Menene Harin Harin Harin Hari Mai Tsalle Yana da Muhimmanci?
Ana amfani da ƙananan harsashi don sarrafa abin da masu amfani za su iya aiwatarwa, sau da yawa suna hana ayyuka kamar cd, ƙaddamar da sabbin harsashi, ko fitar da masu canjin yanayi. Yawanci ana amfani da su a cikin CI/CD wakilai ko muhallin ginawa don iyakance halayen mai amfani. Duk da haka, masu kai hari suna neman hanyoyin yin harsashi mai tsalle, hanyar da ake amfani da ita don tserewa daga yanayin harsashi mai ƙuntatawa da kuma samun damar shiga harsashi mara iyaka kamar bin/bashiDa zarar an shiga ciki it, maharin yana da cikakken ikon sarrafa layin umarni, yana ketare duk iyakokin yanayin da aka hana.
Yadda Tsalle-tsalle ke Aiki: Daga Ƙayyadadden Bayani zuwa kwandon shara/bash
Manufar harsashi mai tsalle shine amfani da raunin da ke cikin mahalli masu ƙuntatawa da kuma haifar da tserewa daga harsashi wanda ke haifar da bin/bashiDabaru na yau da kullun don hare-haren harsashi da aka takaita gudu sun haɗa da:
$ ls /bin/bash $ /bin/bashIf bin/bashi yana da sauƙin samu, wannan kira mai sauƙi ya kammala shi.
Wata hanya ta gama gari:
$ echo "/bin/bash" > run.sh $ sh run.sh Masu kai hari na iya amfani da editoci kamar vi or Kadan:
vi :set shell=/bin/bash :shell Waɗannan hanyoyin suna nuna yadda harsashi mai tsalle zai iya kaiwa cikin sauƙi bin/bashi aiwatarwa, ta hanyar kaucewa kariyar harsashi da aka takaita.
Haɗarin Gaske na Waɗannan Hare-hare a cikin DevOps
A cikin rabawa CI/CD muhalli, ana amfani da ƙananan harsashi don ware abubuwan da ke ginawa da rage haɗari. Amma idan maharin ya yi nasara da harsashi mai tsalle ya kai bin/bashi, tsarin tsaro ya ruguje.
Hadarin ya hada da:
- Samun damar shiga sirrin muhalli ba tare da izini ba
- Ƙara gata ta hanyar rashin iyaka bin/bashi
- Gyaran ginin pipelines ko kayan tarihi
- Shigar da kayan aiki masu ɗorewa a cikin pipeline
An takaita harsashin tserewa zuwa bin/bashi yana buɗe ƙofa ga cikakken sulhu na tsarin, sau da yawa mataki na farko a cikin faɗaɗa Harin DevSecOps.
Kulawa da Gano Tsalle-tsallen Harsashi da kuma Kwandon Shara/Bash
Domin gano halayen harsashin tsalle da kuma yunƙurin toshe harsashin da aka takaita guduwa, dole ne ƙungiyoyin tsaro su:
- Rubuta duk wani aiki na musamman, musamman / bin / bash kisa
- Kula da cin zarafin edita da amfani da rubutun yayin da ake amfani da ƙwayoyin cuta na harsashi
- Bin diddigin damar shiga fayilolin saitin harsashi kamar .bashrc or .bash_profile
Tsarin tsare-tsare kamar gabatarwa bin/bashi Ya kamata a yi la'akari da faɗakarwa daga muhalli mai tsauri. Gano shi da wuri zai iya hana motsi mai zurfi a gefe.
Hana Hare-haren Hari da Amfani da Makamai Masu Takurawa a Gujewa
Don rage haɗarin tsalle-tsalle da kuma hana maharan harbawa bin/bashi:
- Taurare harsashi masu ƙuntatawa: Cire ko toshe shi access
- Yi amfani da AppArmor ko SELinux don takaita aiwatar da umarni
- Aiwatar da mafi ƙarancin gata a duk faɗin CI/CD matsayi da masu gudu
- Gine-ginen kwantena tare da hotuna marasa rarrabawa marasa harsashi kamar bin/bashi
- Tabbatar da yanayin kafin da bayan ginawa don gano abubuwan da ba su dace ba
Hana yanayin harsashi mai ƙuntatawa don tserewa yana buƙatar sarrafawa mai layi, ba kawai dogaro da ƙananan harsashi ba. Kada ku ɗauka cewa ƙananan harsashi suna da aminci idan bin/bashi har ma ana iya isa gare shi.
Kammalawa: Tafiye-tafiyen Shell sune wuraren shiga
Harsasai masu iyaka wani matakin kariya ne, ba garanti ba. Hare-haren harsashi masu tsalle suna kai hari kan raunin warewa da rashin ingantaccen inganci. Da zarar an shiga ciki / bin / bash, masu kai hari za su iya yin juyi, ci gaba, da kuma lalata kayayyakin more rayuwa na DevSecOps.
Ganowa da killacewa suna da mahimmanci. Haɗa rajistar umarni, muhallin da aka takaita, da kuma tsaftace manajojin fakiti yadda ya kamata yana rage fallasa.
A ƙarshe, kayan aiki kamar Xygeni suna ba da damar fahimtar waɗannan haɗarin. Suna taimakawa wajen aiwatar da sahihancin lambar, gano halayen harsashi na musamman, da kuma tabbatar da naka pipelinedaga barazanar ciki da waje, gami da waɗanda suka fara da harsashi mai tsalle zuwa / bin / bash ko ƙoƙarin tserewa daga yanayin da aka hana harsashi.
