Kwa FreeBSD, kukhazikitsidwa kwa njira yodzipatula yogwiritsira ntchito ikuperekedwa, kukumbutsa za plegde ndikuwululira mafoni opangidwa ndi polojekiti ya OpenBSD. Kudzipatula mu plegde kumatheka poletsa mwayi woimbira mafoni omwe sagwiritsidwa ntchito, komanso povumbulutsa mwa kusankha njira zopezera mafayilo omwe pulogalamuyo ingagwire nawo. Pakugwiritsa ntchito, mtundu wa mndandanda woyera wamayimbidwe amachitidwe ndi njira zamafayilo zimapangidwa, ndipo mafoni ena onse ndi njira ndizoletsedwa.
Kusiyana pakati pa analogue ya plegde ndi kuvumbulutsa kupangidwira kwa FreeBSD kumatsikira pakuperekedwa kwa gawo lowonjezera lomwe limakupatsani mwayi wopatula mapulogalamu osasintha ma code awo kapena kusintha pang'ono. Kumbukirani kuti mu OpenBSD, plegde ndi kuvumbulutsa cholinga chake ndi kuphatikizika kolimba ndi malo omwe ali pansi ndipo amagwiritsidwa ntchito powonjezera maupangiri apadera pama code a pulogalamu iliyonse. Kuti muchepetse dongosolo lachitetezo, zosefera zimakupatsani mwayi wofotokozera mwatsatanetsatane pamayimbidwe amtundu uliwonse ndikuwongolera magawo amayimbidwe amtundu (zolowera / zotulutsa, mafayilo owerengera, mafayilo olembera, sockets, ioctl, sysctl, process launch, etc.) . Ntchito zoletsa kulowa zitha kutchedwa mu code yogwiritsira ntchito monga zochita zina zimachitikira, mwachitsanzo, kupeza ma sockets ndi mafayilo kungakanidwe mutatha kutsegula mafayilo ofunikira ndikukhazikitsa kulumikizana kwa netiweki.
Wolemba doko la plegde ndikuvumbulutsa kwa FreeBSD akufuna kupereka mwayi wopatula mapulogalamu osagwirizana, omwe chinsalucho chimapangidwira, chomwe chimakulolani kuti mugwiritse ntchito malamulo omwe amafotokozedwa mu fayilo yosiyana ndi mapulogalamu. Kukonzekera komwe kukufunaku kumaphatikizapo fayilo yokhala ndi zoikamo zoyambira zomwe zimatanthauzira magawo amayimbidwe amachitidwe ndi njira zamafayilo zomwe zimayenderana ndi mapulogalamu ena (kugwira ntchito ndi mawu, kulumikizana kwa netiweki, kudula mitengo, ndi zina), komanso fayilo yokhala ndi malamulo ofikira pamapulogalamu ena.
Chophimbacho chingagwiritsidwe ntchito kupatula zinthu zambiri zosasinthidwa, machitidwe a seva, zojambula, komanso magawo onse apakompyuta. Chophimba chingagwiritsidwe ntchito molumikizana ndi njira zodzipatula zoperekedwa ndi Jail ndi Capsicum subsystems. N'zothekanso kukonza zisa kudzipatula, pamene anapezerapo ntchito cholowa malamulo anapereka kholo ntchito, supplementing iwo ndi zoletsa munthu. Ntchito zina za kernel (ma debugging, POSIX/SysV IPC, PTYs) zimatetezedwanso ndi njira yotchinga yomwe imalepheretsa kupeza zinthu za kernel zomwe sizinapangidwe ndi zomwe zikuchitika kapena makolo.
Njira ikhoza kukhazikitsa kudzipatula poyimba curtainctl kapena kugwiritsa ntchito libcurtain's plegde() ndi unveil() ntchito, zofanana ndi zomwe zimapezeka mu OpenBSD. Kuti muzitsatira maloko pamene pulogalamuyo ikugwira ntchito, sysctl 'security.curtain.log_level' imaperekedwa. Kufikira kwa ma protocol a X11 ndi Wayland kumayatsidwa padera potchula zosankha za "-X"/"-Y" ndi "-W" mukamagwiritsa ntchito nsalu yotchinga, koma kuthandizira kwazithunzi sikunakhazikike mokwanira ndipo kuli ndi zovuta zingapo zomwe sizinathe. mavuto amawonekera makamaka mukamagwiritsa ntchito X11, ndipo chithandizo cha Wayland chimakhazikitsidwa bwino kwambiri). Ogwiritsa ntchito amatha kuwonjezera zoletsa popanga mafayilo amalamulo akumaloko (~/.curtain.conf). Mwachitsanzo, kulola kulemba kuchokera ku Firfox kokha ku ~/Downloads/ directory, mukhoza kuwonjezera gawo la "[firfox]" ndi lamulo "~/Downloads/: rw +".
Kukhazikitsaku kumaphatikizapo mac_curtain kernel module for mandatory access control (MAC, Mandatory Access Control), seti ya zigamba za FreeBSD kernel ndikukhazikitsa zofunikira ndi zosefera, laibulale ya libcurtain yogwiritsa ntchito plegde ndikuvumbulutsa ntchito muzofunsira, zotchinga, mwachitsanzo, mafayilo osinthira, kuyesa ndi zigamba zamapulogalamu ena pamalo ogwiritsira ntchito (mwachitsanzo, kugwiritsa ntchito $ TMPDIR kugwirizanitsa ntchito ndi mafayilo osakhalitsa). Ngati kuli kotheka, wolemba akufuna kuchepetsa kuchuluka kwa zosintha zomwe zimafuna zigamba ku kernel ndi kugwiritsa ntchito.
Source: opennet.ru