O le Fedora 40 faʻasalalauga e faʻaalia ai le faʻatagaina o le tuʻufaʻatasia mo auaunaga faʻapitoa e mafai ona faʻaogaina, faʻapea foʻi ma auaunaga faʻapitoa e pei ole PostgreSQL, Apache httpd, Nginx, ma MariaDB. O loʻo faʻamoemoeina o le suiga o le a matua faʻateleina ai le saogalemu o le tufatufaina atu i le faʻaogaina o le faʻaogaina ma o le a mafai ai ona poloka faʻafitauli le iloa i auaunaga faʻapitoa. O le talosaga e leʻi iloiloina e le FESCo (Fedora Engineering Steering Committee), lea e nafa ma le vaega faʻapitoa o le atinaʻeina o le tufatufaina o Fedora. E mafai fo'i ona te'ena se talosaga a'o faia le iloiloga a le nu'u.
Fautuaina tulaga e mafai ai:
- PrivateTmp=ioe - tuʻuina atu faʻamaumauga eseese ma faila le tumau.
- ProtectSystem=yes/full/strict — fa'apipi'i le faila faila i le faitau-na'o le faiga (i le "tumu" mode - / etc /, i le faiga fa'apitoa - faila faila uma vagana ai /dev/, /proc/ ma /sys/).
- ProtectHome=ioe—e tete'e le avanoa i fa'atonuga ile fale.
- PrivateDevices=ioe - tu'u avanoa na'o /dev/null, /dev/zero ma /dev/random
- ProtectKernelTunables=ioe - faitau-na'o avanoa i /proc/sys/, /sys/, /proc/acpi, /proc/fs, /proc/irq, etc.
- ProtectKernelModules=ioe - fa'asa le utaina o fatu fatu.
- ProtectKernelLogs=ioe - fa'asa le avanoa i le pa'u ma ogalaau fatu.
- ProtectControlGroups=ioe - faitau na'o le avanoa i /sys/fs/cgroup/
- NoNewPrivileges=ioe - fa'asa le si'itia o avanoa e ala i fu'a setuid, setgid ma agava'a.
- PrivateNetwork=ioe - tu'u i se isi igoa avanoa ole fa'aputuga feso'ota'iga.
- ProtectClock=ioe—fa'asa le suia o le taimi.
- ProtectHostname=ioe - faʻasa le suia o le igoa talimalo.
- ProtectProc=le vaaia - natia faiga a isi tagata ile /proc.
- Tagata fa'aoga= - sui tagata fa'aoga
E le gata i lea, e mafai ona e mafaufau e fa'agaoioia tulaga nei:
- CapabilityBoundingSet=
- DevicePolicy=tapunia
- KeyringMode=fa'atasi
- LokaPersonality=ioe
- MemoryDenyWriteExecute=ioe
- PrivateUsers=ioe
- RemoveIPC=ioe
- RestrictAddressFamilies=
- RestrictNamespaces=ioe
- RestrictRealtime=ioe
- RestrictSUIDSGID=ioe
- SystemCallFilter=
- SystemCallArchitectures=native
puna: opennet.ru