{"id":54610,"date":"2019-12-30T00:00:00","date_gmt":"2019-12-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62"},"modified":"2020-02-18T14:02:39","modified_gmt":"2020-02-18T11:02:39","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","title":{"rendered":"Firejail 0.9.62 rakenduste isolatsioonis\u00fcsteemi v\u00e4ljalaskmine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u00e4rast kuue kuu arendust\u00f6\u00f6d <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/releases\/tag\/0.9.62\">saadaval<\/a><\/noindex> projekti v\u00e4ljaanne <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/\">Firejail 0.9.62<\/a><\/noindex>, mille osalade eraldamiseks graafiliste, konsooli ja serveri rakenduste k\u00e4itamiseks. Firejail'i kasutamine v\u00e4hendab peamise s\u00fcsteemi riskide kompromiteerimist, kui k\u00e4itatakse usaldamatuid v\u00f5i potentsiaalselt haavatavaid programme. Programm on kirjutatud C keeles, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\">GNU \u00dcldine Avaliku litsentsi alusel.<\/a><\/noindex> GPLv2 litsentsi all ja see t\u00f6\u00f6tab mis tahes Linuxi distributsioonis, mille tuum on versioonist 3.0 vanem. Firejail'i valmis paketid <noindex><a rel=\"nofollow\" href=\"https:\/\/sourceforge.net\/projects\/firejail\/files\/firejail\/\">valmistatud<\/a><\/noindex> on saadaval deb (Debian, Ubuntu) ja rpm (CentOS, Fedora) formaatides.<\/p>\n<p>Eraldamiseks kasutab Firejail <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/features-3\/\">nimetulemisi (namespaces), AppArmor'i ja s\u00fcsteemikutsungite filtreerimist (seccomp-bpf) Linuxis. P\u00e4rast k\u00e4ivitamist kasutab programm ja k\u00f5ik selle alams\u00fcsteemid eraldi tuuma ressursit\u00f5lgendusi, nagu v\u00f5rguaki, protsesside tabel ja paigalduspunktid. Omavahel seotud rakendusi saab liita \u00fches \u00fchiseks sandbox'iks. Soovi korral saab Firejail'i kasutada ka Docker, LXC ja OpenVZ konteinerite k\u00e4itamiseks.<\/a><\/noindex>  nimed (namespaces), AppArmor ja s\u00fcsteemit\u00f5kestuse filtreerimine (seccomp-bpf) Linuxis. P\u00e4rast k\u00e4ivitamist kasutab programm koos selle allprotsessidega eraldi tuumaressursside vaateid, nagu v\u00f5rgu- jaotis, protsesside tabel ja mount-punktid. Omavahel seotud rakendusi saab \u00fchendada \u00fchte \u00fchisesse liivakasti. Soovi korral saab Firejail'i kasutada ka Docker, LXC ja OpenVZ konteinerite k\u00e4itamiseks. <\/p>\n<p>Erinevalt konteinerite isolatsioonivahenditest on Firejail \u00e4\u00e4rmiselt <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/basic-usage\/\">lihtne<\/a><\/noindex> konfigureerimisel ja ei vaja operatiivsystemi pilti \u2014 konteineri sisu kujundatakse reaalajas olemasoleva failis\u00fcsteemi p\u00f5hjal ning kustutatakse rakenduse t\u00f6\u00f6 l\u00f5ppedes. Pakutakse paindlikke vahendeid juurdep\u00e4\u00e4sureeglite seadmiseks failis\u00fcsteemile, saades m\u00e4\u00e4rata, millistele failidele ja kataloogidele on juurdep\u00e4\u00e4s lubatud v\u00f5i keelatud, lisada andmete jaoks ajutisi failis\u00fcsteeme (tmpfs), piirata juurdep\u00e4\u00e4su failidele v\u00f5i kataloogidele ainult lugemiseks ning kombineerida katalooge l\u00e4bi bind-mount ja overlayfs.<\/p>\n<p>Paljude populaarsete rakenduste jaoks, sealhulgas Firefox, Chromium, VLC ja Transmission, on valmis <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/building-custom-profiles\/\">profiilid<\/a><\/noindex> s\u00fcsteemikutsungite isolatsiooni. Isoleeritud keskkonna seadistamiseks vajalike privileegide saamiseks installitakse k\u00e4ivitatav fail firejail SUID root lipuga (peale initsialiseerimist privileegid t\u00fchistatakse). Rakenduse k\u00e4itamiseks isolatsioonire\u017eiimis piisab, kui m\u00e4\u00e4rata rakenduse nimi firejail utiliidi argumendiks, n\u00e4iteks \u201efirejail firefox\u201c v\u00f5i \u201esudo firejail \/etc\/init.d\/nginx start\u201c. <\/p>\n<p>Uues v\u00e4ljaandes:<\/p>\n<ul>\n<li class=\"l\"> Konfiguratsioonifaili \/etc\/firejail\/firejail.config <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/blob\/master\/etc\/firejail.config#L38\">on lisatud<\/a><\/noindex> faili kopeerimise piiri seadistamine, mis v\u00f5imaldab piirata nende failide suurust, mis kopeeritakse m\u00e4llu kasutades valikuid \u201e--private-*\u201c (vaikimisi on piiriks seatud 500MB).\n<li class=\"l\"> Katalooge \/usr\/share\/doc\/firejail on lisatud mallid uute rakenduste piiranguprofiilide loomiseks.\n<li class=\"l\"> Profiilides on lubatud silurite kasutamine.\n<li class=\"l\"> S\u00fcsteemi k\u00f5nede filtreerimist on parandatud seccomp mehhanismi abil.\n<li class=\"l\"> Kompilaatori lipud on automaatselt tuvastatud.\n<li class=\"l\"> chrooti kutse ei toimu enam tee p\u00f5hjal, vaid kasutades failide descriptor'e p\u00f5hjal koostatud mount-punkte.\n<li class=\"l\"> Kataloog \/usr\/share on valgetesse loenditesse lisatud mitmesuguste profiilide jaoks.\n<li class=\"l\"> conrib sektsiooni on lisatud uued abiskripti gdb-firejail.sh ja sort.py.\n<li class=\"l\"> Tugevdatud kaitse privileege omava koodi (SUID) t\u00e4itmisel.\n<li class=\"l\"> Profiilide jaoks on rakendatud uusi tingimuslikke m\u00e4rke HAS_X11 ja HAS_NET X-serveri ja v\u00f5rgup\u00e4\u00e4suga kontrollimiseks.\n<li class=\"l\"> Lisatud on profiile eraldatud rakenduste k\u00e4ivitamiseks (profiilide koguarv on t\u00f5stetud 884-ni):\n<ul>\n<li>i2p,\n<li>tor-browser (AUR),\n<li>Zulip,\n<li>rsync,\n<li>signal-cli,\n<li>tcpdump,\n<li>tshark,\n<li>qgis,\n<li>OpenArena,\n<li>godot,\n<li>klatexformula,\n<li>klatexformula_cmdl,\n<li>links,\n<li>xlinks,\n<li>pandoc,\n<li>teams-for-linux,\n<li>gnome-sound-recorder,\n<li>newsbeuter,\n<li>keepassxc-cli,\n<li>keepassxc-proxy,\n<li>rhythmbox-client,\n<li>jerry,\n<li>zeal,\n<li>mpg123,\n<li>conplay,\n<li>mpg123.bin,\n<li>mpg123-alsa,\n<li>mpg123-id3dump,\n<li>out123,\n<li>mpg123-jack,\n<li>mpg123-nas,\n<li>mpg123-openal,\n<li> mpg123-oss,\n<li>mpg123-portaudio,\n<li>mpg123-pulse,\n<li> mpg123-strip,\n<li>pavucontrol-qt,\n<li>gnome-characters,\n<li>gnome-character-map,\n<li>Whalebird,\n<li>tb-starter-wrapper,\n<li>bzcat,\n<li>kiwix-desktop,\n<li>bzcat,\n<li>zstd,\n<li>pzstd,\n<li>zstdcat,\n<li>zstdgrep,\n<li>zstdless,\n<li>zstdmt,\n<li>unzstd,\n<li>ar,\n<li>gnome-latex,\n<li> pngquant,\n<li>kalgebra,\n<li>kalgebramobile,\n<li>amuled,\n<li>kfind,\n<li>profanity,\n<li>audio-recorder,\n<li>cameramonitor,\n<li>ddgtk,\n<li>drawio,\n<li>unf,\n<li>gmpc,\n<li>electron-mail,\n<li>gist,\n<li>gist-paste.\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52115\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.62, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Firejail \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54610","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.62 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-29T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firejail rakenduste isoleerimise s\u00fcsteemi 0.9.62 v\u00e4ljaanne | ProHoster","description":"P\u00e4rast kuue kuu arendust\u00f6\u00f6d on projekti v\u00e4ljalase saadaval","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.62 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54610","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 12:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:01:33","updated":"2026-01-24 12:05:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54610"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54610\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}