{"id":54610,"date":"2019-12-30T00:00:00","date_gmt":"2019-12-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62"},"modified":"2020-02-18T14:02:39","modified_gmt":"2020-02-18T11:02:39","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","title":{"rendered":"Firejaili rakenduste isoleerimise s\u00fcsteemi v\u00e4ljaanne 0.9.62","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u00e4rast kuue kuu arendust\u00f6\u00f6d <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/releases\/tag\/0.9.62\">saadaval<\/a><\/noindex> projekti v\u00e4ljalaskmine <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/\">Firejail 0.9.62<\/a><\/noindex>, mille raames areneb s\u00fcsteem isoleeritud k\u00e4ivitamiseks graafika-, konsooli- ja serverirakendustele. Firejail'i kasutamine v\u00e4hendab p\u00f5hiss\u00fcsteemi kompromiteerimise riski, kui k\u00e4ivitada usaldamatuid v\u00f5i potentsiaalselt haavatavaid programme. Programm on kirjutatud C keeles, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\">levitatakse<\/a><\/noindex> GPLv2 litsentsi all ja v\u00f5ib t\u00f6\u00f6tada igas Linuxi jaotuses, mille tuum on vanem kui 3.0. Firejail'i valmis paketid <noindex><a rel=\"nofollow\" href=\"https:\/\/sourceforge.net\/projects\/firejail\/files\/firejail\/\">valmistatud<\/a><\/noindex> debian (Debian, Ubuntu) ja rpm (CentOS, Fedora) formaatides.<\/p>\n<p>Firejail'i isolatsiooniks <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/features-3\/\">kasutatakse<\/a><\/noindex>  nimede ruume (namespaces), AppArmorit ja s\u00fcsteemikutsungite filtreerimist (seccomp-bpf) Linuxis. P\u00e4rast k\u00e4ivitamist kasutab programm ja k\u00f5ik selle alamprotsessid eraldi tuumavarade vaateid, nagu v\u00f5rgu stack, protsesside tabel ja mount-punktid. \u00dchiseid rakendusi saab liita \u00fchte \u00fcldisse sandbox'i. Soovi korral saab Firejail'i kasutada ka Docker, LXC ja OpenVZ konteinerite k\u00e4itamiseks. <\/p>\n<p>Erinevalt konteinerite isolatsiooni vahenditest on firejail \u00e4\u00e4rmiselt <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/basic-usage\/\">lihtne<\/a><\/noindex> konfiguratsioonis ja ei n\u00f5ua s\u00fcsteemi pildi ettevalmistamist \u2014 konteineri koostis moodustatakse jooksvalt praeguse failis\u00fcsteemi sisu p\u00f5hjal ja kustutatakse p\u00e4rast rakenduse l\u00f5petamist. Pakutakse paindlikke vahendeid juurdep\u00e4\u00e4sureeglite m\u00e4\u00e4ramiseks failis\u00fcsteemile, on v\u00f5imalik m\u00e4\u00e4rata, millistele failidele ja kataloogidele on juurdep\u00e4\u00e4s lubatud v\u00f5i keelatud, \u00fchendada andmete jaoks ajutised failis\u00fcsteemid (tmpfs), piirata juurdep\u00e4\u00e4su failidele v\u00f5i kataloogidele ainult lugemisele, kombineerida katalooge bind-mount`i ja overlayfs`i kaudu.<\/p>\n<p>Paljude populaarsete rakenduste, sealhulgas Firefoxi, Chromiumi, VLC ja Transmission, jaoks on ette valmistatud valmis <noindex><a rel=\"nofollow\" href=\"https:\/\/firejail.wordpress.com\/documentation-2\/building-custom-profiles\/\">isoleerimise profiilid<\/a><\/noindex> s\u00fcsteemikutsungite isoleerimine. Isolatsioonikeskkonna seadistamiseks vajalike \u00f5iguste saamiseks installitakse \u00fclesande fail firejail SUID root lipuga (p\u00e4rast initsialiseerimist \u00f5igused t\u00fchistatakse). Programmi k\u00e4itamiseks isolatsioonire\u017eiimis piisab, kui m\u00e4\u00e4rata rakenduse nimi firejail utiliidi argumendiks, n\u00e4iteks \u201efirejail firefox\u201c v\u00f5i \u201esudo firejail \/etc\/init.d\/nginx start\u201c. <\/p>\n<p>Uues v\u00e4ljaandes:<\/p>\n<ul>\n<li class=\"l\"> Konfigureerimisfailis \/etc\/firejail\/firejail.config <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/netblue30\/firejail\/blob\/master\/etc\/firejail.config#L38\">lisatud<\/a><\/noindex> file-copy-limit seade, mis v\u00f5imaldab piirata failide suurust, mis kopeeritakse m\u00e4lu, kui kasutatakse valikuid \u201e--private-*\u201c (vaikimisi on piirang seadistatud 500 MB peale).\n<li class=\"l\"> Katalooge \/usr\/share\/doc\/firejail lisati malli uute rakendusepiirangute profiilide loomiseks.\n<li class=\"l\"> Profiilides on lubatud debugeerimiste kasutamine.\n<li class=\"l\"> S\u00fcsteemi k\u00f5nede filtreerimist on t\u00e4iustatud seccomp mehhanismi abil.\n<li class=\"l\"> Soodustatud on kompilaatorise lipu automaatne tuvastamine.\n<li class=\"l\"> K\u00e4sk chroot t\u00e4idetakse n\u00fc\u00fcd mitte tee alusel, vaid failihalduri p\u00f5hjal t\u00f5usmisel.\n<li class=\"l\"> Kataloog \/usr\/share on erinevate profiilide nimekirjas.\n<li class=\"l\"> Sektsiooni conrib on lisatud uusi abiskripte gdb-firejail.sh ja sort.py.\n<li class=\"l\"> Parandatud on priviligeeritud koodi (SUID) t\u00e4itmise etapi kaitset.\n<li class=\"l\"> Profiilides on rakendatud uusi tingimuslikke tunnuseid HAS_X11 ja HAS_NET X-serveri ja v\u00f5rgu juurdep\u00e4\u00e4su kontrollimiseks.\n<li class=\"l\"> Lisatud on profiilid rakenduste isoleeritud k\u00e4ivitamiseks (kokku profiile n\u00fc\u00fcd 884):\n<ul>\n<li>i2p,\n<li>tor-browser (AUR),\n<li>Zulip,\n<li>rsync,\n<li>signal-cli,\n<li>tcpdump,\n<li>tshark,\n<li>qgis,\n<li>OpenArena,\n<li>godot,\n<li>klatexformula,\n<li>klatexformula_cmdl,\n<li>links,\n<li>xlinks,\n<li>pandoc,\n<li>teams-for-linux,\n<li>gnome-sound-recorder,\n<li>newsbeuter,\n<li>keepassxc-cli,\n<li>keepassxc-proxy,\n<li>rhythmbox-client,\n<li>jerry,\n<li>zeal,\n<li>mpg123,\n<li>conplay,\n<li>mpg123.bin,\n<li>mpg123-alsa,\n<li>mpg123-id3dump,\n<li>out123,\n<li>mpg123-jack,\n<li>mpg123-nas,\n<li>mpg123-openal,\n<li> mpg123-oss,\n<li>mpg123-portaudio,\n<li>mpg123-pulse,\n<li> mpg123-strip,\n<li>pavucontrol-qt,\n<li>gnome-characters,\n<li>gnome-character-map,\n<li>Whalebird,\n<li>tb-starter-wrapper,\n<li>bzcat,\n<li>kiwix-desktop,\n<li>bzcat,\n<li>zstd,\n<li>pzstd,\n<li>zstdcat,\n<li>zstdgrep,\n<li>zstdless,\n<li>zstdmt,\n<li>unzstd,\n<li>ar,\n<li>gnome-latex,\n<li> pngquant,\n<li>kalgebra,\n<li>kalgebramobile,\n<li>amuled,\n<li>kfind,\n<li>profanity,\n<li>audio-recorder,\n<li>cameramonitor,\n<li>ddgtk,\n<li>drawio,\n<li>unf,\n<li>gmpc,\n<li>electron-mail,\n<li>gist,\n<li>gist-paste.\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52115\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.62, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Firejail \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54610","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.62 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-29T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firejail'i rakenduste isoleerimiss\u00fcsteemi v\u00e4ljaanne 0.9.62 | ProHoster","description":"P\u00e4rast kuue kuu arendust\u00f6\u00f6d on projekti v\u00e4ljaanne saadaval","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.62 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54610","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 12:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:01:33","updated":"2026-01-24 12:05:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54610"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54610\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}