{"id":111644,"date":"2023-11-21T03:10:16","date_gmt":"2023-11-21T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov"},"modified":"2023-11-21T03:10:16","modified_gmt":"2023-11-21T01:10:16","slug":"v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","title":{"rendered":"In Fedora 40 wird geplant, die Isolierung von Systemdiensten einzuf\u00fchren.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In der Fedora 40-Version wird vorgeschlagen, Isolationseinstellungen f\u00fcr standardm\u00e4\u00dfig aktivierte systemd-Systemdienste sowie f\u00fcr Dienste mit wichtigen Anwendungen wie PostgreSQL, Apache httpd, Nginx und MariaDB aufzunehmen. Es wird angenommen, dass diese \u00c4nderung die Sicherheit der Distribution in der Standardkonfiguration erheblich verbessern und die M\u00f6glichkeit bieten wird, unbekannte Schwachstellen in Systemdiensten zu blockieren. Der Vorschlag wurde bisher vom FESCo-Komitee (Fedora Engineering Steering Committee), das f\u00fcr den technischen Teil der Entwicklung der Fedora-Distribution zust\u00e4ndig ist, noch nicht gepr\u00fcft. Der Vorschlag kann auch im Rahmen des Community-Review-Prozesses abgelehnt werden.     <\/p>\n<p>Empfohlene Einstellungen zur Aktivierung:  <\/p>\n<ul>\n<li class=\"l\">  PrivateTmp=yes \u2014 Bereitstellung separater Verzeichnisse f\u00fcr tempor\u00e4re Dateien.\n<li class=\"l\">  ProtectSystem=yes\/full\/strict \u2014 Einh\u00e4ngen des Dateisystems im Nur-Lese-Modus (im Modus \u201efull\u201c \u2014 \/etc\/, im Modus strict \u2014 alle Dateisysteme au\u00dfer \/dev\/, \/proc\/ und \/sys\/).\n<li class=\"l\">  ProtectHome=yes \u2014 Verbot des Zugriffs auf die Home-Verzeichnisse von Benutzern.\n<li class=\"l\">  PrivateDevices=yes \u2014 Zugriff nur auf \/dev\/null, \/dev\/zero und \/dev\/random lassen.\n<li class=\"l\">  ProtectKernelTunables=yes \u2014 Zugriff nur im Nur-Lese-Modus auf \/proc\/sys\/, \/sys\/, \/proc\/acpi, \/proc\/fs, \/proc\/irq usw.\n<li class=\"l\">  ProtectKernelModules=yes \u2014 Verbot des Ladens von Kernel-Modulen.\n<li class=\"l\">  ProtectKernelLogs=yes \u2014 Verbot des Zugriffs auf den Kernel-Log-Puffer.\n<li class=\"l\">  ProtectControlGroups=yes \u2014 Zugriff nur im Nur-Lese-Modus auf \/sys\/fs\/cgroup\/\n<li class=\"l\">  NoNewPrivileges=yes \u2014 Verbot der Erh\u00f6hung von Rechten durch setuid-, setgid-Flags und F\u00e4higkeiten.\n<li class=\"l\">  PrivateNetwork=yes \u2014 Unterbringung in einem separaten Namensraum f\u00fcr den Netzwerk-Stack.\n<li class=\"l\"> ProtectClock=yes \u2014 Verbot der Zeit\u00e4nderung.\n<li class=\"l\"> ProtectHostname=yes \u2014 Verbot der \u00c4nderung des Hostnamens.\n<li class=\"l\"> ProtectProc=invisible \u2014 Verstecken fremder Prozesse in \/proc.\n<li class=\"l\"> User= \u2014 Benutzerwechsel      <\/ul>\n<p>Zus\u00e4tzlich k\u00f6nnte die Aktivierung folgender Einstellungen in Betracht gezogen werden:  <\/p>\n<ul>\n<li class=\"l\">    CapabilityBoundingSet=\n<li class=\"l\">    DevicePolicy=closed\n<li class=\"l\">    KeyringMode=private\n<li class=\"l\">    LockPersonality=yes\n<li class=\"l\">    MemoryDenyWriteExecute=yes\n<li class=\"l\">    PrivateUsers=yes\n<li class=\"l\">    RemoveIPC=yes\n<li class=\"l\">    RestrictAddressFamilies=\n<li class=\"l\">    RestrictNamespaces=yes\n<li class=\"l\">    RestrictRealtime=yes\n<li class=\"l\">    RestrictSUIDSGID=yes\n<li class=\"l\">    SystemCallFilter=\n<li class=\"l\">    SystemCallArchitectures=native  <\/ul>\n<p>Quelle: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60152\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Fedora 40 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u044b\u0445 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 systemd, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0441 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a PostgreSQL, Apache httpd, Nginx \u0438 MariaDB. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u0434\u0430\u0441\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043e \u043a\u043e\u043c\u0438\u0442\u0435\u0442\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111644","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Fedora 40 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u044b\u0445 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 systemd, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0441 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a PostgreSQL, Apache httpd, Nginx \u0438 MariaDB.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Fedora 40 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Fedora 40 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u044b\u0445 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 systemd, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0441 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a PostgreSQL, Apache httpd, Nginx \u0438 MariaDB.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-21T01:10:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-21T01:10:16+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47In Fedora 40 plant man, die Isolation von Systemdiensten zu integrieren | ProHoster","description":"In der Fedora 40-Version wird vorgeschlagen, Isolationseinstellungen f\u00fcr standardm\u00e4\u00dfig aktivierte systemd-Systemdienste sowie f\u00fcr Dienste mit wichtigen Anwendungen wie PostgreSQL, Apache httpd, Nginx und MariaDB aufzunehmen.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Fedora 40 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Fedora 40 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u044b\u0445 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 systemd, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0441 \u0432\u0430\u0436\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a PostgreSQL, Apache httpd, Nginx \u0438 MariaDB.","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-21T01:10:16+00:00","article:modified_time":"2023-11-21T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/111644","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=111644"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/111644\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=111644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=111644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=111644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}