{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Release of Bubblewrap 0.4.0, a layer for creating isolated environments","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

M\u00f6vcuddur<\/a><\/noindex> yeni burax\u0131l\u0131\u015f al\u0259tl\u0259ri Bubblewrap 0.4.0<\/a><\/noindex>, izolyasiyal\u0131 m\u00fchitl\u0259rin idar\u0259 olunmas\u0131 \u00fc\u00e7\u00fcn n\u0259z\u0259rd\u0259 tutulmu\u015fdur Linux-da v\u0259 t\u0259tbiq s\u0259viyy\u0259sind\u0259 qeyri-privilegiyal\u0131 istifad\u0259\u00e7il\u0259r s\u0259viyy\u0259sind\u0259 f\u0259aliyy\u0259t g\u00f6st\u0259rir. Praktikada Bubblewrap, paketl\u0259rd\u0259ki t\u0259tbiql\u0259rin izolyasiyas\u0131 \u00fc\u00e7\u00fcn bir ara qat olaraq Flatpak layih\u0259si t\u0259r\u0259find\u0259n istifad\u0259 olunur. Layih\u0259nin kodu C dilind\u0259 yaz\u0131lm\u0131\u015fd\u0131r v\u0259 yay\u0131l\u0131r<\/a><\/noindex> LGPLv2+ lisenziyas\u0131 alt\u0131nda.<\/p>\n

\u0130zolyasiya \u00fc\u00e7\u00fcn Linux-da \u0259n\u0259n\u0259vi konteyner virtualizasiya texnologiyalar\u0131ndan istifad\u0259 olunur, bunlar cgroups, adlar m\u0259kanlar\u0131 (namespaces), Seccomp v\u0259 SELinux-dan istifad\u0259 edir. Konteynerin konfiqurasiyas\u0131 \u00fc\u00e7\u00fcn privilegiyal\u0131 \u0259m\u0259liyyatlar\u0131n yerin\u0259 yetirilm\u0259si Bubblewrap-\u0131n root h\u00fcquqlar\u0131 il\u0259 (suid flag-\u0131 il\u0259 icra edil\u0259n fayl) i\u015f\u0259 sal\u0131nmas\u0131 il\u0259 h\u0259yata ke\u00e7irilir v\u0259 konteynerin ba\u015flan\u011f\u0131c\u0131ndan sonra h\u00fcquqlar\u0131n l\u0259\u011fv edilm\u0259si il\u0259 davam etdirilir. <\/p>\n

\u0130stifad\u0259\u00e7i adlar\u0131 \u00fc\u00e7\u00fcn identifikatorlar (user namespaces) sisteminin aktivl\u0259\u015fdirilm\u0259si, konteynerl\u0259rd\u0259 ayr\u0131 bir identifikatorlar d\u0259stini istifad\u0259 etm\u0259y\u0259 imkan tan\u0131mas\u0131na baxmayaraq, \u00e7oxsayl\u0131 payla\u015f\u0131lan da\u011f\u0131t\u0131mlarda standart olaraq i\u015fl\u0259mir, buna g\u00f6r\u0259 d\u0259 t\u0259l\u0259b olunmur. Bubblewrap, identifikasiya m\u00fchitind\u0259n b\u00fct\u00fcn istifad\u0259\u00e7i v\u0259 proses identifikatorlar\u0131n\u0131 \u00e7\u0131xarmaq \u00fc\u00e7\u00fcn CLONE_NEWUSER v\u0259 CLONE_NEWPID rejiml\u0259rind\u0259n istifad\u0259 ed\u0259r\u0259k, m\u0259hdud bir suid-implementasiyas\u0131 kimi t\u0259qdim edilir. \u018flav\u0259 qoruma \u00fc\u00e7\u00fcn, yerin\u0259 yetiril\u0259n \u0259mrl\u0259r
\n Bubblewrap il\u0259 idar\u0259 olunan proqramlar PR_SET_NO_NEW_PRIVS rejimind\u0259 i\u015f\u0259 sal\u0131n\u0131r, bu da yeni h\u00fcquqlar\u0131n \u0259ld\u0259 edilm\u0259sini, m\u0259s\u0259l\u0259n, setuid flaq\u0131na malik olduqda qada\u011fan edir. <\/p>\n

Fayl sistemind\u0259 izolyasiya, standart olaraq yeni montaj m\u0259kan\u0131n\u0131n (mount namespace) yarad\u0131lmas\u0131 il\u0259 h\u0259yata ke\u00e7irilir. Burada tmpfs yard\u0131m\u0131 il\u0259 bo\u015f k\u00f6k b\u00f6lm\u0259si yarad\u0131l\u0131r. Laz\u0131m g\u0259ldikd\u0259, bu b\u00f6lm\u0259y\u0259 xarici fayl sisteminin b\u00f6lm\u0259l\u0259ri \u00abmount \u2014bind\u00bb rejimind\u0259 qo\u015fulur (m\u0259s\u0259l\u0259n, \u00abbwrap \u2014ro-bind \/usr \/usr\u00bb se\u00e7imi il\u0259 ba\u015flatd\u0131qda, \/usr b\u00f6lm\u0259si \u0259sas sistemd\u0259n yaln\u0131z oxumaq rejimind\u0259 \u00f6t\u00fcr\u00fcl\u00fcr). \u015e\u0259b\u0259k\u0259 imkanlar\u0131, \u015f\u0259b\u0259k\u0259 y\u0131\u011f\u0131n\u0131n\u0131n izolyasiyas\u0131 \u00fc\u00e7\u00fcn CLONE_NEWNET v\u0259 CLONE_NEWUTS bayraqlar\u0131 vasit\u0259sil\u0259 loopback interfeysin\u0259 giri\u015fl\u0259 m\u0259hdudla\u015fd\u0131r\u0131l\u0131r.<\/p>\n

Buna b\u0259nz\u0259r layih\u0259l\u0259rd\u0259n \u0259h\u0259miyy\u0259tli f\u0259rqi Firejail<\/a><\/noindex>, setuid istifad\u0259 ed\u0259r\u0259k i\u015f modelini eyni c\u00fcr t\u0259tbiq ed\u0259n, lakin Bubblewrap-da konteynerl\u0259rin yarad\u0131lmas\u0131 \u00fc\u00e7\u00fcn ara qat\u0131 yaln\u0131z laz\u0131m olan minimum imtiyazlardan ibar\u0259tdir, b\u00fct\u00fcn geni\u015fl\u0259ndirilmi\u015f funksiyalar, x\u00fcsusil\u0259 qrafik t\u0259tbiql\u0259rin ba\u015flan\u011f\u0131c\u0131, masa\u00fcst\u00fc il\u0259 qar\u015f\u0131l\u0131ql\u0131 \u0259laq\u0259 v\u0259 Pulseaudio-ya m\u00fcraci\u0259tl\u0259rin filtr edilm\u0259si Flatpak t\u0259r\u0259find\u0259 saxlan\u0131l\u0131r v\u0259 h\u00fcquqlar\u0131n l\u0259\u011fv olunmas\u0131ndan sonra h\u0259yata ke\u00e7irilir. Firejail is\u0259 bir icra fayl\u0131nda b\u00fct\u00fcn \u0259laq\u0259dar funksiyalar\u0131 birl\u0259\u015fdirir ki, bu da onun audibini v\u0259 t\u0259hl\u00fck\u0259sizliyini m\u00fchafiz\u0259 etm\u0259yi \u00e7\u0259tinl\u0259\u015fdirir y\u00fcks\u0259k s\u0259viyy\u0259d\u0259<\/a><\/noindex>.<\/p>\n

Yeni burax\u0131l\u0131\u015f, m\u00f6vcud istifad\u0259\u00e7i adlar\u0131 (user namespaces) v\u0259 prosesl\u0259r (pid namespaces) m\u0259kanlar\u0131n\u0131n qo\u015fulmas\u0131 \u00fc\u00e7\u00fcn d\u0259st\u0259yin h\u0259yata ke\u00e7irilm\u0259si il\u0259 se\u00e7ilir. M\u0259kanlar\u0131n qo\u015fulmas\u0131n\u0131 idar\u0259 etm\u0259k \u00fc\u00e7\u00fcn \u00ab\u2014userns\u00bb, \u00ab\u2014userns2\u00bb v\u0259 \u00ab\u2014pidns\u00bb bayraqlar\u0131 \u0259lav\u0259 olunmu\u015fdur.
\nBu imkan setuid rejimind\u0259 i\u015fl\u0259mir v\u0259 root h\u00fcquqlar\u0131 olmadan i\u015fl\u0259y\u0259 bil\u0259n ayr\u0131ca rejimin t\u0259tbiqini t\u0259l\u0259b edir, amma
\nsistemd\u0259 user namespaces-in aktivl\u0259\u015fdirilm\u0259sini t\u0259l\u0259b edir (Debian v\u0259 RHEL\/CentOS-da defolt olaraq deaktivdir) v\u0259 istismar etm\u0259 imkan\u0131n\u0131 istisna etmir.<\/a><\/noindex> potensial<\/a><\/noindex> qalanlar<\/a><\/noindex> t\u0259hl\u00fck\u0259sizlik bo\u015fluqlar\u0131n\u0131<\/a><\/noindex> \u00abuser namespaces\u00bb m\u0259hdudiyy\u0259tl\u0259rin\u0259 uy\u011fun olaraq. Bubblewrap 0.4-\u00fcn yeni imkanlar\u0131 aras\u0131nda musl C kitabxanas\u0131 il\u0259 glibc \u0259v\u0259zin\u0259 y\u0131\u011f\u0131lmas\u0131 v\u0259 JSON format\u0131nda statistikaya dair m\u0259kan m\u0259lumatlar\u0131n\u0131n bir faylda saxlan\u0131lmas\u0131 d\u0259st\u0259yi qeyd edilir.<\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bubblewrap 0.4.0 burax\u0131l\u0131\u015f\u0131, izolyasiya olunmu\u015f m\u00fchitl\u0259rin yarad\u0131lmas\u0131 \u00fc\u00e7\u00fcn ara qat | ProHoster","description":"Yeni al\u0259t d\u0259sti burax\u0131ld\u0131","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}