{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"Projekt Landrun rozv\u00edja neprivilegovan\u00fd syst\u00e9m izol\u00e1cie aplik\u00e1ci\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Projekt Landrun za\u010dal v\u00fdvoj nov\u00e9ho syst\u00e9mu pre izolovan\u00e9 sp\u00fa\u0161\u0165anie jednotliv\u00fdch aplik\u00e1ci\u00ed. Na izol\u00e1ciu je pou\u017eit\u00fd LSM modul jadra Linux Landlock, ktor\u00fd umo\u017e\u0148uje ob\u00eds\u0165 vykon\u00e1vanie privilegovan\u00fdch oper\u00e1ci\u00ed pri vytv\u00e1ran\u00ed sandboxov\u00e9ho prostredia. Vo svojej podstate je Landrun podobn\u00fd utilite Firejail, ale vyzna\u010duje sa jednoduch\u0161ou realiz\u00e1ciou, \u013eahkos\u0165ou a mo\u017enos\u0165ou fungova\u0165 pod be\u017en\u00fdm nepriviligovan\u00fdm pou\u017e\u00edvate\u013eom bez nutnosti poskytn\u00fa\u0165 flag suid. K\u00f3d projektu je nap\u00edsan\u00fd v Go a je distribuovan\u00fd pod licenciou GPLv2. <\/p>\n

Mechanizmus Landlock umo\u017e\u0148uje nepriviligovan\u00fdm programom obmedzi\u0165 pou\u017e\u00edvanie objektov jadra Linux, ako s\u00fa hierarchie s\u00faborov, sie\u0165ov\u00e9 sockety a ioctl. Na rozdiel od n\u00e1zvov\u00fdch priestorov a filtrovania syst\u00e9mov\u00fdch volan\u00ed je izolovan\u00e9 prostredie vytv\u00e1ran\u00e9 jadrom Linux vo forme \u010fal\u0161ej vrstvy nad existuj\u00facimi syst\u00e9mov\u00fdmi mechanizmami spr\u00e1vy pr\u00edstupu. Na interakciu s podsyst\u00e9mom Landlock sa v n\u00e1stroji landrun pou\u017e\u00edva kni\u017enica go-landlock od v\u00fdvoj\u00e1rov LandLock. <\/p>\n

Landrun umo\u017e\u0148uje zn\u00ed\u017ei\u0165 riziko kompromit\u00e1cie hlavn\u00e9ho syst\u00e9mu pri sp\u00fa\u0161\u0165an\u00ed ned\u00f4veryhodn\u00fdch alebo potenci\u00e1lne zranite\u013en\u00fdch programov. Medzi jeho funkcie patr\u00ed podpora selekt\u00edvneho obmedzenia pr\u00edstupu na \u00farovni jednotliv\u00fdch adres\u00e1rov, viazanie opr\u00e1vnen\u00ed na cesty k s\u00faborom (povolenie alebo z\u00e1kaz \u010d\u00edtania, p\u00edsania a sp\u00fa\u0161\u0165ania) a kontrola nad iniciovan\u00edm a prij\u00edman\u00edm TCP spojen\u00ed. <\/p>\n

Napr\u00edklad pomocou Landrun je mo\u017en\u00e9 zabr\u00e1ni\u0165 sp\u00fa\u0161\u0165aniu spustite\u013en\u00fdch s\u00faborov, povoli\u0165 z\u00e1pis len do konkr\u00e9tneho podprie\u010dinka s \u00fadajmi, zak\u00e1za\u0165 vytv\u00e1ranie odpo\u010d\u00favac\u00edch soketov na prij\u00edmanie sie\u0165ov\u00fdch pripojen\u00ed a povoli\u0165 odosielanie sie\u0165ov\u00fdch po\u017eiadaviek len na ur\u010den\u00e9 TCP porty. V najjednoduch\u0161om pr\u00edpade na zak\u00e1zanie z\u00e1pisu, sp\u00fa\u0161\u0165ania a sie\u0165ov\u00fdch mo\u017enost\u00ed sa program m\u00f4\u017ee vykona\u0165 pr\u00edkazom \"landrun --ro \/\", a na izol\u00e1ciu nginx sa m\u00f4\u017ee pou\u017ei\u0165: landrun --rox \/usr\/bin --ro \/lib,\/lib64,\/var\/www --rwx \/var\/log --bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n

V pl\u00e1noch do bud\u00facnosti sa spom\u00edna roz\u0161\u00edren\u00e9 riadenie pr\u00edstupu k s\u00faborov\u00e9mu syst\u00e9mu, podpora UDP a spr\u00e1va zdrojov procesov. Na obmedzenie pr\u00edstupu na \u00farovni s\u00faborov\u00e9ho syst\u00e9mu je potrebn\u00e9 minim\u00e1lne jadro Linux 5.13, a na sie\u0165ov\u00e9 obmedzenia -- 6.8. <\/p>\n

Je mo\u017en\u00e9 poznamena\u0165, \u017ee do k\u00f3dovej z\u00e1kladne Firejail u\u017e boli prijat\u00e9 zmeny, ktor\u00e9 umo\u017e\u0148uj\u00fa pou\u017e\u00edvanie pod syst\u00e9mu jadra Landlock na izol\u00e1ciu bez suid-bitu a zvy\u0161ovania privilegi\u00ed, av\u0161ak verzia s touto podporou e\u0161te nebola zverejnen\u00e1.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d LSM-\u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f sandbox-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u043e \u0441\u0432\u043e\u0438\u043c \u0437\u0430\u0434\u0430\u0447\u0430\u043c Landrun \u0431\u043b\u0438\u0437\u043e\u043a \u043a \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Firejail, \u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439, \u043b\u0435\u0433\u043a\u043e\u0432\u0435\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434 \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid. \u041a\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122970","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Projekt Landrun rozv\u00edja neprivilegovansk\u00fd syst\u00e9m izol\u00e1cie aplik\u00e1ci\u00ed | ProHoster","description":"Projekt Landrun za\u010dal v\u00fdvoj novej syst\u00e9mu pre izolovan\u00e9 vykon\u00e1vanie jednotliv\u00fdch aplik\u00e1ci\u00ed.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041f\u0440\u043e\u0435\u043a\u0442 Landrun \u043d\u0430\u0447\u0430\u043b \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T08:22:49+00:00","article:modified_time":"2025-03-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122970","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:34:09","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:34:09","updated":"2026-01-23 11:34:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/122970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=122970"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/122970\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=122970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=122970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=122970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}