{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Udgivelse af Bubblewrap 0.4.0, laget til at skabe isolerede milj\u00f8er","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tilg\u00e6ngelig<\/a><\/noindex> ny udgave af v\u00e6rkt\u00f8jer Bubblewrap 0.4.0<\/a><\/noindex>, designet til at organisere arbejdet med isolerede milj\u00f8er i Linux og fungerer p\u00e5 niveauet for applikationsprivilegier. I praksis bruges Bubblewrap af Flatpak-projektet som et lag til at isolere de applikationer, der k\u00f8rer fra pakker. Koden til projektet er skrevet i C og distribueres<\/a><\/noindex> er licenseret under LGPLv2+.<\/p>\n

Isolationen bruger traditionelle container-virtualiseringsteknologier for Linux, baseret p\u00e5 cgroups, namespaces, Seccomp og SELinux. For at udf\u00f8re privilegerede operationer til konfiguration af containeren startes Bubblewrap med root-rettigheder (eksekverbar fil med suid-flag) og f\u00e5r derefter nulstillet privilegierne efter afslutningen af containerens initialisering. <\/p>\n

Aktivering af systemet til brug af bruger-id-navnerum (user namespaces), som muligg\u00f8r anvendelse af et separat s\u00e6t af id'er i containere, kr\u00e6ves ikke, da det som standard ikke fungerer i mange distributioner (Bubblewrap positionerer sig som en begr\u00e6nset suid-implementering af et subset af funktionerne i bruger-id-navnerum \u2014 for at udelukke alle bruger- og proces-id'er fra milj\u00f8et, bortset fra det aktuelle, anvendes tilstandene CLONE_NEWUSER og CLONE_NEWPID). For yderligere beskyttelse er udf\u00f8relsen under kontrol af
\n Bubblewrap i PR_SET_NO_NEW_PRIVS-tilstand, der forhindrer opn\u00e5else af nye privilegier, f.eks. ved tilstedev\u00e6relse af setuid-flaget. <\/p>\n

Filsystemisoleringen sker gennem oprettelse af et nyt monteringsnavnrum (mount namespace) som standard, hvorved der oprettes en tom rodpartition ved hj\u00e6lp af tmpfs. I denne partition monteres eksterne filsystempartitioner efter behov i 'mount --bind' tilstand (for eksempel, n\u00e5r du starter med indstillingen 'bwrap --ro-bind \/usr \/usr' g\u00f8res partitionen \/usr tilg\u00e6ngelig fra hovedsystemet i skrivebeskyttet tilstand). Netv\u00e6rksmulighederne begr\u00e6nses til adgang til loopback-gr\u00e6nsefladen med isolering af netv\u00e6rksstakken via flags CLONE_NEWNET og CLONE_NEWUTS.<\/p>\n

N\u00f8gleforskellen fra det lignende projekt Firejail<\/a><\/noindex>, som ogs\u00e5 bruger en k\u00f8re-model med setuid, adskiller sig fra Bubblewrap ved at container-laget kun inkluderer det n\u00f8dvendige minimum af funktionaliteter, mens alle udvidede funktioner, der kr\u00e6ves for at k\u00f8re grafiske applikationer, interagere med skrivebordet og filtrere anmodninger til Pulseaudio, er flyttet til Flatpak, der udf\u00f8res efter at privilegierne er blevet nulstillet. Firejail, derimod, samler alle de tilh\u00f8rende funktioner i \u00e9n eksekverbar fil, hvilket komplicerer dens revision og opretholdelse af sikkerheden p\u00e5 det rette niveau.<\/a><\/noindex>.<\/p>\n

Den nye version er bem\u00e6rkelsesv\u00e6rdig for implementeringen af st\u00f8tte til tilslutning af eksisterende bruger-id-navnerum (user namespaces) og procesnavnerum (pid namespaces). For at styre tilslutningen af navnerum er der tilf\u00f8jet flagene \u00ab--userns\u00bb, \u00ab--userns2\u00bb og \u00ab--pidns\u00bb.
\nDenne mulighed fungerer ikke i setuid-tilstand og kr\u00e6ver anvendelse af en separat tilstand, der kan fungere uden at opn\u00e5 root-rettigheder, men kr\u00e6ver aktivering af
\nuser namespaces i systemet (er som standard deaktiveret i Debian og RHEL\/CentOS) og udelukker ikke muligheden udnyttelse<\/a><\/noindex> potentielt<\/a><\/noindex> for at forblive<\/a><\/noindex> af s\u00e5rbarheder<\/a><\/noindex> for at opretholde gr\u00e6nserne for \u00abuser namespaces\u00bb. Blandt de nye funktioner i Bubblewrap 0.4 bem\u00e6rkes ogs\u00e5 muligheden for at kompilere med C-biblioteket musl i stedet for glibc samt st\u00f8tte til at gemme information om navnerum i en statistikfil i JSON-format.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release of Bubblewrap 0.4.0, a layer for creating isolated environments | ProHoster","description":"A new release of the toolset is available","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}