{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Izlazak Bubblewrap 0.4.0, sloja za stvaranje izoliranih okru\u017eenja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dostupno<\/a><\/noindex> novi izdanak alata Bubblewrap 0.4.0<\/a><\/noindex>, namijenjenog organizaciji rada izoliranih okru\u017eenja u Linuxu i funkcionira na razini aplikacija obi\u010dnih korisnika. U praksi, Bubblewrap koristi projekt Flatpak kao posrednik za izolaciju aplikacija pokrenutih iz paketa. Kod projekta napisan je na jeziku C i distribuira se<\/a><\/noindex> pod licencom LGPLv2+.<\/p>\n

Za izolaciju se koriste tradicionalne Linux tehnologije kontejnerske virtualizacije, temelje\u0107i se na kori\u0161tenju cgroups, prostora imena (namespaces), Seccomp i SELinux. Za izvr\u0161avanje privilegiranih operacija pri postavljanju kontejnera, Bubblewrap se pokre\u0107e s pravima root (izvr\u0161na datoteka s suid-flagom) nakon \u010dega se privilegije poni\u0161tavaju nakon zavr\u0161etka inicijalizacije kontejnera. <\/p>\n

Aktivacija sustava prostora imena identifikatora korisnika (user namespaces), koji omogu\u0107uju kori\u0161tenje vlastitog odvojenog skupa identifikatora unutar kontejnera, nije potrebna za rad jer prema zadanim postavkama ne radi u mnogim distribucijama (Bubblewrap se pozicionira kao ograni\u010dena suid-implementacija podskupa mogu\u0107nosti user namespaces \u2014 za isklju\u010divanje svih identifikatora korisnika i procesa iz okru\u017eenja, osim trenutnog, koriste se modusi CLONE_NEWUSER i CLONE_NEWPID). Za dodatnu za\u0161titu programi pod upravljanjem
\n Bubblewrap izvode se u na\u010dinu PR_SET_NO_NEW_PRIVS, koji zabranjuje dobivanje novih privilegija, na primjer, kada je postavljen setuid flag. <\/p>\n

Izolacija na razini datote\u010dnog sustava ostvaruje se stvaranjem po defaultu novog prostora imena to\u010daka montiranja (mount namespace), u kojem se putem tmpfs stvara prazan korijenski odjeljak. U taj odjeljak se po potrebi pri\u010dvr\u0161\u0107uju dijelovi vanjskog FS-a u re\u017eimu \u201emount \u2014bind\u201c (na primjer, prilikom pokretanja s opcijom \u201ebwrap \u2014ro-bind \/usr \/usr\u201c dijelovi \/usr se proslje\u0111uju iz glavnog sustava u re\u017eimu samo za \u010ditanje). Mre\u017ene mogu\u0107nosti se ograni\u010davaju pristupom loopback su\u010delju uz izolaciju mre\u017enog steka putem oznaka CLONE_NEWNET i CLONE_NEWUTS.<\/p>\n

Klju\u010dna razlika u odnosu na sli\u010dan projekt Firejail<\/a><\/noindex>, koji tako\u0111er koristi model podizanja s primjenom setuid, je to da u Bubblewrap sloj za stvaranje kontejnera uklju\u010duje samo minimum potrebnih mogu\u0107nosti, dok su sve unaprijedene funkcije potrebne za pokretanje grafi\u010dkih aplikacija, interakciju s radnom povr\u0161inom i filtriranje poziva prema Pulseaudio, preba\u010dene na stranu Flatpak i izvr\u0161avaju se nakon poni\u0161tavanja privilegija. Firejail, s druge strane, objedinjuje u jednoj izvr\u0161noj datoteci sve prate\u0107e funkcije, \u0161to ote\u017eava njegovu reviziju i odr\u017eavanje sigurnosti. na<\/a><\/noindex>.<\/p>\n

Nova verzija se isti\u010de implementacijom podr\u0161ke za priklju\u010divanje postoje\u0107ih prostora imena identifikatora korisnika (user namespaces) i procesa (pid namespaces). Za upravljanje povezivanjem prostora imena dodani su oznake \u201e\u2014userns\u201c, \u201e\u2014userns2\u201c i \u201e\u2014pidns\u201c.
\nOva mogu\u0107nost ne radi u setuid modu i zahtijeva primjenu zasebnog moda, koji mo\u017ee raditi bez sticanja root prava, ali zahtijeva aktivaciju
\nuser namespaces u sustavu (zadano su onemogu\u0107eni u Debian i RHEL\/CentOS) i ne isklju\u010duje mogu\u0107nost iskori\u0161tavanja<\/a><\/noindex> potencijalno<\/a><\/noindex> ostaju<\/a><\/noindex> ranjivosti<\/a><\/noindex> zaobila\u017eenje ograni\u010denja \u201euser namespaces\u201c. Od novih mogu\u0107nosti Bubblewrap 0.4 tako\u0111er se isti\u010de mogu\u0107nost kompilacije s C bibliotekama musl umjesto glibc i podr\u0161ka za spremanje informacija o prostorima imena u datoteku sa statistikama u formatu JSON.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdanje Bubblewrap 0.4.0, sloja za stvaranje izoliranih okru\u017eenja | ProHoster","description":"Dostupan je novi izdanak alata","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}