{"id":106390,"date":"2023-01-19T00:48:17","date_gmt":"2023-01-18T22:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72"},"modified":"2023-01-19T00:48:17","modified_gmt":"2023-01-18T22:48:17","slug":"vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","title":{"rendered":"Vydanie syst\u00e9mu izol\u00e1cie aplik\u00e1ci\u00ed Firejail 0.9.72","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bol release projektu Firejail 0.9.72, ktor\u00fd vyv\u00edja syst\u00e9m na izolovan\u00e9 sp\u00fa\u0161\u0165anie grafick\u00fdch, konzolov\u00fdch a serverov\u00fdch aplik\u00e1ci\u00ed, \u010do umo\u017e\u0148uje minimalizova\u0165 riziko kompromit\u00e1cie hlavn\u00e9ho syst\u00e9mu pri sp\u00fa\u0161\u0165an\u00ed ned\u00f4veryhodn\u00fdch alebo potenci\u00e1lne zranite\u013en\u00fdch programov. Program je nap\u00edsan\u00fd v jazyku C, distribuuje sa pod licenciou GPLv2 a m\u00f4\u017ee fungova\u0165 v akomko\u013evek distrib\u00fate Linuxu s jadrom star\u0161\u00edm ako 3.0. Hotov\u00e9 bal\u00ed\u010dky s Firejail s\u00fa pripraven\u00e9 vo form\u00e1toch deb (Debian, Ubuntu) a rpm (CentOS, Fedora). <\/p>\n

Na izol\u00e1ciu vo Firejail sa pou\u017e\u00edvaj\u00fa menn\u00e9 priestory (namespaces), AppArmor a filtr\u00e1cia syst\u00e9mov\u00fdch volan\u00ed (seccomp-bpf) v Linuxe. Po spusten\u00ed program a v\u0161etky jej dc\u00e9rske procesy pou\u017e\u00edvaj\u00fa oddelen\u00e9 poh\u013eady na zdroje jadra, ako s\u00fa sie\u0165ov\u00fd z\u00e1sobn\u00edk, tabu\u013eka procesov a body pripojenia. Z\u00e1visl\u00e9 aplik\u00e1cie m\u00f4\u017eu by\u0165 zl\u00fa\u010den\u00e9 do jedn\u00e9ho spolo\u010dn\u00e9ho sandboxu. Ak si \u017eel\u00e1te, Firejail sa d\u00e1 pou\u017ei\u0165 aj na sp\u00fa\u0161\u0165anie kontajnerov Docker, LXC a OpenVZ. <\/p>\n

Na rozdiel od prostriedkov kontajnerovej izol\u00e1cie je firejail mimoriadne jednoduch\u00fd na konfigur\u00e1ciu a nevy\u017eaduje pr\u00edpravu syst\u00e9mov\u00e9ho obrazu \u2014 zlo\u017eenie kontajnera sa vytv\u00e1ra na po\u010dkanie na z\u00e1klade obsahu aktu\u00e1lneho FS a odstra\u0148uje sa po dokon\u010den\u00ed pr\u00e1ce aplik\u00e1cie. Poskytuj\u00fa sa flexibiln\u00e9 prostriedky na definovanie pravidiel pr\u00edstupu k s\u00faborov\u00e9mu syst\u00e9mu, je mo\u017en\u00e9 ur\u010di\u0165, ktor\u00e9 s\u00fabory a adres\u00e1re s\u00fa povolen\u00e9 alebo zak\u00e1zan\u00e9, pripoji\u0165 pre d\u00e1ta do\u010dasn\u00e9 FS (tmpfs), obmedzi\u0165 pr\u00edstup k s\u00faborom alebo adres\u00e1rom iba na \u010d\u00edtanie, kombinova\u0165 adres\u00e1re pomocou bind-mount a overlayfs. <\/p>\n

Pre ve\u013ek\u00e9 mno\u017estvo popul\u00e1rnych aplik\u00e1ci\u00ed, vr\u00e1tane Firefoxu, Chromu, VLC a Transmission, s\u00fa pripraven\u00e9 hotov\u00e9 profily izol\u00e1cie syst\u00e9mov\u00fdch volan\u00ed. Na z\u00edskanie opr\u00e1vnen\u00ed potrebn\u00fdch na nastavenie izolovan\u00e9ho prostredia sa vykon\u00e1vac\u00ed s\u00fabor firejail in\u0161taluje s pr\u00edznakom SUID root (po inicializ\u00e1cii sa opr\u00e1vnenia resetuj\u00fa). Na spustenie programu v izola\u010dnom re\u017eime sta\u010d\u00ed uvies\u0165 n\u00e1zov aplik\u00e1cie ako argument n\u00e1stroja firejail, napr\u00edklad \u201efirejail firefox\u201c alebo \u201esudo firejail \/etc\/init.d\/nginx start\u201c. <\/p>\n

V novom vydan\u00ed: <\/p>\n