{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"Projekt Landrun rozwija nieuprzywilejowany system izolacji aplikacji.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Projekt Landrun rozpocz\u0105\u0142 rozw\u00f3j nowego systemu do izolowanego uruchamiania poszczeg\u00f3lnych aplikacji. Do izolacji wykorzystywany jest modu\u0142 j\u0105dra Linux LSM Landlock, kt\u00f3ry pozwala na stworzenie \u015brodowiska sandbox bez wykonywania operacji z uprawnieniami uprzywilejowanymi. Pod wzgl\u0119dem funkcjonalno\u015bci Landrun jest podobny do narz\u0119dzia Firejail, ale wyr\u00f3\u017cnia si\u0119 prostsz\u0105 realizacj\u0105, niewielk\u0105 wag\u0105 oraz mo\u017cliwo\u015bci\u0105 dzia\u0142ania jako zwyk\u0142y u\u017cytkownik bez potrzeby u\u017cycia flagi suid. Kod projektu zosta\u0142 napisany w j\u0119zyku Go i jest dystrybuowany na licencji GPLv2. <\/p>\n

Mechanizm Landlock pozwala programom bez uprawnie\u0144 na ograniczenie u\u017cycia obiekt\u00f3w j\u0105dra Linux, takich jak hierarchie plik\u00f3w, gniazda sieciowe i ioctl. W przeciwie\u0144stwie do przestrzeni nazw i filtracji wywo\u0142a\u0144 systemowych, izolowane \u015brodowisko jest tworzone przez j\u0105dro Linux w formie dodatkowej warstwy nad istniej\u0105cymi mechanizmami zarz\u0105dzania dost\u0119pem. Do interakcji z podsystemem Landlock w narz\u0119dziu landrun wykorzystywana jest biblioteka go-landlock od tw\u00f3rc\u00f3w LandLock. <\/p>\n

Landrun pozwala na zmniejszenie ryzyka kompromitacji g\u0142\u00f3wnego systemu podczas uruchamiania zaufanych lub potencjalnie wra\u017cliwych program\u00f3w. W\u015br\u00f3d mo\u017cliwo\u015bci wyr\u00f3\u017cnia si\u0119 wsparcie dla selektywnego ograniczania dost\u0119pu na poziomie poszczeg\u00f3lnych katalog\u00f3w, przypinanie uprawnie\u0144 do \u015bcie\u017cek plik\u00f3w (zezwolenie lub zakaz na odczyt, zapis i wykonanie) oraz kontrola nad inicjowaniem i odbieraniem po\u0142\u0105cze\u0144 TCP. <\/p>\n

Na przyk\u0142ad, za pomoc\u0105 Landrun mo\u017cna zakaza\u0107 uruchamiania plik\u00f3w wykonywalnych, zezwoli\u0107 na zapis tylko w okre\u015blonym podfolderze z danymi, zabroni\u0107 tworzenia nas\u0142uchuj\u0105cych gniazd do odbierania po\u0142\u0105cze\u0144 sieciowych oraz zezwoli\u0107 na wysy\u0142anie \u017c\u0105da\u0144 sieciowych tylko na okre\u015blone porty TCP. W najprostszym przypadku, aby zabroni\u0107 zapisu, uruchamiania i mo\u017cliwo\u015bci sieciowych, program mo\u017cna uruchomi\u0107 poleceniem \u201elandrun \u2014ro \/\u201d, a dla izolacji nginx mo\u017cna u\u017cy\u0107: landrun \u2014rox \/usr\/bin \u2014ro \/lib,\/lib64,\/var\/www \u2014rwx \/var\/log \u2014bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n

W planach na przysz\u0142o\u015b\u0107 wspomniano o rozszerzonym zarz\u0105dzaniu dost\u0119pem do systemu plik\u00f3w, wsparciu dla UDP oraz zarz\u0105dzaniu zasobami proces\u00f3w. Aby ograniczy\u0107 dost\u0119p na poziomie systemu plik\u00f3w, wymagane jest co najmniej j\u0105dro Linux 5.13, a dla ogranicze\u0144 sieciowych \u2014 6.8. <\/p>\n

Dodatkowo warto zauwa\u017cy\u0107, \u017ce do bazy kodu Firejail wprowadzono ju\u017c zmiany umo\u017cliwiaj\u0105ce korzystanie z podsystemu j\u0105dra Landlock do izolacji bez bitu suid i podnoszenia uprawnie\u0144, ale wydanie z t\u0105 obs\u0142ug\u0105 nie zosta\u0142o jeszcze opublikowane.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d LSM-\u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f sandbox-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u043e \u0441\u0432\u043e\u0438\u043c \u0437\u0430\u0434\u0430\u0447\u0430\u043c Landrun \u0431\u043b\u0438\u0437\u043e\u043a \u043a \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Firejail, \u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439, \u043b\u0435\u0433\u043a\u043e\u0432\u0435\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434 \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid. \u041a\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122970","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Projekt Landrun rozwija system izolacji aplikacji bez uprawnie\u0144 | ProHoster","description":"Projekt Landrun rozpocz\u0105\u0142 rozw\u00f3j nowego systemu do izolowanego wykonywania pojedynczych aplikacji.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T08:22:49+00:00","article:modified_time":"2025-03-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122970","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:34:09","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:34:09","updated":"2026-01-23 11:34:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/122970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=122970"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/122970\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=122970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=122970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=122970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}