{"id":106390,"date":"2023-01-19T00:48:17","date_gmt":"2023-01-18T22:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72"},"modified":"2023-01-19T00:48:17","modified_gmt":"2023-01-18T22:48:17","slug":"vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","title":{"rendered":"Lansarea sistemului de izolare a aplica\u021biilor Firejail 0.9.72","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost publicat\u0103 versiunea proiectului Firejail 0.9.72, care dezvolt\u0103 un sistem pentru executarea izolat\u0103 a aplica\u021biilor grafice, de consol\u0103 \u0219i server, permi\u021b\u00e2nd minimizarea riscului de compromitere a sistemului de baz\u0103 la rularea programelor nesigure sau poten\u021bial vulnerabile. Programul este scris \u00een limbajul C, este distribuit sub licen\u021ba GPLv2 \u0219i poate func\u021biona pe orice distribu\u021bie Linux cu un nucleu mai vechi de 3.0. Pachetele preg\u0103tite pentru Firejail sunt disponibile \u00een formate deb (Debian, Ubuntu) \u0219i rpm (CentOS, Fedora).      <\/p>\n<p>Pentru izolarea \u00een Firejail se folosesc spa\u021biile de nume (namespaces), AppArmor \u0219i filtrarea apelurilor sistemice (seccomp-bpf) \u00een Linux. Dup\u0103 lansare, programul \u0219i toate procesele sale fiice folosesc reprezent\u0103ri separate ale resurselor nucleului, cum ar fi stiva de re\u021bea, tabela proceselor \u0219i punctele de montare. Aplica\u021biile interdependente pot fi combinate \u00eentr-un singur sandbox comun. Firejail poate fi utilizat \u0219i pentru lansarea containerelor Docker, LXC \u0219i OpenVZ.     <\/p>\n<p>Spre deosebire de instrumentele de izolare a containerelor, firejail este extrem de simplu de configurat \u0219i nu necesit\u0103 preg\u0103tirea unei imagini sistemice \u2014 con\u021binutul containerului este generat dinamic pe baza con\u021binutului FS-ului curent \u0219i este eliminat dup\u0103 terminarea aplica\u021biei. Sunt oferite instrumente flexibile pentru stabilirea regulilor de acces la sistemul de fi\u0219iere, put\u00e2nd fi definit la ce fi\u0219iere \u0219i directoare este permis sau interzis accesul, se pot monta sisteme de fi\u0219iere temporare (tmpfs) pentru date, se poate restric\u021biona accesul la fi\u0219iere sau directoare doar la citire, se pot combina directoare prin bind-mount \u0219i overlayfs.      <\/p>\n<p>Pentru un num\u0103r mare de aplica\u021bii populare, inclusiv Firefox, Chromium, VLC \u0219i Transmission, au fost preg\u0103tite profiluri gata f\u0103cute pentru izolare a apelurilor sistemului. Pentru a ob\u021bine privilegiile necesare pentru configurarea unui mediu izolat, fi\u0219ierul executabil firejail este instalat cu steagul SUID root (dup\u0103 ini\u021bializare, privilegiile sunt resetate). Pentru a rula programul \u00een mod izolat, este suficient s\u0103 specifici numele aplica\u021biei ca argument pentru utilitarul firejail, de exemplu, \u201efirejail firefox\u201d sau \u201esudo firejail \/etc\/init.d\/nginx start\u201d.   <\/p>\n<p>\u00cen noua versiune:  <\/p>\n<ul>\n<li class=\"l\"> A fost ad\u0103ugat un filtru seccomp pentru apelurile sistemului, bloc\u00e2nd crearea spa\u021biilor de nume (op\u021biunea \u201e--restrict-namespaces\u201d a fost ad\u0103ugat\u0103 pentru activare). Tabelele apelurilor sistemului \u0219i grupurile seccomp au fost actualizate.\n<li class=\"l\"> A fost \u00eembun\u0103t\u0103\u021bit modul force-nonewprivs (NO_NEW_PRIVS), interzic\u00e2nd ob\u021binerea de privilegii suplimentare \u00een noile procese.\n<li class=\"l\"> A fost ad\u0103ugat\u0103 posibilitatea de a folosi profiluri proprii AppArmor (op\u021biunea \u201e--apparmor\u201d a fost propus\u0103 pentru activare).\n<li class=\"l\"> \u00cen sistemul de urm\u0103rire a traficului de re\u021bea nettrace, care afi\u0219eaz\u0103 informa\u021bii despre IP \u0219i intensitatea traficului de la fiecare adres\u0103, a fost implementat suport pentru ICMP, fiind propuse op\u021biunile \u201e--dnstrace\u201d, \u201e--icmptrace\u201d \u0219i \u201e--snitrace\u201d.\n<li class=\"l\"> Comenzile \u201e-cgroup\u201d \u0219i \u201e-shell\u201d au fost eliminate (\u00een mod implicit se aplic\u0103 \u201e-shell=none\u201d). \u00cen mod implicit, s-a oprit construirea firetunnel. Set\u0103rile chroot, private-lib \u0219i tracelog din \/etc\/firejail\/firejail.config au fost dezactivate. Suportul pentru grsecurity a fost oprit.      <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58493\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.72, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 Linux \u0441 \u044f\u0434\u0440\u043e\u043c \u0441\u0442\u0430\u0440\u0448\u0435 3.0. \u0413\u043e\u0442\u043e\u0432\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0441 Firejail \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106390","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.72, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.72 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.72, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-01-18T22:48:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-01-18T22:48:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea sistemului de izolare a aplica\u021biilor Firejail 0.9.72 | ProHoster","description":"A fost publicat\u0103 versiunea proiectului Firejail 0.9.72, care dezvolt\u0103 un sistem pentru executarea izolat\u0103 a aplica\u021biilor grafice, de consol\u0103 \u0219i server, permi\u021b\u00e2nd minimizarea riscului de compromitere a sistemului de baz\u0103 la rulare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Firejail 0.9.72 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Firejail 0.9.72, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445, \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-01-18T22:48:17+00:00","article:modified_time":"2023-01-18T22:48:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/106390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=106390"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/106390\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=106390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=106390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=106390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}