{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"Proiectul Landrun dezvolt\u0103 un sistem de izolare a aplica\u021biilor f\u0103r\u0103 privilegii.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Proiectul Landrun a \u00eenceput dezvoltarea unui nou sistem pentru execu\u021bia izolat\u0103 a aplica\u021biilor individuale. Pentru izolare, este utilizat modulul LSM din nucleul Linux Landlock, care permite evitarea execu\u021biei opera\u021biunilor privilegiate \u00een timpul cre\u0103rii unui mediu sandbox. Din punct de vedere al func\u021bionalit\u0103\u021bilor, Landrun este similar cu utilitarul Firejail, dar se deosebe\u0219te printr-o implementare mai simpl\u0103, fiind mai u\u0219or \u0219i av\u00e2nd capacitatea de a func\u021biona sub un utilizator obi\u0219nuit f\u0103r\u0103 a fi livrat cu flag-ul suid. Codul proiectului este scris \u00een limbajul Go \u0219i este distribuit sub licen\u021ba GPLv2. <\/p>\n

Mecanismul Landlock permite programelor f\u0103r\u0103 privilegii s\u0103 limiteze utilizarea obiectelor din nucleul Linux, cum ar fi ierarhiile de fi\u0219iere, socket-urile de re\u021bea \u0219i ioctl. Spre deosebire de spa\u021biile de nume \u0219i filtrarea apelurilor de sistem, mediu izolat este creat de nucleul Linux sub forma unei straturi suplimentare peste mecanismele existente de control al accesului. Pentru a interac\u021biona cu subsistemul Landlock, utilitarul landrun folose\u0219te biblioteca go-landlock de la dezvoltatorii LandLock. <\/p>\n

Landrun permite reducerea riscului de compromitere a sistemului de baz\u0103 atunci c\u00e2nd se execut\u0103 programe nefiabile sau poten\u021bial vulnerabile. Printre func\u021bionalit\u0103\u021bile sale se num\u0103r\u0103 suportul pentru limitarea selectiv\u0103 a accesului la nivel de directoare individuale, legarea privilegiilor la c\u0103ile fi\u0219ierelor (permisiuni de citire, scriere \u0219i execu\u021bie) \u0219i controlul ini\u021bierii \u0219i accept\u0103rii conexiunilor TCP. <\/p>\n

De exemplu, prin intermediul Landrun, se poate interzice executarea fi\u0219ierelor binare, permite scrierea doar \u00eentr-un subdosar specific cu date, interzice crearea de socket-uri de ascultare pentru primirea conexiunilor de re\u021bea \u0219i permite trimiterea de cereri de re\u021bea doar pe porturile TCP specificate. \u00cen cazul cel mai simplu, pentru a interzice scrierea, executarea \u0219i func\u021biile de re\u021bea, programul poate fi rulat cu comanda \u201elandrun \u2014ro \/\u201d, iar pentru izolarea nginx se poate folosi: landrun \u2014rox \/usr\/bin \u2014ro \/lib,\/lib64,\/var\/www \u2014rwx \/var\/log \u2014bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n

Planurile de viitor men\u021bioneaz\u0103 un control extins al accesului la sistemul de fi\u0219iere, suport pentru UDP \u0219i gestionarea resurselor proceselor. Pentru a limita accesul la nivelul sistemului de fi\u0219iere, este necesar cel pu\u021bin un nucleu Linux 5.13, iar pentru restric\u021biile de re\u021bea \u2014 6.8. <\/p>\n

De asemenea, se poate men\u021biona c\u0103 modific\u0103rile au fost deja acceptate \u00een baza de cod Firejail, care permit utilizarea subsistemului de nucleu Landlock pentru izolarea f\u0103r\u0103 bitul suid \u0219i cre\u0219terea privilegiilor, dar versiunea cu acest suport nu a fost publicat\u0103 \u00eenc\u0103.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d LSM-\u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f sandbox-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u043e \u0441\u0432\u043e\u0438\u043c \u0437\u0430\u0434\u0430\u0447\u0430\u043c Landrun \u0431\u043b\u0438\u0437\u043e\u043a \u043a \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Firejail, \u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439, \u043b\u0435\u0433\u043a\u043e\u0432\u0435\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434 \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid. \u041a\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122970","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Proiectul Landrun dezvolt\u0103 un sistem de izolare a aplica\u021biilor f\u0103r\u0103 privilegii | ProHoster","description":"Proiectul Landrun a \u00eenceput dezvoltarea unui nou sistem pentru execu\u021bia izolat\u0103 a unor aplica\u021bii individuale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T08:22:49+00:00","article:modified_time":"2025-03-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122970","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:34:09","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:34:09","updated":"2026-01-23 11:34:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=122970"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122970\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=122970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=122970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=122970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}