Firejail 0.9.72 yatulutsidwa. Imapanga njira yogwiritsira ntchito zithunzi, ma console, ndi mapulogalamu a seva, kuchepetsa chiopsezo choika pachiwopsezo dongosolo la host pamene likugwiritsa ntchito mapulogalamu osadalirika kapena omwe angakhale pachiwopsezo. Pulogalamuyi imalembedwa mu C, imagawidwa pansi pa layisensi ya GPLv2, ndipo imagwira ntchito pa kugawa kulikonse. Linux ndi kernel yakale kuposa 3.0. Ma phukusi opangidwa okonzeka ndi Firejail amakonzedwa mu mawonekedwe a deb (Debian, Ubuntu) ndi rpm (CentOS, Fedora).
Firejail imagwiritsa ntchito malo osungira mayina, AppArmor, ndi kusefa mafoni a dongosolo (seccomp-bpf) kuti ipatule. LinuxPulogalamu ikangoyambitsidwa, ndi njira zake zonse zoyambira zimagwiritsa ntchito mawonekedwe osiyana a zinthu za kernel, monga network stack, process table, ndi mount points. Mapulogalamu ogwirizana amatha kuphatikizidwa kukhala sandbox imodzi yogawana. Firejail ingagwiritsidwenso ntchito kuyendetsa zotengera za Docker, LXC, ndi OpenVZ.
Mosiyana ndi zida zodzipatula zachidebe, ndende yamoto ndiyosavuta kuyisintha ndipo sifunikira kukonza chithunzi chadongosolo - mawonekedwe a chidebe amapangidwa pa ntchentche potengera zomwe zili pamafayilo apano ndipo amachotsedwa ntchitoyo ikamalizidwa. Njira zosinthika zokhazikitsira malamulo ofikira pamafayilo amaperekedwa; mutha kudziwa kuti ndi mafayilo ati omwe amaloledwa kapena kukanidwa, kulumikiza mafayilo osakhalitsa (tmpfs) pa data, kuchepetsa mwayi wamafayilo kapena zolemba kuti muwerenge-pokha, kuphatikiza maupangiri kudzera kumanga-phiri ndi overlayfs.
Pazinthu zambiri zodziwika bwino, kuphatikiza Firefox, Chromium, VLC ndi Transmission, ma profiles odzipatula opangidwa okonzeka akonzedwa. Kuti mupeze mwayi wofunikira kukhazikitsa malo okhala ndi mchenga, chowotcha moto chimayikidwa ndi mbendera ya mizu ya SUID (mwayi umakhazikitsidwanso pambuyo poyambitsa). Kuti mugwiritse ntchito pulogalamu yodzipatula, ingotchulani dzina la pulogalamuyo ngati mtsutso ku zida zamoto, mwachitsanzo, "firejail firefox" kapena "sudo firejail /etc/init.d/nginx start".
M'kutulutsa kwatsopano:
- Onjezani fyuluta ya seccomp yama foni am'makina omwe amaletsa kupangidwa kwa malo a mayina (njira ya "-restrict-namespaces" yawonjezedwa kuti itheke). Matebulo oyitanitsa amachitidwe osinthidwa ndi magulu a seccomp.
- Kupititsa patsogolo mphamvu-nonewprivs mode (NO_NEW_PRIVS), yomwe imalepheretsa njira zatsopano kupeza mwayi wowonjezera.
- Onjezani kuthekera kogwiritsa ntchito mbiri yanu ya AppArmor (njira ya "--apparmor" imaperekedwa kuti ilumikizidwe).
- Nettrace network track tracking system, yomwe imawonetsa zambiri za IP ndi kuchuluka kwa magalimoto kuchokera ku adilesi iliyonse, imagwiritsa ntchito thandizo la ICMP ndikupereka "--dnstrace", "--icmptrace" ndi "--snitrace".
- Malamulo --cgroup ndi --shell achotsedwa (zosakhazikika ndi --shell=none). Kumanga kwa Firetunnel kuyimitsidwa mwachisawawa. Zosintha za chroot, zachinsinsi-lib ndi tracelog mu /etc/firejail/firejail.config. Thandizo la grisecurity lathetsedwa.
Source: opennet.ru
