{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu ierobe\u017eos piek\u013cuvi lietot\u0101ja telpai","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uz\u0146\u0113mums Canonical pazi\u0146oja par izmai\u0146\u0101m Ubuntu 23.10, kas ierobe\u017eo lietot\u0101ju piek\u013cuvi lietot\u0101ja identifikatoru nosaukumu telp\u0101m (user namespace), t\u0101d\u0113j\u0101di uzlabojot sist\u0113mu dro\u0161\u012bbu, kas izmanto konteineru izol\u0101ciju, pret ievainojam\u012bb\u0101m, kuru izmanto\u0161anai nepiecie\u0161amas manipul\u0101cijas ar user namespace. Saska\u0146\u0101 ar Google datiem, 44% eksploit\u0101ciju, kas piedal\u0101s ievainojam\u012bbu atl\u012bdz\u012bbu programm\u0101 Linux kodol\u0101, prasa iesp\u0113ju izveidot lietot\u0101ja identifikatoru nosaukumu telpas. <\/p>\n

T\u0101 viet\u0101, lai piln\u012bb\u0101 blo\u0137\u0113tu piek\u013cuvi lietot\u0101ja nosaukumam Ubuntu, ir ieviesta hibr\u012bda sh\u0113ma, kas da\u017e\u0101m programm\u0101m \u013cauj izveidot lietot\u0101ja nosaukumu, ja ir AppArmor profils ar noteikumu «allow userns create» vai ties\u012bb\u0101m CAP_SYS_ADMIN. Piem\u0113ram, Chrome ir izveidots profils \/etc\/apparmor.d\/opt.google.chrome.chrome, ko var izmantot k\u0101 piem\u0113ru piek\u013cuves nodro\u0161in\u0101\u0161anai lietot\u0101ja nosaukumam cit\u0101m programm\u0101m. <\/p>\n

Gaido\u0161aj\u0101 Ubuntu 23.10 izlaidum\u0101 piek\u013cuves ierobe\u017eo\u0161ana uz user namespace pl\u0101nota k\u0101 opcija, kas p\u0113c noklus\u0113juma nav aktiviz\u0113ta. Da\u017eu ned\u0113\u013cu laik\u0101 p\u0113c Ubuntu 23.10 izdevuma izlai\u0161anas izstr\u0101d\u0101t\u0101ji apkopo inform\u0101ciju par iesp\u0113jamu negat\u012bvu ietekmi uz pakot\u0146u darb\u012bbu, ja piek\u013cuve user namespace tiek atsp\u0113jota, un sagatavos attiec\u012bgus AppArmor profilus. P\u0113c tam vien\u0101 no stabil\u0101s atjaunin\u0101jumu pakotn\u0113m ierobe\u017eojums tiks aktiviz\u0113ts p\u0113c noklus\u0113juma. <\/p>\n

Iepriek\u0161\u0113jai ierobe\u017eojuma aktiviz\u0113\u0161anai var izmantot komandus: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n

Un, lai to atsp\u0113jotu: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e, \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 user namespace. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, 44% \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110711","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ubuntu ierobe\u017eos piek\u013cuvi user namespace | ProHoster","description":"Uz\u0146\u0113mums Canonical pazi\u0146oja par izmai\u0146\u0101m Ubuntu 23.10, kas ierobe\u017eo lietot\u0101ju piek\u013cuvi lietot\u0101ja identifikatoru nosaukumu telp\u0101m (user namespace), t\u0101d\u0113j\u0101di uzlabojot sist\u0113mu dro\u0161\u012bbu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Ubuntu \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a user namespace | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-10T01:10:26+00:00","article:modified_time":"2023-10-10T01:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/110711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=110711"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/110711\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=110711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=110711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=110711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}