{"id":103439,"date":"2022-02-26T15:37:02","date_gmt":"2022-02-26T13:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bubblewrap-0-6-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2022-02-26T15:37:02","modified_gmt":"2022-02-26T13:37:02","slug":"vypusk-bubblewrap-0-6-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/vypusk-bubblewrap-0-6-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Release of Bubblewrap 0.6, a layer for creating isolated environments.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Bubblewrap 0.6 toolkit release is available for organizing the operation of isolated environments, commonly used to restrict individual applications of unprivileged users. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. The project's code is written in C and is distributed under the LGPLv2+ license. <\/p>\n
Az elszigetel\u00e9shez a Linuxban megszokott kont\u00e9neres virtualiz\u00e1ci\u00f3s technol\u00f3gi\u00e1kat haszn\u00e1lj\u00e1k, amelyek cgroups, n\u00e9vterek (namespaces), Seccomp \u00e9s SELinux alkalmaz\u00e1s\u00e1n alapulnak. A kont\u00e9ner be\u00e1ll\u00edt\u00e1s\u00e1hoz sz\u00fcks\u00e9ges privilegiz\u00e1lt m\u0171veletek v\u00e9grehajt\u00e1s\u00e1hoz a Bubblewrap root jogokkal (suid flag-gel rendelkez\u0151 futtathat\u00f3 f\u00e1jl) indul, majd a kont\u00e9ner inicializ\u00e1l\u00e1sa ut\u00e1n a privil\u00e9giumokat vissza\u00e1ll\u00edtja. <\/p>\n
A felhaszn\u00e1l\u00f3i n\u00e9vazonos\u00edt\u00f3k (user namespaces) aktiv\u00e1l\u00e1sa nem sz\u00fcks\u00e9ges, mivel alap\u00e9rtelmez\u00e9s szerint sok disztrib\u00faci\u00f3ban nem m\u0171k\u00f6dik. A Bubblewrap korl\u00e1tozott suid implement\u00e1ci\u00f3k\u00e9nt hirdeti a felhaszn\u00e1l\u00f3i n\u00e9vazonos\u00edt\u00f3k k\u00e9pess\u00e9geinek egy r\u00e9szhalmaz\u00e1t \u2014 a felhaszn\u00e1l\u00f3i \u00e9s folyamat-azonos\u00edt\u00f3k k\u00f6rnyezetb\u0151l val\u00f3 kiz\u00e1r\u00e1s\u00e1hoz a CLONE_NEWUSER \u00e9s CLONE_NEWPID \u00fczemm\u00f3dokat haszn\u00e1lja. Tov\u00e1bbi v\u00e9delem \u00e9rdek\u00e9ben a Bubblewrap \u00e1ltal kezelt programok PR_SET_NO_NEW_PRIVS m\u00f3dban futnak, amely megakad\u00e1lyozza az \u00faj privil\u00e9giumok megszerz\u00e9s\u00e9t, p\u00e9ld\u00e1ul setuid jelz\u0151 jelenl\u00e9t\u00e9ben. <\/p>\n
A f\u00e1jlrendszer szint\u0171 izol\u00e1l\u00e1s alap\u00e9rtelmez\u00e9s szerint \u00faj mont\u00e1zs n\u00e9vt\u00e9r (mount namespace) l\u00e9trehoz\u00e1s\u00e1val t\u00f6rt\u00e9nik, amelyben a tmpfs seg\u00edts\u00e9g\u00e9vel \u00fcres gy\u00f6k\u00e9rpart\u00edci\u00f3 j\u00f6n l\u00e9tre. Ezen a part\u00edci\u00f3n sz\u00fcks\u00e9g eset\u00e9n k\u00fcls\u0151 f\u00e1jlrendszerek part\u00edci\u00f3i csatlakoztathat\u00f3k a 'mount \u2014bind' m\u00f3ddal (p\u00e9ld\u00e1ul a 'bwrap \u2014ro-bind \/usr \/usr' opci\u00f3 bekapcsol\u00e1sakor a \/usr part\u00edci\u00f3 az alap\u00e9rtelmezett rendszerb\u0151l csak olvas\u00e1si m\u00f3dba ker\u00fcl). A h\u00e1l\u00f3zati lehet\u0151s\u00e9gek a loopback interf\u00e9sz el\u00e9r\u00e9s\u00e9re korl\u00e1toz\u00f3dnak a h\u00e1l\u00f3zati verem izol\u00e1l\u00e1s\u00e1val a CLONE_NEWNET \u00e9s CLONE_NEWUTS z\u00e1szl\u00f3k seg\u00edts\u00e9g\u00e9vel. <\/p>\n
A f\u0151 k\u00fcl\u00f6nbs\u00e9g a hasonl\u00f3 Firejail projektt\u0151l, amely szint\u00e9n setuid alkalmaz\u00e1sind\u00edt\u00e1si modellt haszn\u00e1l, hogy a Bubblewrap kont\u00e9nerek l\u00e9trehoz\u00e1s\u00e1nak r\u00e9tege csak a sz\u00fcks\u00e9ges minim\u00e1lis funkci\u00f3kat tartalmazza, m\u00edg a grafikus alkalmaz\u00e1sok ind\u00edt\u00e1s\u00e1hoz, a munkaasztallal val\u00f3 interakci\u00f3hoz \u00e9s a Pulseaudio h\u00edv\u00e1sok sz\u0171r\u00e9s\u00e9hez sz\u00fcks\u00e9ges \u00f6sszes kib\u0151v\u00edtett funkci\u00f3t a Flatpak oldal\u00e1ra helyezik, \u00e9s m\u00e1r a privil\u00e9giumok vissza\u00e1ll\u00edt\u00e1sa ut\u00e1n hajtj\u00e1k v\u00e9gre. A Firejail viszont egyetlen v\u00e9grehajthat\u00f3 f\u00e1jlban egyes\u00edti az \u00f6sszes kapcsol\u00f3d\u00f3 funkci\u00f3t, ami megnehez\u00edti az audit\u00e1l\u00e1s\u00e1t \u00e9s a biztons\u00e1g szinten tart\u00e1s\u00e1t. <\/p>\n
Az \u00faj kiad\u00e1sban: <\/p>\n
\n
Support for the Meson build system has been added. Support for building with Autotools is still retained but will be removed in one of the upcoming releases.\n
Bevezett\u00fck az «—add-seccomp» opci\u00f3t, amely lehet\u0151v\u00e9 teszi t\u00f6bb seccomp program hozz\u00e1ad\u00e1s\u00e1t. Figyelmeztet\u00e9st is hozz\u00e1adtunk, hogy ha az «—seccomp» opci\u00f3t t\u00f6bbsz\u00f6r adj\u00e1k meg, csak az utols\u00f3 param\u00e9ter ker\u00fcl alkalmaz\u00e1sra.\n
The master branch in the git repository has been renamed to main.\n
Partial support for the REUSE specification has been added, standardizing the process of indicating licensing and copyright information. SPDX-License-Identifier headers have been added to many code files. Following REUSE recommendations simplifies the automatic determination of which license applies to which parts of the application code.\n
A check for the command-line argument counter (argc) has been added, implementing an emergency exit if the counter is zero. This change helps block security issues caused by improper handling of command-line arguments, such as CVE-2021-4034 in Polkit. <\/ul>\n