Log #3 - challenge, LFCS & CKS

How socket works? Do you secure your k8s bruh? stratum and some AI math

1. Iximuiz - Restrict Access to a Unix Domain Socket

Hard problem for me b/c i don’t have experience manaing socket.

Basically this question is asking me to secure /run/deployd.sock and make sure the permissions survive service restart.

Currently /run/deployd. looks like this:

laborant@ubuntu-01:~$ ls -l /run/deployd.sock
srw-rw-rw- 1 root root 0 Nov 13 09:39 /run/deployd.sock

We have to change it so it become sth like this:

laborant@ubuntu-01:~$ ls -l /run/deployd.sock
srw-rw-rw- 1 root deploy 0 Nov 13 09:39 /run/deployd.sock

If we use the normal chgrp and chmod on the deployd.sock would WORK but temporary. So I know for sure i have to change something on the /etc/systemd/system/deployd.service

This is the part is stuck b/c i thought to myself well there has to be sth likle User and Group under systemd.serivce. Well we can use Group=deploy and UMask=0007 and call it a day.

BUT the problem is that would change the entire daemon process and not just socket.

The one solution i found out was to use .docket file service from systemctl. The problem of that is this daemon should be desined that way.

For example if you are on ubunut check: systemctl cat sshd.socket And systemctl cat sshd.service

On boot first socket is created and when there is ssh connection to port 22 (to socket) the service will run.

I couldn’t make this setup work for this challenge so i saw the solution and it was just too easy 🤦

How about running something post creation? Let me introduce you to ExecStartPost= hook. In this challenge systemd is starting the daemon we are going to use the systemctl to re-own and re-mode the socket.

Edit the deployd.service using: sudo SYSTEMCTL_EDITOR=vim systemctl edit deployd.service

And put this script in the file:

[Service]
ExecStartPost=/bin/sh -c 'until [ "$(deployctl PING)" = "PONG" ]; do sleep 0.1; done; chgrp deploy /run/deployd.sock; chmod 0660 /run/deployd.sock'

After systemd starts the deployd daemon, ExecStartPost runs a shell script that waits until the daemon is ready by repeatedly sending deployctl PING and checking whether the response is PONG. If the response isn’t PONG, it waits 0.1 seconds and tries again. Once the daemon responds, the script changes the socket’s group ownership to deploy using chgrp, then sets its permissions to 0660 using chmod, allowing only the owner (root) and members of the deploy group to connect. Since ExecStartPost runs every time the service starts, these permissions are reapplied after each restart.

Really fun challenge.

1. Iximuiz - Recover an Ingestion Service After a VM Upgrade Need review

After going to through this I saw I have a skill gap in storage department so I went to finish kodekloud lfcs storage chapter I am going to take this cert so i might better to fill the gap as i go.

The full flow looks like this:

1. cfkdis: split the disk into paritions (draw the walls)
2. mkfs: put a filesystem on a parition (furnish the room)
3. mount: connect it to a folder so you can use it (open the door)

Also found another (seemingly) good book for just linux storage Architecture and design of the linux storage stack Seems really interesting.

Will come back to this, right now we have to do our ckad,cka,cks session.

I already got the ckad and cka 2 years ago. Just to need to review some stuff so I can be ready for CKS. Specially Gateway API.

Finish lightning exam with 100% score.

Finish another Mock-Exam - 1 with 98% score.

Finish Mock-Exam - 2 with 100% score.