend a SIGKILL on the specified thread or\n\t\t * return if the thread and\/or task are already terminating. Either way, the\n\t\t * current thread won't return to userspace.\n\t\t *\/\/\n\t\tpsignal_thread_with_reason(target_proc, current_thread(), SIGKILL, signal_reason);\n\t} else {\n\t\tpsignal_with_reason(target_proc, SIGKILL, signal_reason);\n\t}\n...\n}\n<\/code><\/pre>\n
<\/p>\n
launchd<\/h3>\n
\nM\u00ebnyra standarde p\u00ebr krijimin e demon\u00ebve n\u00eb nisjen e sistemit dhe kontrollimin e koh\u00ebs s\u00eb jet\u00ebs s\u00eb tyre \u00ebsht\u00eb launchd. Dua t\u00eb theksoj se kodet e dh\u00ebna jan\u00eb p\u00ebr nj\u00eb version t\u00eb vjet\u00ebr t\u00eb launchctl para macOS 10.10, dhe shembujt e kodit jan\u00eb dh\u00ebn\u00eb p\u00ebr ilust\u00ebrim. Launchctl modern d\u00ebrgon sinjale launchd p\u00ebrmes XPC, logjika e launchctl \u00ebsht\u00eb transferuar n\u00eb t\u00eb.<\/p>\n
Le t\u00eb shohim se si ndodhet ndalimi i aplikacioneve. Para d\u00ebrgimit t\u00eb sinjalit SIGTERM, aplikacionet p\u00ebrpiqen t\u00eb ndalohen p\u00ebrmes thirrjes s\u00eb sistemit \u201cproc_terminate\u201d.<\/p>\n
...\n\terror = proc_terminate(j->p, &sig);\n\tif (error) {\n\t\tjob_log(j, LOG_ERR | LOG_CONSOLE, \"Nuk mund t\u00eb p\u00ebrfundoj pun\u00ebn: %d: %s\", error, strerror(error));\n\t\tjob_log(j, LOG_NOTICE | LOG_CONSOLE, \"Duke p\u00ebrdorur opsionin alternativ p\u00ebr t\u00eb p\u00ebrfunduar pun\u00ebn...\");\n\t\terror = kill2(j->p, SIGTERM);\n\t\tif (error) {\n\t\t\tjob_log(j, LOG_ERR, \"Nuk mund t\u00eb sinjalizoj pun\u00ebn: %d: %s\", error, strerror(error));\n\t\t} \n...\n<\/code><\/pre>\n
\nN\u00ebn kapak, proc_terminate, pavar\u00ebsisht emrit t\u00eb tij, mund t\u00eb d\u00ebrgoj\u00eb jo vet\u00ebm psignal me SIGTERM, por edhe SIGKILL.<\/p>\n
Vrasja e t\u00ebrthort\u00eb \u2014 kufizimi i burimeve<\/h3>\n
\nNj\u00eb rast m\u00eb interesant mund t\u00eb shihet n\u00eb nj\u00eb thirrje tjet\u00ebr t\u00eb sistemit process_policy<\/a><\/noindex>. P\u00ebrdorimi standard i k\u00ebsaj thirrjeje t\u00eb sistemit \u00ebsht\u00eb kufizimi i burimeve t\u00eb aplikacioneve, p\u00ebr shembull, p\u00ebr indeksuesin, kufizimi i kuot\u00ebs s\u00eb koh\u00ebs s\u00eb procesorit dhe memories, n\u00eb m\u00ebnyr\u00eb q\u00eb sistemi t\u00eb mos ngadal\u00ebsohet ndjesh\u00ebm nga veprimet e ruajtjes s\u00eb skedar\u00ebve. N\u00ebse aplikacioni arrin kufizimin e burimeve, si\u00e7 mund t\u00eb shihet nga funksioni proc_apply_resource_actions, procesit i d\u00ebrgohet sinjali SIGKILL.<\/p>\n
Pavar\u00ebsisht se kjo thirrje e sistemit mund t\u00eb prodhoj\u00eb potencialisht vrasjen e procesit, sistemi nuk ka kontrolluar adekuat t\u00eb drejtat e procesit q\u00eb b\u00ebnte thirrjen e sistemit. N\u00eb t\u00eb v\u00ebrtet\u00eb, kontrolli ekzistonte<\/a><\/noindex>, por mjafton t\u00eb p\u00ebrdoret flaka alternative PROC_POLICY_ACTION_SET p\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb kusht.<\/p>\n
Nga k\u00ebtu, n\u00ebse \"kufizohet\" kuota e p\u00ebrdorimit t\u00eb CPU nga aplikacioni (p\u00ebr shembull, lejohet t\u00eb funksionoj\u00eb vet\u00ebm 1 ns), at\u00ebher\u00eb mund t\u00eb vrar\u00eb \u00e7do proces n\u00eb sistem. K\u00ebshtu, nj\u00eb malware mund t\u00eb vras\u00eb \u00e7do proces n\u00eb sistem, p\u00ebrfshir\u00eb procesin e antivirusit. Gjithashtu, \u00ebsht\u00eb interesante efekti q\u00eb ndodh kur vritet procesi me pid 1 (launchctl) \u2014 panic n\u00eb b\u00ebrtham\u00eb kur p\u00ebrpiqet t\u00eb p\u00ebrpunoj\u00eb sinjalin SIGKILL \ud83d\ude42<\/p>\n
\"Si
\n<\/p>\n
Si t\u00eb zgjidhni problemin?<\/h3>\n
\nM\u00ebnyra m\u00eb e drejtp\u00ebrdrejt\u00eb p\u00ebr t\u00eb ndaluar vrasjen e nj\u00eb procesi \u00ebsht\u00eb t\u00eb z\u00ebvend\u00ebsohet treguesi n\u00eb tabel\u00ebn e thirrjeve sistemore. Fatkeq\u00ebsisht, ky opcion \u00ebsht\u00eb i nd\u00ebrlikuar p\u00ebr shum\u00eb arsye<\/p>\n
S\u00eb pari, simboli q\u00eb p\u00ebrgjigjet p\u00ebr pozicionin e sysent n\u00eb memorie \u00ebsht\u00eb jo vet\u00ebm nj\u00eb simbol privat i b\u00ebrthames XNU, por nuk mund t\u00eb gjendet as n\u00eb simbolet e b\u00ebrtham\u00ebs. Do t\u00eb duhej t\u00eb p\u00ebrdoren metoda heuristike p\u00ebr t\u00eb gjetur, p\u00ebr shembull, disasemblim dinamik t\u00eb funksionit dhe k\u00ebrkimin e treguesit n\u00eb t\u00eb.<\/p>\n
S\u00eb dyti, struktura e sh\u00ebnimeve n\u00eb tabel\u00eb varet nga flamujt me t\u00eb cil\u00ebt \u00ebsht\u00eb nd\u00ebrtuar b\u00ebrthama. N\u00ebse \u00ebsht\u00eb shpallur flamuri CONFIG_REQUIRES_U32_MUNGING, at\u00ebher\u00eb madh\u00ebsia e struktur\u00ebs do t\u00eb ndryshoj\u00eb \u2014 do t\u00eb shtohet nj\u00eb fush\u00eb e re. sy_arg_munge32<\/a><\/noindex>. Necesiteti p\u00ebr t\u00eb realizuar nj\u00eb kontroll t\u00eb m\u00ebtejsh\u00ebm se me cilin flamur \u00ebsht\u00eb kompiluar b\u00ebrthama, si nj\u00eb alternativ\u00eb p\u00ebr t\u00eb p\u00ebrputhur treguesit me funksionet e njohura.<\/p>\n
struct sysent {         \n        \/* tabela e thirrjeve sistemore *\/\n        sy_call_t       *sy_call;       \/* funksioni q\u00eb implementon *\/\n#if CONFIG_REQUIRES_U32_MUNGING || (__arm__ && (__BIGGEST_ALIGNMENT__ > 4))\n        sy_munge_t      *sy_arg_munge32; \/* procesi i thirrjes sistemore p\u00ebr argumentet 32-bit *\/\n#endif\n        int32_t         sy_return_type; \/* llojet e kthimit t\u00eb thirrjeve sistemore *\/\n        int16_t         sy_narg;        \/* numri i argumenteve *\/\n        uint16_t        sy_arg_bytes;   \/* Madh\u00ebsia totale e argumenteve n\u00eb byte p\u00ebr\n                                         * thirrjet sistemore 32-bit\n                                         *\/\n};\n<\/code><\/pre>\n
\nMe fat, n\u00eb versionet moderne t\u00eb macOS, Apple ofron nj\u00eb API t\u00eb re p\u00ebr t\u00eb punuar me proceset. API e Siguris\u00eb s\u00eb Endpoint lejon klient\u00ebt t\u00eb autorizojn\u00eb shum\u00eb k\u00ebrkesa p\u00ebr procese t\u00eb tjera. K\u00ebshtu, \u00ebsht\u00eb e mundur t\u00eb bllokohen \u00e7do sinjal p\u00ebr proceset, p\u00ebrfshir\u00eb sinjalin SIGKILL me ndihm\u00ebn e API-s\u00eb s\u00eb p\u00ebrmendur m\u00eb lart.<\/p>\n
#include <bsm\/libbsm.h>\n#include <EndpointSecurity\/EndpointSecurity.h>\n#include <unistd.h>\n\nint main(int argc, const char * argv[]) {\n    es_client_t* cli = nullptr;\n    {\n        auto res = es_new_client(&cli, ^(es_client_t * client, const es_message_t * message) {\n            switch (message->event_type) {\n                case ES_EVENT_TYPE_AUTH_SIGNAL:\n                {\n                    auto& msg = message->event.signal;\n                    auto target = msg.target;\n                    auto& token = target->audit_token;\n                    auto pid = audit_token_to_pid(token);\n                    printf("signal '%d' sent to pid '%d'n", msg.sig, pid);\n                    es_respond_auth_result(client, message, pid == getpid() ? ES_AUTH_RESULT_DENY : ES_AUTH_RESULT_ALLOW, false);\n                }\n                    break;\n                default:\n                    break;\n            }\n        });\n    }\n\n    {\n        es_event_type_t evs[] = { ES_EVENT_TYPE_AUTH_SIGNAL };\n        es_subscribe(cli, evs, sizeof(evs) \/ sizeof(*evs));\n    }\n\n    printf("%dn", getpid());\n    sleep(60); \/\/ could be replaced with other waiting primitive\n\n    es_unsubscribe_all(cli);\n    es_delete_client(cli);\n\n    return 0;\n}\n<\/code><\/pre>\n
\nPo ashtu, n\u00eb b\u00ebrtham\u00eb mund t\u00eb regjistrohet nj\u00eb Politika MAC, e cila ofron nj\u00eb metod\u00eb mbrojtjeje nga sinjalet (policy proc_check_signal), megjithat\u00eb API nuk mb\u00ebshtetet zyrtarisht.<\/p>\n
Mbrojtja e zgjerimit t\u00eb b\u00ebrtham\u00ebs<\/h3>\n
\nP\u00ebrve\u00e7 mbrojtjes s\u00eb proceseve n\u00eb sistem, \u00ebsht\u00eb e nevojshme t\u00eb mbrohet edhe vet zgjerimi i b\u00ebrtham\u00ebs (kext). macOS ofron nj\u00eb kuad\u00ebr p\u00ebr zhvilluesit p\u00ebr zhvillimin e leht\u00eb t\u00eb drejtor\u00ebve t\u00eb pajisjeve IOKit. P\u00ebrve\u00e7 sigurimit t\u00eb mjeteve p\u00ebr pun\u00ebn me pajisjet, IOKit siguron metoda p\u00ebr grumbullimin e drejtor\u00ebve (driver stacking) me an\u00eb t\u00eb instancave t\u00eb klasave C++. Nj\u00eb aplikacion n\u00eb userspace mund t\u00eb \"gjej\u00eb\" nj\u00eb instanc\u00eb t\u00eb regjistruar t\u00eb klas\u00ebs p\u00ebr t\u00eb vendosur lidhje mes kernel dhe userspace.<\/p>\n
P\u00ebr t\u00eb zbuluar numrin e instancave t\u00eb klasave n\u00eb sistem, ekziston utilita ioclasscount.<\/p>\n
my_kext_ioservice = 1\nmy_kext_iouserclient = 1\n<\/code><\/pre>\n
\n\u00c7do zgjerim b\u00ebrthame, q\u00eb d\u00ebshiron t\u00eb regjistrohet n\u00eb grumbullin e drejtor\u00ebve, duhet t\u00eb shpall\u00eb nj\u00eb klas\u00eb t\u00eb trash\u00ebguar nga IOService, p\u00ebr shembull, my_kext_ioservice n\u00eb k\u00ebt\u00eb rast. K\u00ebrkesa e aplikacioneve p\u00ebr p\u00ebrdorues krijon nj\u00eb instanc\u00eb t\u00eb re t\u00eb klas\u00ebs, e cila trash\u00ebgohet nga IOUserClient, n\u00eb shembullin my_kext_iouserclient.<\/p>\n
Kur b\u00ebhet nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb shkarkuar drejtorin nga sistemi (komanda kextunload), thirret funksioni virtual \"bool terminate(IOOptionBits options)\". Mjafton t\u00eb kthehet false n\u00eb thirrjen e funksionit terminate gjat\u00eb p\u00ebrpjekjes p\u00ebr shkarkim, p\u00ebr t\u00eb ndaluar kextunload.<\/p>\n
bool Kext::terminate(IOOptionBits options)\n{\n\n  if (!IsUnloadAllowed)\n  {\n    \/\/ Shkarkimi nuk lejohet, duke u kthyer false\n    return false;\n  }\n\n  return super::terminate(options);\n}\n\n<\/code><\/pre>\n
\nFlamuri IsUnloadAllowed mund t\u00eb vendoset nga IOUserClient gjat\u00eb ngarkimit. N\u00ebse ka nj\u00eb kufizim n\u00eb ngarkim, komanda kextunload do t\u00eb kthej\u00eb daljen e m\u00ebposhtme:<\/p>\n
admin@admins-Mac drivermanager % sudo kextunload .\/test.kext\nFjal\u00ebkalimi:\n(kernel) Nuk mund t\u00eb hiqet kext my.kext.test; sh\u00ebrbimet d\u00ebshtuan n\u00eb mbyllje - 0xe00002c7.\nD\u00ebshtoi eliminimi i my.kext.test - (iokit\/common) funksion i pap\u00ebrshtatsh\u00ebm.\n<\/code><\/pre>\n
\nMbrojtja e ngjashme duhet t\u00eb realizohet edhe p\u00ebr IOUserClient. Instancat e klasave mund t\u00eb shkarkohen me an\u00eb t\u00eb funksionit n\u00eb userspace t\u00eb IOKitLib \"IOCatalogueTerminate(mach_port_t, uint32_t flag, io_name_t description);\". Mund t\u00eb kthehen false n\u00eb thirrjen e komand\u00ebs \"terminate\" derisa aplikacioni n\u00eb userspace t\u00eb \"vdes\", pra derisa t\u00eb mos thirret funksioni \"clientDied\".<\/p>\n
Mbrojtja e skedar\u00ebve<\/h3>\n
\nP\u00ebr t\u00eb mbrojtur skedar\u00ebt, mjafton t\u00eb p\u00ebrdorim Kauth API, i cili lejon kufizimin e aksesit n\u00eb skedar\u00eb. Apple u ofron zhvilluesve njoftime p\u00ebr ngjarje t\u00eb ndryshme n\u00eb scope, p\u00ebr ne jan\u00eb t\u00eb r\u00ebnd\u00ebsishme operacionet KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA dhe KAUTH_VNODE_DELETE_CHILD. T\u00eb kufizosh aksesin n\u00eb skedar\u00eb \u00ebsht\u00eb m\u00eb e leht\u00eb sipas rrug\u00ebs \u2014 p\u00ebrdorim API 'vn_getpath' p\u00ebr t\u00eb marr\u00eb rrug\u00ebn e skedarit dhe kryejm\u00eb krahasimin e prefiksit t\u00eb rrug\u00ebs. Vlen t\u00eb theksohet se p\u00ebr optimizimin e ndryshimit t\u00eb emrave t\u00eb rrug\u00ebve t\u00eb dosjeve, sistemi nuk autorizon aksesin p\u00ebr \u00e7do skedar, por vet\u00ebm p\u00ebr dosjen e vet\u00eb q\u00eb \u00ebsht\u00eb ribler\u00eb. Duhet t\u00eb kryhet krahasimi i rrug\u00ebs prind dhe t\u00eb kufizohet KAUTH_VNODE_DELETE p\u00ebr t\u00eb.<\/p>\n
\"Si
\n
\nNj\u00eb dob\u00ebsi e k\u00ebtij qasjes mund t\u00eb jet\u00eb performanca e ul\u00ebt me rritjen e numrit t\u00eb prefikseve. P\u00ebr t\u00eb b\u00ebr\u00eb q\u00eb krahasimi t\u00eb mos jet\u00eb O(prefix*length), ku prefix \u00ebsht\u00eb numri i prefikseve, length \u00ebsht\u00eb gjat\u00ebsia e vargjeve, mund t\u00eb p\u00ebrdorim automatin e fund\u00ebm t\u00eb p\u00ebrcaktuar (DFA) t\u00eb nd\u00ebrtuar sipas prefikseve. <\/p>\n
Le t\u00eb shqyrtojm\u00eb m\u00ebnyr\u00ebn e nd\u00ebrtimit t\u00eb DFA p\u00ebr k\u00ebt\u00eb grup prefikse. Inicizojm\u00eb kursoret n\u00eb fillim t\u00eb \u00e7do prefiksi. N\u00ebse t\u00eb gjitha kursoret tregojn\u00eb p\u00ebr t\u00eb nj\u00ebjtin simbol, at\u00ebher\u00eb rrisim \u00e7do kurser me nj\u00eb simbol dhe mbajm\u00eb mend se gjat\u00ebsia e vargjeve t\u00eb nj\u00ebjt\u00eb \u00ebsht\u00eb rritur me nj\u00eb. N\u00ebse ekzistojn\u00eb dy kursore, simbolet n\u00ebn t\u00eb cilat jan\u00eb ndryshme, i ndajm\u00eb kursor\u00ebt n\u00eb grupe sipas simbolit q\u00eb tregojn\u00eb dhe e p\u00ebrs\u00ebrisim algoritmin p\u00ebr secil\u00ebn grup.<\/p>\n
N\u00eb rastin e par\u00eb (t\u00eb gjith\u00eb simbol\u00ebt n\u00ebn kursor\u00eb jan\u00eb t\u00eb nj\u00ebjt\u00eb) marrim nj\u00eb gjendje t\u00eb DFA-s\u00eb q\u00eb ka vet\u00ebm nj\u00eb kalim sipas vargjeve t\u00eb nj\u00ebjta. N\u00eb rastin e dyt\u00eb, marrim nj\u00eb tabel\u00eb kalimesh me madh\u00ebsi 256 (numri i simboleve dhe numri maksimal i grupeve) n\u00eb gjendjet e ardhshme, t\u00eb fituara gjat\u00eb thirrjes rikursive t\u00eb funksionit.<\/p>\n
Le t\u00eb marrim nj\u00eb shembull. P\u00ebr grupin e prefikseve ('\\\/foo\\\/bar\\\/tmp\\\/', '\\\/var\\\/db\\\/foo\\\/', '\\\/foo\\\/bar\\\/aba\\\/', 'foo\\\/bar\\\/aac\\\/') mund t\u00eb marrim k\u00ebt\u00eb DFA. N\u00eb vizatim jan\u00eb sh\u00ebnuar vet\u00ebm kalimet q\u00eb \u00e7ojn\u00eb n\u00eb gjendje t\u00eb tjera, kalimet e tjera nuk do t\u00eb jen\u00eb p\u00ebrfundimtare.<\/p>\n
\"Si
\n
\nKur kalojm\u00eb p\u00ebrmes gjendjeve t\u00eb DFA-s\u00eb, mund t\u00eb ndodhin 3 raste.<\/p>\n
    \n
  1. \u00cbsht\u00eb arritur gjendja p\u00ebrfundimtare \u2014 rruga \u00ebsht\u00eb e mbrojtur, kufizojm\u00eb operacionet KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA dhe KAUTH_VNODE_DELETE_CHILD.<\/li>\n
  2. Nuk u arrit n\u00eb nj\u00eb gjendje p\u00ebrfundimtare, por rruga \"p\u00ebrfundoi\" (u arrit terminatori zero) \u2014 rruga \u00ebsht\u00eb prind\u00ebrore, duhet t\u00eb kufizohet KAUTH_VNODE_DELETE. V\u00ebrejm\u00eb se, n\u00ebse vnode \u00ebsht\u00eb nj\u00eb dosje, duhet t\u00eb shtohet n\u00eb fund \u2018\\\/\u2019, p\u00ebrndryshe mund t\u00eb b\u00ebhet kufizimi i skedarit \u201c\\\/foor\\\/bar\\\/t\u201d, q\u00eb \u00ebsht\u00eb e gabuar.<\/li>\n
  3. Nuk u arrit n\u00eb nj\u00eb gjendje p\u00ebrfundimtare, rruga nuk p\u00ebrfundoi. Asnj\u00eb nga prefiksat nuk i p\u00ebrputhet k\u00ebsaj, nuk vendosim kufizime.<\/li>\n<\/ol>\n
    <\/p>\n
    P\u00ebrfundim<\/h3>\n
    \nObjektivi i zgjidhjeve t\u00eb siguris\u00eb n\u00eb zhvillim \u00ebsht\u00eb t\u00eb rris\u00eb nivelin e siguris\u00eb s\u00eb p\u00ebrdoruesit dhe t\u00eb dh\u00ebnave t\u00eb tij. Nga nj\u00ebra an\u00eb, ky objektiv sigurohet p\u00ebrmes zhvillimit t\u00eb nj\u00eb produkti software Acronis, q\u00eb mbulon ato dob\u00ebsi ku \"\u00ebsht\u00eb e dob\u00ebt\" vet\u00eb sistemi operativ. Nga ana tjet\u00ebr, nuk duhet t\u00eb injorojm\u00eb forcimin e aspekteve t\u00eb siguris\u00eb q\u00eb mund t\u00eb p\u00ebrmir\u00ebsohen nga ana e OS, sidomos duke pasur parasysh se mbyllja e dob\u00ebsive t\u00eb tilla rrit q\u00ebndrueshm\u00ebrin\u00eb ton\u00eb si produkt. Dob\u00ebsia u raportua nga Ekipi i Siguris\u00eb s\u00eb Produkteve t\u00eb Apple dhe u korrigjua n\u00eb macOS 10.14.5 (https:\/\/support.apple.com\/en-gb\/HT210119).<\/p>\n
    \"Si
    \n
    \nKjo mund t\u00eb b\u00ebhet vet\u00ebm n\u00ebse utilitari juaj \u00ebsht\u00eb instaluar zyrtarisht n\u00eb kernel. K\u00ebshtu q\u00eb p\u00ebr softuerin e jasht\u00ebm dhe t\u00eb pad\u00ebshiruar nuk ka rrug\u00eb tjet\u00ebr. Megjithat\u00eb, si\u00e7 e shihni, edhe p\u00ebr t\u00eb mbrojtur programet legjitime, si antivirus dhe sistemi i rezervimit, k\u00ebrkohet pun\u00eb. Megjithat\u00eb, tani produktet e reja Acronis p\u00ebr macOS do t\u00eb ken\u00eb mbrojtje shtes\u00eb kund\u00ebr shkarkimit nga sistemi.
    \n
    Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si t\u00eb mbrojm\u00eb proceset dhe zgjerimet e kernelit n\u00eb macOS | ProHoster","description":"P\u00ebrsh\u00ebndetje, Habr! Sot do t\u00eb doja t\u00eb flas p\u00ebr se si mund t\u00eb mbrohen proceset nga sulmet e keqb\u00ebr\u00ebsve n\u00eb macOS.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430 \u0432 macOS | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T23:42:32+00:00","article:modified_time":"2020-04-19T23:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78514","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:56:36","updated":"2022-09-28 22:19:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=78514"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/78515"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=78514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=78514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=78514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}