{"id":78514,"date":"2020-04-20T01:42:32","date_gmt":"2020-04-19T23:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos"},"modified":"2020-04-20T01:42:32","modified_gmt":"2020-04-19T23:42:32","slug":"kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","title":{"rendered":"Si sihet mbrojtja e proceseve dhe shtrirjeve t\u00eb b\u00ebrtham\u00ebs n\u00eb macOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje, Habr! Sot do t\u00eb flas p\u00ebr m\u00ebnyrat si mund t\u00eb mbrohen proceset nga sulmet e haker\u00ebve n\u00eb macOS. Kjo \u00ebsht\u00eb e dobishme sidomos p\u00ebr antivirusin ose sistemin e kopjimit, ve\u00e7an\u00ebrisht p\u00ebr shkak se n\u00eb macOS ekzistojn\u00eb disa m\u00ebnyra p\u00ebr t\u00eb \"vrar\u00eb\" nj\u00eb proces. M\u00eb k\u00ebt\u00eb dhe metodat e mbrojtjes lexoni m\u00eb posht\u00eb.<\/p>\n

\"Si<\/a><\/noindex>
\n<\/a><\/noindex><\/p>\n

M\u00ebnyra klasike p\u00ebr t\u00eb \"vrar\u00eb\" nj\u00eb proces<\/h3>\n

\nNj\u00eb m\u00ebnyr\u00eb e njohur p\u00ebr t\u00eb \"vrar\u00eb\" nj\u00eb proces \u00ebsht\u00eb d\u00ebrgimi i sinjalit SIGKILL procesit. N\u00eb bash, mund t\u00eb th\u00ebrras\u00ebsh metodat standarde \"kill -SIGKILL PID\" ose \"pkill -9 NAME\" p\u00ebr t'i b\u00ebr\u00eb at\u00eb. Komanda \"kill\" \u00ebsht\u00eb e njohur q\u00eb nga koha e UNIX-it dhe \u00ebsht\u00eb e disponueshme jo vet\u00ebm n\u00eb macOS, por edhe n\u00eb sisteme t\u00eb tjera UNIX-like.<\/p>\n

Po ashtu si n\u00eb sistemet UNIX-like, macOS lejon kapjen e \u00e7do sinjali p\u00ebr procesin p\u00ebrve\u00e7 dy - SIGKILL dhe SIGSTOP. Ky artikull do t\u00eb shqyrtoj\u00eb kryesisht sinjalin SIGKILL, si sinjal q\u00eb shkakton vrasjen e procesit.<\/p>\n

Specifika e macOS
\n<\/h3>\n

\nN\u00eb macOS, thirrja sistemike kill n\u00eb b\u00ebrtham\u00ebn XNU th\u00ebrret funksionin psignal(SIGKILL,...). Le t\u00eb shohim cilat veprime t\u00eb tjera t\u00eb p\u00ebrdoruesit n\u00eb userspace mund t\u00eb th\u00ebrrasin funksionin psignal. Do t\u00eb ndalojm\u00eb thirrjet e funksionit psignal n\u00eb mekanizmat e brendsh\u00ebm t\u00eb b\u00ebrtham\u00ebs (pavar\u00ebsisht se ato mund t\u00eb jen\u00eb komplekse, por do t'i l\u00ebm\u00eb ato p\u00ebr nj\u00eb artikull tjet\u00ebr \ud83d\ude42 \u2014 verifikimi i n\u00ebnshkrimit, gabimet e memories, trajtimi i exit\/terminate, shkelja e mbrojtjes s\u00eb skedar\u00ebve etj. <\/p>\n

Le t\u00eb fillojm\u00eb shqyrtimin me funksionin dhe thirrjen p\u00ebrkat\u00ebse sistemike. terminate_with_payload<\/a><\/noindex>. \u00cbsht\u00eb e dukshme se p\u00ebrve\u00e7 thirrjes klasike kill, ekziston nj\u00eb qasje alternative, e cila \u00ebsht\u00eb specifike p\u00ebr sistemin operativ macOS dhe nuk gjendet n\u00eb BSD. Parimet e funksionimit t\u00eb t\u00eb dy thirrjeve sistemike jan\u00eb gjithashtu t\u00eb ngjashme. ato p\u00ebrb\u00ebjn\u00eb thirrje direkte t\u00eb funksionit t\u00eb b\u00ebrtham\u00ebs psignal. Po ashtu, le t\u00eb v\u00ebm\u00eb re se para se t\u00eb vras\u00eb procesin b\u00ebhet nj\u00eb kontroll \u201ccansignal\u201d \u2013 n\u00ebse procesi mund t\u00eb d\u00ebrgoj\u00eb sinjal tjet\u00ebr procesi, sistemi nuk lejon asnj\u00eb aplikacion t\u00eb vras\u00eb proceset sistemike, p\u00ebr shembull.<\/p>\n

static int\nterminate_with_payload_internal(struct proc *cur_proc, int target_pid, uint32_t reason_namespace,\n\t\t\t\tuint64_t reason_code, user_addr_t payload, uint32_t payload_size,\n\t\t\t\tuser_addr_t reason_string, uint64_t reason_flags)\n{\n...\n\ttarget_proc = proc_find(target_pid);\n...\n\tif (!cansignal(cur_proc, cur_cred, target_proc, SIGKILL)) {\n\t\tproc_rele(target_proc);\n\t\treturn EPERM;\n\t}\n...\n\tif (target_pid == cur_proc->p_pid) {\n\t\t\/*\n\t\t * psignal_thread_with_reason() will pend a SIGKILL on the specified thread or\n\t\t * return if the thread and\/or task are already terminating. Either way, the\n\t\t * current thread won't return to userspace.\n\t\t *\/\n\t\tpsignal_thread_with_reason(target_proc, current_thread(), SIGKILL, signal_reason);\n\t} else {\n\t\tpsignal_with_reason(target_proc, SIGKILL, signal_reason);\n\t}\n...\n}\n<\/code><\/pre>\n
<\/p>\n
launchd<\/h3>\n
\nM\u00ebnyra standarde p\u00ebr t\u00eb krijuar demon\u00eb n\u00eb nisjen e sistemit dhe p\u00ebr t\u00eb kontrolluar koh\u00ebzgjatjen e tyre \u00ebsht\u00eb launchd. Dua t\u00eb theksoj se burimet jan\u00eb p\u00ebr nj\u00eb version t\u00eb vjet\u00ebr t\u00eb launchctl para macOS 10.10, shembujt e kodit jan\u00eb dh\u00ebn\u00eb p\u00ebr ilustim. Launchctl modern d\u00ebrgon sinjale n\u00eb launchd p\u00ebrmes XPC, logjika e launchctl \u00ebsht\u00eb transferuar tek ai.<\/p>\n
Le t\u00eb shqyrtojm\u00eb se si ndalohet sakt\u00ebsisht aplikacionet. Para d\u00ebrgimit t\u00eb sinjalit SIGTERM, aplikacionet p\u00ebrpiqen t\u00eb ndalen p\u00ebrmes thirrjes sistemore \u201cproc_terminate\u201d.<\/p>\n
...\n\terror = proc_terminate(j->p, &sig);\n\tif (error) {\n\t\tjob_log(j, LOG_ERR | LOG_CONSOLE, \"Nuk mund t\u00eb nd\u00ebrpritet puna: %d: %s\", error, strerror(error));\n\t\tjob_log(j, LOG_NOTICE | LOG_CONSOLE, \"Duke p\u00ebrdorur opsionin e rikthimit p\u00ebr t\u00eb nd\u00ebrprer\u00eb pun\u00ebn...\");\n\t\terror = kill2(j->p, SIGTERM);\n\t\tif (error) {\n\t\t\tjob_log(j, LOG_ERR, \"Nuk mund t\u00eb sinjalizoj pun\u00ebn: %d: %s\", error, strerror(error));\n\t\t}\n...\n<\/code><\/pre>\n
\nPavar\u00ebsisht emrit t\u00eb tij, proc_terminate mund t\u00eb d\u00ebrgoj\u00eb jo vet\u00ebm psignal me SIGTERM, por edhe SIGKILL.<\/p>\n
Vrasja indirekte \u2014 kufizim n\u00eb burime<\/h3>\n
\nNj\u00eb rast m\u00eb interesant mund t\u00eb shihet n\u00eb nj\u00eb thirrje tjet\u00ebr t\u00eb sistemit process_policy<\/a><\/noindex>. P\u00ebrdorimi standard i k\u00ebsaj thirrjeje t\u00eb sistemit \u2014 kufizime n\u00eb burimet e aplikacioneve, p.sh. p\u00ebr indeksuesin, nj\u00eb kufizim n\u00eb kuot\u00ebn e koh\u00ebs s\u00eb procesorit dhe memories, n\u00eb m\u00ebnyr\u00eb q\u00eb sistemi t\u00eb mos ngadal\u00ebsohet ndjesh\u00ebm p\u00ebr shkak t\u00eb veprimeve t\u00eb ruajtjes n\u00eb skedar. N\u00ebse aplikacioni arrin kufizimin e burimeve, si\u00e7 mund t\u00eb shihet nga funksioni proc_apply_resource_actions, atij i d\u00ebrgohet sinjali SIGKILL.<\/p>\n
Megjith\u00ebse kjo thirrje e sistemit mund t\u00eb prodhoj\u00eb potencialisht vrasjen e procesit, sistemi nuk e ka kontrolluar adekuat t\u00eb drejtat e procesit q\u00eb th\u00ebrret thirrjen e sistemit. N\u00eb t\u00eb v\u00ebrtet\u00eb, kontrolli existon<\/a><\/noindex>, porashtu mjafton t\u00eb p\u00ebrdorni nj\u00eb flamur alternativ PROC_POLICY_ACTION_SET p\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb kusht.<\/p>\n
Nga k\u00ebtu, n\u00ebse \"kufizoni\" kuot\u00ebn e p\u00ebrdorimit t\u00eb CPU p\u00ebr aplikacionin (p\u00ebr shembull, lejoni t\u00eb ekzekutohet vet\u00ebm 1 ns), mund t\u00eb vrisni \u00e7do proces n\u00eb sistem. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, nj\u00eb malware mund t\u00eb eliminoj\u00eb \u00e7do proces n\u00eb sistem, duke p\u00ebrfshir\u00eb edhe procesin e antivirusit. Po ashtu, efekti q\u00eb ndodh kur vritet procesi me pid 1 (launchctl) \u00ebsht\u00eb mjaft interesant \u2014 panic i kernel-it kur p\u00ebrpiqet t\u00eb p\u00ebrpunoj\u00eb sinjalin SIGKILL \ud83d\ude42<\/p>\n
\"Si
\n<\/p>\n
Si t\u00eb zgjidhni problemin?<\/h3>\n
\nM\u00ebnyra m\u00eb e drejtp\u00ebrdrejt\u00eb p\u00ebr t\u00eb ndaluar vrasjen e procesit \u00ebsht\u00eb t\u00eb z\u00ebvend\u00ebsosh treguesin e funksionit n\u00eb tabel\u00ebn e thirrjeve sistemike. Fatkeq\u00ebsisht, ky metod\u00eb \u00ebsht\u00eb jo triviale p\u00ebr shum\u00eb arsye.<\/p>\n
S\u00eb pari, simboli q\u00eb ka t\u00eb b\u00ebj\u00eb me vendndodhjen e sysent n\u00eb memorie \u00ebsht\u00eb nj\u00eb simbol privat i b\u00ebrtham\u00ebs XNU dhe nuk mund t\u00eb gjendet n\u00eb simbolet e b\u00ebrtham\u00ebs. Do t\u00eb duhet t\u00eb p\u00ebrdorim metoda heuristike p\u00ebr k\u00ebrkimin, si\u00e7 \u00ebsht\u00eb disassamble dinamike e funksionit dhe k\u00ebrkimi i treguesit n\u00eb t\u00eb.<\/p>\n
S\u00eb pari, struktura e regjistrimeve n\u00eb tabel\u00eb varet nga flamujt me t\u00eb cil\u00ebt \u00ebsht\u00eb nd\u00ebrtuar b\u00ebrthama. N\u00ebse \u00ebsht\u00eb shpallur flamuri CONFIG_REQUIRES_U32_MUNGING, at\u00ebher\u00eb madh\u00ebsia e struktur\u00ebs do t\u00eb ndryshoj\u00eb - do t\u00eb shtohet nj\u00eb fush\u00eb shtes\u00eb. sy_arg_munge32<\/a><\/noindex>. \u00cbsht\u00eb e nevojshme t\u00eb kryhet nj\u00eb kontroll shtes\u00eb p\u00ebr at\u00eb me cilin flamur \u00ebsht\u00eb kompiluar b\u00ebrthama, si nj\u00eb mund\u00ebsi t\u00eb krahasohen treguesit n\u00eb funksione me ato t\u00eb njohura.<\/p>\n
struct sysent {         \/* tabela e thirrjeve sistemike *\/\n        sy_call_t       *sy_call;       \/* funksioni i implementimit *\/\n#if CONFIG_REQUIRES_U32_MUNGING || (__arm__ && (__BIGGEST_ALIGNMENT__ > 4))\n        sy_munge_t      *sy_arg_munge32; \/* muesi i argumenteve t\u00eb thirrjeve sistemike p\u00ebr procesin 32-bit *\/\n#endif\n        int32_t         sy_return_type; \/* tipet e kthimeve t\u00eb thirrjeve sistemike *\/\n        int16_t         sy_narg;        \/* numri i argumenteve *\/\n        uint16_t        sy_arg_bytes;   \/* Madh\u00ebsia totale e argumenteve n\u00eb bytes p\u00ebr\n                                         * thirrjet sistemike 32-bit\n                                         *\/\n};\n<\/code><\/pre>\n
\nP\u00ebr fat t\u00eb mir\u00eb, n\u00eb versionet moderne t\u00eb macOS, Apple ofron nj\u00eb API t\u00eb ri p\u00ebr t\u00eb punuar me proceset. Endpoint Security API lejon klient\u00ebt t\u00eb autorizojn\u00eb shum\u00eb k\u00ebrkesa p\u00ebr procese t\u00eb tjera. K\u00ebshtu, \u00ebsht\u00eb e mundur t\u00eb bllokohet \u00e7do sinjal p\u00ebr proceset, duke p\u00ebrfshir\u00eb sinjalin SIGKILL me an\u00eb t\u00eb API-s\u00eb t\u00eb p\u00ebrmendur m\u00eb lart.<\/p>\n
#include <bsm\/libbsm.h>\n#include <EndpointSecurity\/EndpointSecurity.h>\n#include <unistd.h>\n\nint main(int argc, const char * argv[]) {\n    es_client_t* cli = nullptr;\n    {\n        auto res = es_new_client(&cli, ^(es_client_t * client, const es_message_t * message) {\n            switch (message->event_type) {\n                case ES_EVENT_TYPE_AUTH_SIGNAL:\n                {\n                    auto& msg = message->event.signal;\n                    auto target = msg.target;\n                    auto& token = target->audit_token;\n                    auto pid = audit_token_to_pid(token);\n                    printf("signal '%d' sent to pid '%d'n", msg.sig, pid);\n                    es_respond_auth_result(client, message, pid == getpid() ? ES_AUTH_RESULT_DENY : ES_AUTH_RESULT_ALLOW, false);\n                }\n                    break;\n                default:\n                    break;\n            }\n        });\n    }\n\n    {\n        es_event_type_t evs[] = { ES_EVENT_TYPE_AUTH_SIGNAL };\n        es_subscribe(cli, evs, sizeof(evs) \/ sizeof(*evs));\n    }\n\n    printf("%dn", getpid());\n    sleep(60); \/\/ could be replaced with other waiting primitive\n\n    es_unsubscribe_all(cli);\n    es_delete_client(cli);\n\n    return 0;\n}\n<\/code><\/pre>\n
\nNj\u00eblloj si n\u00eb kernel, mund t\u00eb regjistrohet nj\u00eb Politika MAC, e cila ofron nj\u00eb metod\u00eb mbrojtjeje nga sinjalet (policy proc_check_signal), megjith\u00ebse API nuk mb\u00ebshtetet zyrtarisht.<\/p>\n
Mbrojtja e zgjerimit t\u00eb kernelit<\/h3>\n
\nP\u00ebrve\u00e7 mbrojtjes s\u00eb proceseve n\u00eb sistem, \u00ebsht\u00eb e nevojshme edhe mbrojtja e vet\u00eb zgjerimit t\u00eb kernelit (kext). macOS ofron nj\u00eb korniz\u00eb p\u00ebr zhvilluesit p\u00ebr zhvillimin e leht\u00eb t\u00eb drejtuesve t\u00eb pajisjeve IOKit. P\u00ebrve\u00e7 ofrimit t\u00eb mjeteve p\u00ebr pun\u00eb me pajisjet, IOKit siguron metoda p\u00ebr grumbullimin e drejtuesve (driver stacking) p\u00ebrmes instancave t\u00eb klasave C++. Nj\u00eb aplikacion n\u00eb userspace mund t\u00eb \"gjej\u00eb\" nj\u00eb instanc\u00eb t\u00eb regjistruar t\u00eb klas\u00ebs p\u00ebr t\u00eb vendosur nj\u00eb lidhje midis kernelit dhe userspace.<\/p>\n
P\u00ebr t\u00eb zbuluar numrin e instancave t\u00eb klasave n\u00eb sistem, ekziston nj\u00eb utilitar i quajtur ioclasscount.<\/p>\n
my_kext_ioservice = 1\nmy_kext_iouserclient = 1\n<\/code><\/pre>\n
\n\u00c7do zgjerim kernelit q\u00eb d\u00ebshiron t\u00eb regjistrohet n\u00eb grumbullin e drejtuesve \u00ebsht\u00eb i detyruar t\u00eb shpall\u00eb nj\u00eb klas\u00eb t\u00eb trash\u00ebguar nga IOService, p\u00ebr shembull, my_kext_ioservice n\u00eb k\u00ebt\u00eb rast. Lidha e aplikacioneve t\u00eb p\u00ebrdoruesit shkakton krijimin e nj\u00eb instanc\u00eb t\u00eb re t\u00eb klas\u00ebs q\u00eb trash\u00ebgohet nga IOUserClient, n\u00eb shembullin my_kext_iouserclient.<\/p>\n
Kur gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb shkarkuar drejtuesin nga sistemi (komanda kextunload), thirret funksioni virtual \u201cbool terminate(IOOptionBits options)\u201d. Mjafton t\u00eb kthehet false n\u00eb thirrjen e funksionit terminate gjat\u00eb p\u00ebrpjekjes p\u00ebr shkarkim, p\u00ebr t\u00eb ndaluar kextunload.<\/p>\n
bool Kext::terminate(IOOptionBits options)\n{\n\n  if (!IsUnloadAllowed)\n  {\n    \/\/ Shkarkimi nuk lejohet, po kthehet false\n    return false;\n  }\n\n  return super::terminate(options);\n}\n\n<\/code><\/pre>\n
\nFlamuri IsUnloadAllowed mund t\u00eb vendoset nga IOUserClient gjat\u00eb ngarkimit. Kur ndalohet ngarkimi, komanda kextunload do t\u00eb kthej\u00eb daljen e m\u00ebposhtme:<\/p>\n
admin@admins-Mac drivermanager % sudo kextunload .\/test.kext\nFjal\u00ebkalimi:\n(kernel) Nuk mund t\u00eb hiqet kext my.kext.test; sh\u00ebrbimet d\u00ebshtuan p\u00ebr t'u ndaluar - 0xe00002c7.\nD\u00ebshtoi t\u00eb shkarkoj\u00eb my.kext.test - (iokit\/common) funksion i pavlefsh\u00ebm.\n<\/code><\/pre>\n
\nNj\u00eb mbrojtje t\u00eb ngjashme duhet t\u00eb b\u00ebhet edhe p\u00ebr IOUserClient. Instancat e klasave mund t\u00eb shkaktohen p\u00ebrmes funksionit t\u00eb userspace IOKitLib \u201cIOCatalogueTerminate(mach_port_t, uint32_t flag, io_name_t description);\u201d. Mund t\u00eb kthehen false n\u00eb thirrjen e komand\u00ebs \u201cterminate\u201d derisa aplikacioni i userspace t\u00eb \u201cvdes\u00eb\u201d, dometh\u00ebn\u00eb, derisa t\u00eb ndodhi thirrja e funksionit \u201cclientDied\u201d.<\/p>\n
Mbrojtja e skedar\u00ebve<\/h3>\n
\nP\u00ebr mbrojtjen e skedareve, mjafton t\u00eb p\u00ebrdorni Kauth API, i cili lejon kufizimin e aksesit n\u00eb skedare. Apple u siguron zhvilluesve njoftime p\u00ebr ngjarje t\u00eb ndryshme n\u00eb scope, ku p\u00ebr ne jan\u00eb t\u00eb r\u00ebnd\u00ebsishme operacionet KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA dhe KAUTH_VNODE_DELETE_CHILD. Kufizimi i aksesit n\u00eb skedare \u00ebsht\u00eb m\u00eb i thjesht\u00eb n\u00ebp\u00ebrmjet rrug\u00ebs \u2014 p\u00ebrdorim API-n\u00eb \u201cvn_getpath\u201d p\u00ebr t\u00eb marr\u00eb rrug\u00ebn drejt skedarit dhe b\u00ebjm\u00eb krahasimin e prefix-it t\u00eb rrug\u00ebs. Vlen t\u00eb theksohet se p\u00ebr optimizimin e rinovimit t\u00eb rrug\u00ebve t\u00eb dosjeve, sistemi nuk autorizon aksesin n\u00eb \u00e7do skedar, por vet\u00ebm n\u00eb dosjen q\u00eb \u00ebsht\u00eb rinovuar. \u00cbsht\u00eb e nevojshme t\u00eb b\u00ebhet krahasimi i rrug\u00ebs prind dhe t\u00eb kufizohet KAUTH_VNODE_DELETE p\u00ebr t\u00eb.<\/p>\n
\"Si
\n
\nNj\u00eb mang\u00ebsi e k\u00ebtij qasjeje mund t\u00eb jet\u00eb performanca e ul\u00ebt n\u00eb rritjen e numrit t\u00eb prefix-eve. P\u00ebr t\u00eb siguruar q\u00eb krahasimi t\u00eb mos jet\u00eb O(prefix*length), ku prefix \u00ebsht\u00eb numri i prefix-eve dhe length \u00ebsht\u00eb gjat\u00ebsia e vargut, mund t\u00eb p\u00ebrdorim nj\u00eb automat\u00eb t\u00eb fund\u00ebm deterministik (DFA), t\u00eb nd\u00ebrtuar sipas prefix-eve. <\/p>\n
Le t\u00eb shqyrtojm\u00eb metod\u00ebn e nd\u00ebrtimit t\u00eb DKA p\u00ebr k\u00ebt\u00eb grup prefixesh. Inicializojm\u00eb kursoret n\u00eb fillim t\u00eb \u00e7do prefixi. N\u00ebse t\u00eb gjith\u00eb kursoret tregojn\u00eb p\u00ebr t\u00eb nj\u00ebjtin simbol, rrisim secilin kursor me nj\u00eb simbol dhe mbajm\u00eb mend se gjat\u00ebsia e vargjeve t\u00eb nj\u00ebjta \u00ebsht\u00eb rritur me nj\u00eb. N\u00ebse ka dy kursore, simbolet n\u00ebn t\u00eb cilat ndodhen jan\u00eb t\u00eb ndryshme, ndajm\u00eb kursoret n\u00eb grupe sipas simbolit q\u00eb ato tregojn\u00eb dhe p\u00ebrs\u00ebrisim algoritmin p\u00ebr secil\u00ebn grup.<\/p>\n
N\u00eb rastin e par\u00eb (kur t\u00eb gjitha simbolet n\u00ebn kursore jan\u00eb t\u00eb nj\u00ebjta) p\u00ebrftojm\u00eb gjendjen DKA, e cila ka vet\u00ebm nj\u00eb kalim sipas vargut t\u00eb nj\u00ebjt\u00eb. N\u00eb rastin e dyt\u00eb, marrim nj\u00eb tabel\u00eb kalimi me madh\u00ebsi 256 (numri i simboleve dhe numri maksimal i grupeve) p\u00ebr gjendjet e ardhshme, t\u00eb marra gjat\u00eb thirrjes rekurzive t\u00eb funksionit.<\/p>\n
Le t\u00eb shqyrtojm\u00eb nj\u00eb shembull. P\u00ebr grupin e prefixeve (\u201c\/foo\/bar\/tmp\/\u201d, \u201c\/var\/db\/foo\/\u201d, \u201c\/foo\/bar\/aba\/\u201d, \u201cfoo\/bar\/aac\/\u201d) mund t\u00eb p\u00ebrftojm\u00eb k\u00ebt\u00eb DKA. N\u00eb ilustrim jan\u00eb treguar vet\u00ebm kalimet q\u00eb \u00e7ojn\u00eb n\u00eb gjendje t\u00eb tjera, kalimet e tjera nuk do t\u00eb jen\u00eb p\u00ebrfundimtare.<\/p>\n
\"Si
\n
\nGjat\u00eb kalimit p\u00ebrmes gjendjeve t\u00eb DKA mund t\u00eb ndodhin 3 raste.<\/p>\n
    \n
  1. Arrithet nj\u00eb gjendje p\u00ebrfundimtare - rruga \u00ebsht\u00eb e sigurt, kufizoni operacionet KAUTH_VNODE_DELETE, KAUTH_VNODE_WRITE_DATA dhe KAUTH_VNODE_DELETE_CHILD<\/li>\n
  2. Nuk \u00ebsht\u00eb arritur nj\u00eb gjendje p\u00ebrfundimtare, por rruga \"mbaroi\" (u arrit zero-terminatori) - rruga \u00ebsht\u00eb prind, \u00ebsht\u00eb e nevojshme t\u00eb kufizohet KAUTH_VNODE_DELETE. V\u00ebreni se n\u00ebse vnode \u00ebsht\u00eb nj\u00eb dosje, duhet t\u00eb shtoni n\u00eb fund \u2018\/\u2019, ndryshe mund t\u00eb ndodhi kufizimi n\u00eb skedarin \u201c\/foor\/bar\/t\u201d, q\u00eb \u00ebsht\u00eb e gabuar.<\/li>\n
  3. Nuk \u00ebsht\u00eb arritur nj\u00eb gjendje p\u00ebrfundimtare, rruga nuk mbaroi. Asnj\u00eb nga prefiks\u00ebt nuk p\u00ebrputhet me k\u00ebt\u00eb, nuk vendosim kufizime.<\/li>\n<\/ol>\n
    <\/p>\n
    P\u00ebrfundimi<\/h3>\n
    \nQ\u00ebllimi i zgjidhjeve t\u00eb siguris\u00eb q\u00eb po zhvillohen \u00ebsht\u00eb rritja e nivelit t\u00eb siguris\u00eb p\u00ebr p\u00ebrdoruesin dhe t\u00eb dh\u00ebnat e tij. Nga nj\u00ebra an\u00eb, ky q\u00ebllim sigurohet p\u00ebrmes zhvillimit t\u00eb produktit software Acronis, i cili mbulon ato dobie ku \"\u00ebsht\u00eb e dob\u00ebt\" vet\u00eb sistemi operativ. Nga ana tjet\u00ebr, nuk duhet t\u00eb injorojm\u00eb forcimin e aspekteve t\u00eb siguris\u00eb q\u00eb mund t\u00eb p\u00ebrmir\u00ebsohen nga ana e OS, ve\u00e7an\u00ebrisht sepse mbyllja e till\u00eb e dob\u00ebsive rrit stabilitetin ton\u00eb si produkt. Dob\u00ebsia u raportua nga Apple Product Security Team dhe u rregullua n\u00eb macOS 10.14.5 (https:\/\/support.apple.com\/en-gb\/HT210119).<\/p>\n
    \"Si
    \n
    \nT\u00eb gjitha k\u00ebto mund t\u00eb b\u00ebhen vet\u00ebm n\u00ebse utilitari juaj \u00ebsht\u00eb instaluar zyrtarisht n\u00eb bllok. K\u00ebshtu, p\u00ebr software q\u00eb \u00ebsht\u00eb i jasht\u00ebm dhe i pad\u00ebshiruar nuk ka skema t\u00eb tilla. Megjithat\u00eb, si\u00e7 e shihni, edhe p\u00ebr mbrojtjen e programeve legjitime, si antivirus dhe sistemi i kopjimit, k\u00ebrkohet p\u00ebrpjekje. Por tani produktet e reja Acronis p\u00ebr macOS do t\u00eb ken\u00eb mbrojtje shtes\u00eb nga shkarkimi nga sistemi.
    \n
    Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si t\u00eb mbroni proceset dhe zgjerimet e b\u00ebrtham\u00ebs n\u00eb macOS | ProHoster","description":"P\u00ebrsh\u00ebndetje, Habr! Sot d\u00ebshiroj t\u00eb flas mbi m\u00ebnyrat sesi mund t\u00eb mbrohen proceset nga nd\u00ebrhyrjet e haker\u00ebve n\u00eb macOS. Kjo \u00ebsht\u00eb ve\u00e7an\u00ebrisht e dobishme p\u00ebr antivirusin ose sistemin e backup-it, sidomos p\u00ebr shkak se n\u00eb macOS ekzistojn\u00eb disa m\u00ebnyra p\u00ebr \"t\u00eb vrar\u00eb\" nj\u00eb proces. Lexoni m\u00eb shum\u00eb rreth k\u00ebsaj dhe metodave t\u00eb mbrojtjes m\u00eb posht\u00eb. M\u00ebnyra klasike p\u00ebr \"t\u00eb vrar\u00eb\" nj\u00eb proces \u00ebsht\u00eb e njohur p\u00ebr t\u00eb gjith\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430 \u0432 macOS | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u043e\u0442 \u043f\u043e\u0441\u044f\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 macOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u044d\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0441\u0432\u0435\u0442\u0435 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u0434 macOS \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041e\u0431 \u044d\u0442\u043e\u043c \u0438 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 \u0437\u0430\u0449\u0438\u0442\u044b \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u201c\u0443\u0431\u0438\u0442\u044c\u201d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0412\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-zashhishhat-proczessy-i-rasshireniya-yadra-v-macos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T23:42:32+00:00","article:modified_time":"2020-04-19T23:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78514","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:56:36","updated":"2022-09-28 22:19:40"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=78514"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/78515"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=78514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=78514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=78514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}