{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Lan\u00e7amento do Bubblewrap 0.4.0, uma camada para criar ambientes isolados.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dispon\u00edvel<\/a><\/noindex> nova vers\u00e3o da ferramenta Bubblewrap 0.4.0<\/a><\/noindex>, destinada \u00e0 organiza\u00e7\u00e3o do trabalho em ambientes isolados no Linux e operando no n\u00edvel de aplicativos de usu\u00e1rios n\u00e3o privilegiados. Na pr\u00e1tica, o Bubblewrap \u00e9 utilizado pelo projeto Flatpak como uma camada para isolar aplicativos executados a partir de pacotes. O c\u00f3digo do projeto \u00e9 escrito em C e \u00e9 distribu\u00eddo<\/a><\/noindex> sob a licen\u00e7a LGPLv2+.<\/p>\n

Para isolamento, s\u00e3o utilizadas tecnologias tradicionais de virtualiza\u00e7\u00e3o de cont\u00eaineres do Linux, baseadas no uso de cgroups, namespaces, Seccomp e SELinux. Para realizar opera\u00e7\u00f5es privilegiadas de configura\u00e7\u00e3o do cont\u00eainer, o Bubblewrap \u00e9 executado com privil\u00e9gios de root (arquivo execut\u00e1vel com a flag suid), com a posterior revoga\u00e7\u00e3o das permiss\u00f5es ap\u00f3s a inicializa\u00e7\u00e3o do cont\u00eainer. <\/p>\n

A ativa\u00e7\u00e3o do sistema de namespaces de identificadores de usu\u00e1rio (user namespaces), que permite usar um conjunto separado de identificadores em cont\u00eaineres, n\u00e3o \u00e9 necess\u00e1ria, pois, por padr\u00e3o, n\u00e3o funciona em muitas distribui\u00e7\u00f5es (Bubblewrap \u00e9 posicionado como uma implementa\u00e7\u00e3o suid limitada de um subconjunto das funcionalidades dos user namespaces \u2014 para isolar todos os identificadores de usu\u00e1rios e processos do ambiente, exceto o atual, s\u00e3o usados os modos CLONE_NEWUSER e CLONE_NEWPID). Para prote\u00e7\u00e3o adicional, os execut\u00e1veis operando sob
\n Bubblewrap s\u00e3o iniciados no modo PR_SET_NO_NEW_PRIVS, que pro\u00edbe a obten\u00e7\u00e3o de novos privil\u00e9gios, por exemplo, na presen\u00e7a da flag setuid. <\/p>\n

A isolamento a n\u00edvel do sistema de arquivos \u00e9 realizado atrav\u00e9s da cria\u00e7\u00e3o por padr\u00e3o de um novo espa\u00e7o de nomes de pontos de montagem (mount namespace), no qual um sistema de arquivos vazio \u00e9 criado utilizando o tmpfs. Neste sistema, segmentos de sistemas de arquivos externos podem ser montados no modo «mount —bind» (por exemplo, ao executar com a op\u00e7\u00e3o «bwrap —ro-bind \/usr \/usr», o segmento \/usr \u00e9 passado do sistema principal no modo somente leitura). As capacidades de rede s\u00e3o limitadas ao acesso \u00e0 interface de loopback com isolamento da pilha de rede atrav\u00e9s das flags CLONE_NEWNET e CLONE_NEWUTS.<\/p>\n

A principal diferen\u00e7a em rela\u00e7\u00e3o a um projeto semelhante Firejail<\/a><\/noindex>, que tamb\u00e9m utiliza um modelo de execu\u00e7\u00e3o com setuid, se diferencia pelo fato de que no Bubblewrap a camada para cria\u00e7\u00e3o de cont\u00eaineres inclui apenas o m\u00ednimo necess\u00e1rio de capacidades, enquanto todas as fun\u00e7\u00f5es avan\u00e7adas necess\u00e1rias para executar aplicativos gr\u00e1ficos, interagir com o desktop e filtrar chamadas ao Pulseaudio s\u00e3o delegadas ao Flatpak e executadas ap\u00f3s a revoga\u00e7\u00e3o dos privil\u00e9gios. Firejail, por outro lado, combina todas as fun\u00e7\u00f5es auxiliares em um \u00fanico arquivo execut\u00e1vel, o que dificulta sua auditoria e a manuten\u00e7\u00e3o da seguran\u00e7a em n\u00edvel adequado.<\/a><\/noindex>.<\/p>\n

O novo lan\u00e7amento \u00e9 not\u00e1vel pela implementa\u00e7\u00e3o do suporte \u00e0 conex\u00e3o de namespaces de identificadores de usu\u00e1rios (user namespaces) e processos (pid namespaces) existentes. Para gerenciar a conex\u00e3o dos namespaces, foram adicionadas as flags \u2018--userns\u2019, \u2018--userns2\u2019 e \u2018--pidns\u2019.
\nEssa funcionalidade n\u00e3o opera no modo setuid e requer a aplica\u00e7\u00e3o de um modo separado, que pode operar sem obter privil\u00e9gios de root, mas requer a ativa\u00e7\u00e3o
\ndos user namespaces no sistema (desabilitados por padr\u00e3o no Debian e RHEL\/CentOS) e n\u00e3o exclui a possibilidade de opera\u00e7\u00e3o<\/a><\/noindex> potencialmente<\/a><\/noindex> permanecer.<\/a><\/noindex> vulnerabilidades<\/a><\/noindex> para restringir os limites dos \u2018user namespaces\u2019. Entre as novas funcionalidades do Bubblewrap 0.4, destaca-se a op\u00e7\u00e3o de compilar com a biblioteca C musl em vez de glibc e o suporte para salvar informa\u00e7\u00f5es sobre os namespaces em um arquivo de estat\u00edsticas no formato JSON.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do Bubblewrap 0.4.0, uma camada para a cria\u00e7\u00e3o de ambientes isolados | ProHoster","description":"Uma nova vers\u00e3o da ferramenta est\u00e1 dispon\u00edvel","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}