{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Bubblewrapi v\u00e4ljalase 0.4.0, isolatsioonikeskkondade loomiseks m\u00f5eldud kiht","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Saadaval<\/a><\/noindex> uusim v\u00e4ljaanne t\u00f6\u00f6riistade komplekt Bubblewrap 0.4.0<\/a><\/noindex>, mis on m\u00f5eldud isoleeritud keskkondade haldamiseks Linuxis ja toimib rakenduste tasandil mitteprivilegeeritud kasutajate jaoks. Praktikas kasutatakse Bubblewrap'i projekti Flatpak'is talletatavate rakenduste isoleerimise kihina. Projekti kood on kirjutatud C keeles ja levitatakse<\/a><\/noindex> on litsentseeritud LGPLv2+ alusel.<\/p>\n

Isolatsiooni tagamiseks kasutatakse Linuxile omaseid konteinerite virtualiseerimise tehnoloogiaid, mis p\u00f5hinevad cgroup'e, nimede nimete (namespaces), Seccomp'i ja SELinuxi kasutamisel. Bubblewrap'i konteinereid seadistavate privileegidega toimingute tegemiseks k\u00e4ivitatakse see root'i \u00f5igustes (tehtud fail c suid-lipuga) ning privileegid t\u00fchistatakse p\u00e4rast konteineri algatamist. <\/p>\n

Kasutaja identifikaatorite (user namespaces) ruumide aktiveerimine, mis v\u00f5imaldab konteinerites kasutada eraldi identifikaatorite kogumit, ei ole n\u00f5utav, kuna vaikimisi ei t\u00f6\u00f6ta see paljudes jaotustes (Bubblewrap positsioneeritakse kui piiratud suid-implementatsioon kasutaja identifikaatorite ruumide v\u00f5imaluste alamhulka \u2014 kasutades CLONE_NEWUSER ja CLONE_NEWPID re\u017eiime, v\u00e4listatakse k\u00f5ik kasutaja ja protsessi identifikaatorid keskkonnast, v\u00e4lja arvatud praegune). T\u00e4iendava kaitse tagamiseks k\u00e4ivitatakse
\n Bubblewrap'is k\u00e4ivitatakse PR_SET_NO_NEW_PRIVS re\u017eiimis, mis keelab uute privileegide saamise, n\u00e4iteks juhul, kui on olemas setuid lipp. <\/p>\n

Failis\u00fcsteemi tasandil isoleerimine toimub vaikimisi uue mount-nimede ruumi loomise kaudu, kus tmpfs-i abil luuakse t\u00fchi juurkataloog. Sellesse kataloogi liidetakse vajadusel v\u00e4lised failis\u00fcsteemid «mount —bind» re\u017eiimis (n\u00e4iteks, kui k\u00e4ivitatakse koos valikuga «bwrap —ro-bind \/usr \/usr», siis liidetakse \/usr l\u00f5ik peamisest s\u00fcsteemist ainult lugemisre\u017eiimis). V\u00f5rgufunktsionaalsus piirdub ringh\u00e4\u00e4linguliidesele juurdep\u00e4\u00e4suga ning v\u00f5rgu steigi isoleerimisega l\u00e4bi flagide CLONE_NEWNET ja CLONE_NEWUTS.<\/p>\n

Peamine erinevus sarnase projekti Firejail<\/a><\/noindex>, mis kasutab samuti setuid mudeli k\u00e4ivitamiseks, on see, et Bubblewrap'i konteinerite loomise kiht sisaldab vaid vajalikku miinimumi v\u00f5imalustest, samas kui k\u00f5ik laiendatud funktsioonid, mis on vajalikud graafiliste rakenduste k\u00e4itamiseks, t\u00f6\u00f6laua suhtlemiseks ja Pulseaudio'le suunatud p\u00e4ringute filtreerimiseks, on v\u00e4lja toodud Flatpak'i poole, kus need k\u00e4ivitatakse juba p\u00e4rast privileegide kustutamist. Firejail koondab k\u00f5ik toetavad funktsioonid \u00fchte t\u00e4idesaatvasse faili, mis muudab selle auditeerimise ja turvalisuse s\u00e4ilimise keeruliseks \u00f5igel tasemel<\/a><\/noindex>.<\/p>\n

Uus v\u00e4ljaanne paistab silma kasutaja identifikaatorite ruumide (user namespaces) ja protsesside (pid namespaces) \u00fchendamise toe rakendamisega. Ruumide \u00fchendamise haldamiseks on lisatud lipud \u00ab--userns\u00bb, \u00ab--userns2\u00bb ja \u00ab--pidns\u00bb.
\nSee v\u00f5imalus ei toimi setuid re\u017eiimis ja n\u00f5uab eraldi re\u017eiimi kasutamist, mis suudab t\u00f6\u00f6tada ilma root'i \u00f5iguste saamiseta, kuid n\u00f5uab kasutaja nimede ruumide aktiveerimist (vaikimisi on need Debianis ja RHEL\/CentOS'is keelatud) ning ei v\u00e4lista
\npotentsiaalselt lekke<\/a><\/noindex> j\u00e4\u00e4vaid<\/a><\/noindex> j\u00e4\u00e4vate<\/a><\/noindex> haavatavuste<\/a><\/noindex> kasutaja identifikaatorite ruumide piirangute jaoks. Bubblewrap 0.4 uutest v\u00f5imalustest t\u00f5stetakse esile ka v\u00f5ime \u00fchendada musl C-raamatukoguga glibc asemel ja toeta statistikainfo hoidmist ruumide kohta JSON-vormingus faili.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Bubblewrap 0.4.0 v\u00e4ljaanne, isoleeritud keskkondade loomise kiht | ProHoster","description":"Uus t\u00f6\u00f6riistade v\u00e4ljaanne on saadaval","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}