{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Lansarea Bubblewrap 0.4.0, straturile pentru crearea de medii izolate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Disponibil<\/a><\/noindex> noua versiune a uneltelor Bubblewrap 0.4.0<\/a><\/noindex>, destinat pentru organizarea activit\u0103\u021bii mediilor izolate \u00een Linux \u0219i func\u021bion\u00e2nd la nivelul aplica\u021biilor utilizatorilor neprivilegia\u021bi. \u00cen practic\u0103, Bubblewrap este utilizat de proiectul Flatpak ca un strat pentru izolarea aplica\u021biilor lansate din pachete. Codul proiectului este scris \u00een limbajul C \u0219i se r\u0103sp\u00e2nde\u0219te<\/a><\/noindex> sub licen\u021ba LGPLv2+.<\/p>\n

Pentru izolare se folosesc tehnologii tradi\u021bionale de virtualizare a containerelor \u00een Linux, bazate pe utilizarea cgroups, spa\u021biilor de nume (namespaces), Seccomp \u0219i SELinux. Pentru a efectua opera\u021biuni privilegiate de configurare a containerului, Bubblewrap este lansat cu drepturi root (fi\u0219ierul executabil are flag-ul suid) cu resetarea privilegiilor dup\u0103 finalizarea ini\u021bializ\u0103rii containerului. <\/p>\n

Activarea sistemului de spa\u021bii de nume pentru identificatori de utilizator (user namespaces), care permit utilizarea \u00eentr-un container a propriului set de identificatori, nu este necesar\u0103, deoarece, \u00een mod implicit, nu func\u021bioneaz\u0103 \u00een multe distribu\u021bii (Bubblewrap este pozi\u021bionat ca o realizare limitat\u0103 suid a unui subgrup de capabilit\u0103\u021bi ale spa\u021biilor de nume pentru utilizatori \u2014 pentru a exclude to\u021bi identificatorii utilizatorilor \u0219i proceselor din mediu, cu excep\u021bia celui curent, se utilizeaz\u0103 modurile CLONE_NEWUSER \u0219i CLONE_NEWPID). Pentru o protec\u021bie suplimentar\u0103, executabilele care ruleaz\u0103 sub managementul
\n Bubblewrap sunt lansate \u00een modul PR_SET_NO_NEW_PRIVS, care interzice ob\u021binerea unor privilegii noi, de exemplu, \u00een prezen\u021ba flag-ului setuid. <\/p>\n

Izolarea la nivel de sistem de fi\u0219iere se realizeaz\u0103 prin crearea, \u00een mod implicit, a unui nou spa\u021biu de nume pentru punctele de montare (mount namespace), \u00een care, cu ajutorul tmpfs, se creeaz\u0103 un sistem de fi\u0219iere r\u0103d\u0103cin\u0103 gol. \u00cen aceast\u0103 parti\u021bie, se pot ata\u0219a, dac\u0103 este necesar, parti\u021bii externe \u00een modul \u201emount \u2014bind\u201d (de exemplu, la pornirea cu op\u021biunea \u201ebwrap \u2014ro-bind \/usr \/usr\u201d, parti\u021bia \/usr este trecut\u0103 din sistemul principal \u00een modul doar pentru citire). Capacit\u0103\u021bile de re\u021bea sunt limitate la accesul la interfa\u021ba loopback, cu izolarea stivei de re\u021bea prin flagurile CLONE_NEWNET \u0219i CLONE_NEWUTS.<\/p>\n

Diferen\u021ba esen\u021bial\u0103 fa\u021b\u0103 de un proiect similar Firejail<\/a><\/noindex>, care folose\u0219te de asemenea un model de execu\u021bie cu aplicarea setuid, const\u0103 \u00een faptul c\u0103 \u00een Bubblewrap stratul pentru crearea containerelor include doar minimul necesar de func\u021bionalit\u0103\u021bi, iar toate func\u021biile extinse necesare pentru rularea aplica\u021biilor grafice, interac\u021biunea cu desktopul \u0219i filtrarea apelurilor la Pulseaudio sunt mutate \u00een partea Flatpak \u0219i executate deja dup\u0103 resetarea privilegiilor. Firejail, pe de alt\u0103 parte, combin\u0103 toate func\u021biile \u00een acela\u0219i fi\u0219ier executabil, ceea ce complic\u0103 auditul s\u0103u \u0219i men\u021binerea securit\u0103\u021bii la nivelul corespunz\u0103tor.<\/a><\/noindex>.<\/p>\n

Noua versiune se remarc\u0103 prin implementarea suportului pentru conectarea spa\u021biilor de nume existente pentru utilizatori (user namespaces) \u0219i procese (pid namespaces). Pentru gestionarea conect\u0103rii spa\u021biilor de nume au fost ad\u0103ugate flag-uri \u00ab\u2014userns\u00bb, \u00ab\u2014userns2\u00bb \u0219i \u00ab\u2014pidns\u00bb.
\nAceast\u0103 op\u021biune nu func\u021bioneaz\u0103 \u00een modul setuid \u0219i necesit\u0103 aplicarea unei modalit\u0103\u021bi separate, care poate func\u021biona f\u0103r\u0103 ob\u021binerea privilegiilor root, dar necesit\u0103 activare.
\nspa\u021biilor de nume al utilizatorilor \u00een sistem (de obicei dezactivate \u00een Debian \u0219i RHEL\/CentOS) \u0219i nu exclude posibilitatea. exploat\u0103rii<\/a><\/noindex> poten\u021bial<\/a><\/noindex> r\u0103mase.<\/a><\/noindex> vulnerabilit\u0103\u021bi<\/a><\/noindex> pentru a respecta restric\u021biile \u00abuser namespaces\u00bb. Printre noile caracteristici ale Bubblewrap 0.4 se num\u0103r\u0103 \u0219i posibilitatea de a fi compilat cu biblioteca C musl \u00een loc de glibc \u0219i suportul pentru salvarea informa\u021biilor despre spa\u021biile de nume \u00eentr-un fi\u0219ier cu statistici \u00een format JSON.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea Bubblewrap 0.4.0, un strat pentru crearea mediilor izolate | ProHoster","description":"Este disponibil un nou versiune a uneltelor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}