{"id":34673,"date":"2019-10-31T21:59:45","date_gmt":"2019-10-31T18:59:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60\/"},"modified":"2019-10-31T21:59:45","modified_gmt":"2019-10-31T18:59:45","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","title":{"rendered":"Firejail rakenduse isoleerimise versiooni 0.9.60 v\u00e4ljalase","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/releases\/tag\/0.9.60\">Tuli v\u00e4lja<\/a><\/noindex> projekti v\u00e4ljalaskmine <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/\">Firejail 0.9.60<\/a><\/noindex>, mille raames areneb s\u00fcsteem isoleeritud k\u00e4ivitamiseks graafika-, konsooli- ja serverirakendustele. Firejail'i kasutamine v\u00e4hendab p\u00f5hiss\u00fcsteemi kompromiteerimise riski, kui k\u00e4ivitada usaldamatuid v\u00f5i potentsiaalselt haavatavaid programme. Programm on kirjutatud C keeles, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\">levitatakse<\/a><\/noindex> GPLv2 litsentsi all ja v\u00f5ib t\u00f6\u00f6tada igas Linuxi jaotuses, mille tuum on vanem kui 3.0. Firejail'i valmis paketid <noindex><a rel=\"nofollow\" href=\"https:\/\/sourceforge.net\/projects\/firejail\/files\/firejail\/\">valmistatud<\/a><\/noindex> debian (Debian, Ubuntu) ja rpm (CentOS, Fedora) formaatides.<\/p>\n<p>Firejail'i isolatsiooniks <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/features-3\/\">kasutatakse<\/a><\/noindex>  nimedeid (namespaces), AppArmor ja s\u00fcsteemikutse filtreerimine (seccomp-bpf) Linuxis. P\u00e4rast k\u00e4ivitamist kasutab programm ja k\u00f5ik selle alaprotsessid eraldi tuumaressursside vaateid, nagu v\u00f5rgu\u00fclesanne, protsesside tabel ja mount-punktid. Omavahel seotud rakendusi saab \u00fchendada \u00fchte \u00fchisesse sandboxi. Soovi korral saab Firejail't kasutada ka Docker, LXC ja OpenVZ konteinerite k\u00e4ivitamiseks. <\/p>\n<p>Erinevalt konteinerite isolatsiooni vahenditest on firejail \u00e4\u00e4rmiselt <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/basic-usage\/\">lihtne<\/a><\/noindex> Konfiguratsioon ei n\u00f5ua s\u00fcsteemi pildi ettevalmistamist \u2014 konteineri koostis moodustatakse reaalajas praeguse failis\u00fcsteemi sisu p\u00f5hjal ja eemaldatakse p\u00e4rast rakenduse t\u00f6\u00f6 l\u00f5petamist. Pakutakse paindlikke vahendeid failis\u00fcsteemi juurdep\u00e4\u00e4su reeglite m\u00e4\u00e4ramiseks, saades m\u00e4\u00e4rata, millistele failidele ja kaustadele on juurdep\u00e4\u00e4s lubatud v\u00f5i keelatud, andmete jaoks ajutisi failis\u00fcsteeme (tmpfs) \u00fchendades, piirates failide v\u00f5i kaustade juurdep\u00e4\u00e4su ainult lugemiseks ja \u00fchendades kaustu bind-mount ja overlayfs kaudu.<\/p>\n<p>Paljude populaarsete rakenduste, sealhulgas Firefoxi, Chromiumi, VLC ja Transmission, jaoks on ette valmistatud valmis <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/building-custom-profiles\/\">isoleerimise profiilid<\/a><\/noindex> S\u00fcsteemi kutsumise isoleerimiseks. Programmi k\u00e4itamiseks isoleeritud re\u017eiimis piisab rakenduse nime edastamisest argumentidena utiliidile firejail, n\u00e4iteks \u201efirejail firefox\u201c v\u00f5i \u201esudo firejail \/etc\/init.d\/nginx start\u201c. <\/p>\n<p>Uues v\u00e4ljaandes:<\/p>\n<ul>\n<li class=\"l\"> On k\u00f5rvaldatud haavatavus, mis v\u00f5imaldas kahjuliku protsessil m\u00f6\u00f6da minna s\u00fcsteemikutsete filtreerimise mehhanismist. Haavatavuse olemus seisneb selles, et Seccomp filtrid koopiad salvestatakse kausta \/run\/firejail\/mnt, mis on kirjutamiseks avatud isoleeritud keskkonnas. Isolatsioonire\u017eiimis k\u00e4ivitatud kahjulikud protsessid saavad muuta neid faile, mis toob kaasa selle, et samas keskkonnas k\u00e4ivitatud uued protsessid viiakse ellu ilma s\u00fcsteemikutsete filtrit rakendamata;\n<li class=\"l\"> M\u00e4lu lahtiminekuks ja kirjutamiseks on filter memory-deny-write-execute, mis takistab \u201ememfd_create\u201c kutset;\n<li class=\"l\"> Uus valik \u201eprivate-cwd\u201c on lisatud vangla t\u00f6\u00f6kausta muutmiseks;\n<li class=\"l\"> Lisatud valik \u201e--nodbus\u201c D-Bus soketite blokeerimiseks;\n<li class=\"l\"> Tagasi on toodud CentOS 6 tugi;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/pull\/2601\">L\u00f5petatud<\/a><\/noindex> pakettide toimetamisel formaatides <noindex><a rel=\"nofollow\" href=\"https:\/\/flatpak.org\/\">flatpak<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/snapcraft.io\/\">snap<\/a><\/noindex>.<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/pull\/2601\/commits\/581d3cd01432c6666dbf6168fe5bdb3dae90fa46\">On m\u00e4rgitud<\/a><\/noindex>, et nende pakettide jaoks tuleks kasutada nende enda t\u00f6\u00f6riistu;<\/p>\n<li class=\"l\"> Lisatud uued profiilid 87 t\u00e4iendava rakenduse isolatsiooniks, sealhulgas mypaint, nano, xfce4-mixer, gnome-keyring, redshift, font-manager, gconf-editor, gsettings, freeciv, lincity-ng, openttd, torcs, tremulous, warsow, freemind, kid3, freecol, opencity, utox, freeoffice-planmaker, freeoffice-presentations, freeoffice-textmaker, inkview, meteo-qt, ktouch, yelp ja cantata.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50760\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0432\u0438\u0434\u0435\u043b \u0441\u0432\u0435\u0442 \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.60, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Firejail \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 Linux \u0441 \u044f\u0434\u0440\u043e\u043c \u0441\u0442\u0430\u0440\u0448\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34673","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0423\u0432\u0438\u0434\u0435\u043b \u0441\u0432\u0435\u0442 \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.60 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0423\u0432\u0438\u0434\u0435\u043b \u0441\u0432\u0435\u0442 \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:59:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:59:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firejail 0.9.60 rakenduste isolatsioonis\u00fcsteemi v\u00e4ljaanne | ProHoster","description":"Tuli v\u00e4lja Firejail projekti v\u00e4ljaanne.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.60 | ProHoster","og:description":"\u0423\u0432\u0438\u0434\u0435\u043b \u0441\u0432\u0435\u0442 \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:59:45+00:00","article:modified_time":"2019-10-31T18:59:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34673","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:10:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:33","updated":"2026-01-21 20:10:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34673"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34673\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}