{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu piirab juurdep\u00e4\u00e4su kasutaja nimekogule","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Canonical teatas, et Ubuntu 23.10-s tehakse muudatusi, mis piirdavad kasutajate juurdep\u00e4\u00e4su kasutaja nimede ruumidele (user namespace), v\u00f5imaldades seel\u00e4bi suurendada s\u00fcsteemide turvalisust, mis kasutavad konteinerite isoleerimist, haavatavuste eest, mille \u00e4rakasutamiseks on vajalikud manipulatsioonid user namespace'iga. Google'i andmetel n\u00f5uab 44% Linuxi tuuma haavatavuste tuvastamise preemia programmis osalenud eksploitidest juurdep\u00e4\u00e4su kasutaja nimede ruumide loomise v\u00f5imalust. <\/p>\n

Ubuntu's user namespace access is not completely blocked anymore; instead, a hybrid scheme has been implemented that selectively allows some programs to create user namespaces if they have an AppArmor profile with the rule 'allow userns create' or the CAP_SYS_ADMIN privilege. For instance, a profile has been created for Chrome at \/etc\/apparmor.d\/opt.google.chrome.chrome, which can be used as an example for granting access to the user namespace for other programs. <\/p>\n

Ootavas Ubuntu 23.10 v\u00e4ljaandes pakutakse user namespace'i juurdep\u00e4\u00e4su piiramist valikuna, mis ei ole vaikimisi aktiveeritud. M\u00f5ni n\u00e4dal p\u00e4rast Ubuntu 23.10 v\u00e4ljalaskmist koguvad arendajad teavet v\u00f5imalikest negatiivsetest m\u00f5judest user namespace'i juurdep\u00e4\u00e4su keelamise kohta paketihaldusele ja valmistavad ette vastavad AppArmor profiilid. Seej\u00e4rel aktiveeritakse piirang vaikimisi selle kohta ilmuvate ajakohastuste ajal (Stable Release Updates). <\/p>\n

Piirangu ennetamiseks saab kasutada j\u00e4rgmisi k\u00e4ske: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n

Ja keelamiseks: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e, \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 user namespace. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, 44% \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110711","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ubuntu piirab juurdep\u00e4\u00e4su user namespace'ile | ProHoster","description":"Canonical teatas, et Ubuntu 23.10-s tehakse muudatusi, mis piiravad kasutajate juurdep\u00e4\u00e4su kasutaja nimede ruumidele (user namespace), et suurendada s\u00fcsteemide turvalisust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Ubuntu \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a user namespace | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-10T01:10:26+00:00","article:modified_time":"2023-10-10T01:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=110711"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110711\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=110711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=110711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=110711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}