{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu ograniczy dost\u0119p do przestrzeni nazw u\u017cytkownik\u00f3w.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Canonical og\u0142osi\u0142a wprowadzenie do Ubuntu 23.10 zmian ograniczaj\u0105cych dost\u0119p u\u017cytkownik\u00f3w do przestrzeni nazw identyfikator\u00f3w u\u017cytkownika (user namespace), co zwi\u0119kszy bezpiecze\u0144stwo system\u00f3w wykorzystuj\u0105cych izolacj\u0119 kontener\u00f3w przed lukami, do wykorzystania kt\u00f3rych konieczne s\u0105 manipulacje z user namespace. Wed\u0142ug Google, 44% exploit\u00f3w bior\u0105cych udzia\u0142 w programie wyp\u0142aty nagr\u00f3d za wykrywanie luk w j\u0105drze Linuxa wymaga mo\u017cliwo\u015bci tworzenia przestrzeni nazw identyfikator\u00f3w u\u017cytkownika. <\/p>\n

Zamiast ca\u0142kowitego zablokowania dost\u0119pu do przestrzeni u\u017cytkownika w Ubuntu zastosowano hybrydowy model, kt\u00f3ry wybi\u00f3rczo pozwala niekt\u00f3rym programom na tworzenie przestrzeni u\u017cytkownika w przypadku posiadania profilu AppArmor z regu\u0142\u0105 «allow userns create» lub uprawnie\u0144 CAP_SYS_ADMIN. Na przyk\u0142ad dla Chrome stworzono profil \/etc\/apparmor.d\/opt.google.chrome.chrome, kt\u00f3ry mo\u017cna wykorzysta\u0107 jako przyk\u0142ad do otwierania dost\u0119pu do przestrzeni u\u017cytkownika dla innych program\u00f3w. <\/p>\n

W nadchodz\u0105cej wersji Ubuntu 23.10 ograniczenie dost\u0119pu do user namespace planuje si\u0119 zaoferowa\u0107 jako opcj\u0119, kt\u00f3ra nie b\u0119dzie w\u0142\u0105czona domy\u015blnie. W ci\u0105gu kilku tygodni po wydaniu Ubuntu 23.10 deweloperzy zbior\u0105 informacje o mo\u017cliwym negatywnym wp\u0142ywie wy\u0142\u0105czenia dost\u0119pu do user namespace na dzia\u0142anie pakiet\u00f3w i przygotuj\u0105 odpowiednie profile AppArmor. Nast\u0119pnie w jednym z aktualizacji poprawkowych pakietu j\u0105dra (Stable Release Updates) ograniczenie zostanie aktywowane domy\u015blnie. <\/p>\n

Aby przedwcze\u015bnie w\u0142\u0105czy\u0107 ograniczenie, mo\u017cna u\u017cy\u0107 polece\u0144: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n

A aby je wy\u0142\u0105czy\u0107: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e, \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 user namespace. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, 44% \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110711","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ubuntu ograniczy dost\u0119p do user namespace | ProHoster","description":"Firma Canonical og\u0142osi\u0142a wprowadzenie do Ubuntu 23.10 zmian ograniczaj\u0105cych dost\u0119p u\u017cytkownik\u00f3w do przestrzeni nazw identyfikator\u00f3w u\u017cytkownika (user namespace), co zwi\u0119kszy bezpiecze\u0144stwo system\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Ubuntu \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a user namespace | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-10T01:10:26+00:00","article:modified_time":"2023-10-10T01:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/110711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=110711"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/110711\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=110711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=110711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=110711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}