{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"Landrun projekt arendab mittepriviligeeritud rakenduste isoleerimise s\u00fcsteemi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Landrun projekt alustas uue s\u00fcsteemi arendamist isoleeritud rakenduste k\u00e4itamiseks. Isolatsiooni saavutamiseks kasutatakse Linuxi tuuma Landlocki LSM-moodulit, mis v\u00f5imaldab v\u00e4ltida privileegitud operatsioonide t\u00e4itmist sandbox-\u00fcmbriku loomise k\u00e4igus. Landrun on oma funktsioonidelt sarnane Firejail utiliidile, kuid on lihtsama rakenduse, kergema kaaluga ja v\u00f5imaldab t\u00f6\u00f6tamist tavalise mitteprivileegitud kasutaja all ilma suid lipu kohaletoimetamiseta. Projekti kood on kirjutatud Go keeles ja levitatakse GPLv2 litsentsi all. <\/p>\n

Landlock mehhanism v\u00f5imaldab mitteprivileegitud programmide piirata Linuxi tuuma objektide, nagu failihierarhiad, v\u00f5rgu sokid ja ioctl, kasutamist. Erinevalt nimede ruumidest ja s\u00fcsteemikutsumiste filtreerimisest, luuakse isoleeritud keskkond Linuxi tuuma poolt, lisakihina olemasolevate juurdep\u00e4\u00e4sukontrolli mehhanismide \u00fcle. Landlocki alamehhanismide suhtlemiseks kasutatakse landrun utiliidis LandLock arendajate go-landlock teeki. <\/p>\n

Landrun v\u00e4hendab peamise s\u00fcsteemi kompromiteerimise riski, kui k\u00e4itatakse usaldamatuid v\u00f5i potentsiaalselt haavatavaid programme. Toetatakse valikulist juurdep\u00e4\u00e4su piiramist \u00fcksikute kataloogide tasemel, \u00f5iguste sidumist failiteedega (lugemise, kirjutamise ja k\u00e4itamise lubamine v\u00f5i keeldumine) ja TCP-\u00fchenduste algatamise ning vastuv\u00f5tmise kontrolli. <\/p>\n

N\u00e4iteks saab Landrun'i protsessi abil keelata k\u00e4ivitatavate failide k\u00e4ivitamise, lubada kirjutamine ainult teatud alamkausta andmetesse, keelata kuulamis sokettide loomise v\u00f5rguside vastuv\u00f5tmiseks ja lubada v\u00f5rgup\u00e4ringute saatmine ainult m\u00e4\u00e4ratud TCP-portidele. Lihtsaimal juhul saab kirjutamise, k\u00e4ivitamise ja v\u00f5rguv\u00f5imaluste keeldimiseks programmi k\u00e4itada k\u00e4suga \u201elandrun \u2014ro \/\u201d, ja nginx'i isoleerimiseks v\u00f5ib kasutada: landrun \u2014rox \/usr\/bin \u2014ro \/lib,\/lib64,\/var\/www \u2014rwx \/var\/log \u2014bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n

Tuleviku plaanides mainitakse laiendatud juurdep\u00e4\u00e4su failis\u00fcsteemile, UDP toe ja protsessideressursside haldamise toetust. Failis\u00fcsteemi tasemel juurdep\u00e4\u00e4su piiramiseks on vajalik v\u00e4hemalt Linuxi tuum 5.13 ja v\u00f5rgu piirangute jaoks \u2014 6.8. <\/p>\n

Lisaks v\u00f5ib m\u00e4rkida, et Firejaili koodibaasi on juba sisse viidud muudatused, mis v\u00f5imaldavad kasutada Landlocki tuuma alamprogrammi isoleerimiseks ilma suid-biti ja \u00f5iguste t\u00f5stmiseta, kuid selle toe sisaldava v\u00e4ljalaskega pole veel v\u00e4lja lastud.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d LSM-\u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f sandbox-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u043e \u0441\u0432\u043e\u0438\u043c \u0437\u0430\u0434\u0430\u0447\u0430\u043c Landrun \u0431\u043b\u0438\u0437\u043e\u043a \u043a \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Firejail, \u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439, \u043b\u0435\u0433\u043a\u043e\u0432\u0435\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434 \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid. \u041a\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122970","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Landrun projekt arendab privileegideta rakenduste isoleerimise s\u00fcsteemi | ProHoster","description":"Landrun projekt on alustanud uus s\u00fcsteemi arendamist eraldatud rakenduste t\u00e4itmiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T08:22:49+00:00","article:modified_time":"2025-03-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122970","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:34:09","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:34:09","updated":"2026-01-23 11:34:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/122970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=122970"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/122970\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=122970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=122970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=122970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}