{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Bubblewrap 0.4.0 v\u00e4ljaanne, isoleeritud keskkondade loomiseks m\u00f5eldud kihid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Saadaval<\/a><\/noindex> uus v\u00e4ljaanne t\u00f6\u00f6riistakomplektist Bubblewrap 0.4.0<\/a><\/noindex>, mis on loodud isoleeritud keskkondade korraldamiseks Linuxis ja t\u00f6\u00f6tab mitteprivileegitud kasutajate rakendustasandil. Praktiliselt kasutatakse Bubblewrapi Flatpaki projekti poolt rakenduste pakettide isoleerimise kihina. Projekti kood on kirjutatud C keeles ja GNU \u00dcldine Avaliku litsentsi alusel.<\/a><\/noindex> jagatud LGPLv2+ litsentsi all.<\/p>\n

Isolatsiooni tagamiseks kasutatakse traditsioonilisi Linuxi konteinerite virtualiseerimise tehnoloogiaid, mis p\u00f5hinevad cgroupside, nimede ruumide (namespaces), Seccomp-i ja SELinuxi kasutamisel. Privilegeeritud konteineri seadistamise toimingute t\u00e4itmiseks k\u00e4ivitatakse Bubblewrap root-\u00f5igustes (suud-failiga) ning privileegid t\u00fchistatakse p\u00e4rast konteineri initsialiseerimise l\u00f5petamist. <\/p>\n

Kasutajate nimede ruumide (user namespaces) aktiveerimist, mis v\u00f5imaldavad konteinerites kasutada eraldi identifikaatorite kogumit, ei n\u00f5uta, kuna see ei ole paljudes distributsioonides vaikimisi lubatud. Bubblewrap on piiratud suid-implementatsioon, mis t\u00f6\u00f6tab user namespaces'i v\u00f5imaluste osahulgas \u2014 kasutajate ja protsesside identifikaatorite keskkonnast k\u00f5rvaldamiseks kasutatakse re\u017eiime CLONE_NEWUSER ja CLONE_NEWPID. T\u00e4iendava kaitse tagamiseks, mida juhitakse.
\n rakendused k\u00e4ivitatakse re\u017eiimis PR_SET_NO_NEW_PRIVS, mis keelab uute privileegide saamise, n\u00e4iteks setuid lipu olemasolu korral. <\/p>\n

Failis\u00fcsteemi isoleerimine toimub vaikimisi uue mount-nimetu loomise kaudu, kus tmpfs abil luuakse t\u00fchi juurdosa. Vajadusel kinnitatakse sellele osale v\u00e4list failis\u00fcsteemi osad «mount —bind» re\u017eiimis (n\u00e4iteks kui k\u00e4ivitatakse c valikuga «bwrap —ro-bind \/usr \/usr», siis jaotust \/usr suunatakse p\u00f5hiskeemist vaid lugemisre\u017eiimis). V\u00f5rguv\u00f5imalusi piiratakse p\u00e4\u00e4suga loopback-liidesesse ning v\u00f5rguhaldus isoleeritakse CLONE_NEWNET ja CLONE_NEWUTS lippude kaudu.<\/p>\n

Peamine erinevus sarnase projekti ees Firejail<\/a><\/noindex>, mis kasutab samuti k\u00e4ivitamise mudelit setuid rakendamisega, erineb Bubblewrapist, kuna konteinerite loomise kiht sisaldab ainult vajalikku minimaalset v\u00f5imaluste kogumit, samas kui k\u00f5ik laiendatud funktsioonid, mis on vajalikud graafiliste rakenduste k\u00e4itamiseks, t\u00f6\u00f6lauaga suhtlemiseks ja Pulseaudio p\u00e4ringute filtreerimiseks, on viidud Flatpaki poole ja teostatakse p\u00e4rast privileegide t\u00fchistamist. Firejail koondab k\u00f5ik kaasnevad funktsioonid \u00fchte t\u00e4itevfaili, mis muudab auditeerimise ja turvalisuse s\u00e4ilitamise komplekssemaks<\/a><\/noindex>.<\/p>\n

Uue v\u00e4ljaande peamine t\u00e4helepanu on olemasolevate kasutajate nimede ruumide (user namespaces) ja protsesside (pid namespaces) \u00fchendamise toetuse rakendamine. Nimede ruumide \u00fchendamiseks on lisatud lipud \u2014userns, \u2014userns2 ja \u2014pidns.
\nSee funktsioon ei t\u00f6\u00f6ta setuid re\u017eiimis ja n\u00f5uab eraldi re\u017eiimi kasutamist, mis saab t\u00f6\u00f6tada ilma root \u00f5igusteta, kuid vajab
\nkasutaja nimede ruumide aktiveerimist s\u00fcsteemis (vaikimisi on need Debianis ja RHEL\/CentOSis keelatud) ning ei v\u00e4lista haavatavuse<\/a><\/noindex> potentsiaalset<\/a><\/noindex> j\u00e4\u00e4kide olemasolu<\/a><\/noindex> haavatavuste<\/a><\/noindex> user namespaces'i piirangutest. Bubblewrap 0.4 uusimate v\u00f5imaluste hulka kuulub ka v\u00f5imalus koostada koos musl C-raamatukoguga glibc asemel ja toetab nimede ruumide teabe salvestamist JSON-formaadis statistika faili.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bubblewrap 0.4.0 v\u00e4ljaanne, isoleeritud keskkondade loomise kiht | ProHoster","description":"Uus t\u00f6\u00f6riistade v\u00e4ljaanne on saadaval","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}