{"id":101071,"date":"2021-08-21T16:22:59","date_gmt":"2021-08-21T14:22:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bubblewrap-0-5-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2021-08-21T16:22:59","modified_gmt":"2021-08-21T14:22:59","slug":"vypusk-bubblewrap-0-5-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-bubblewrap-0-5-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"L\u00ebshimi i Bubblewrap 0.5.0, nj\u00eb shtres\u00eb p\u00ebr krijimin e mjediseve t\u00eb izoluara","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
I dispozitsh\u00ebm l\u00ebshimi i mjetit p\u00ebr organizimin e pun\u00ebs s\u00eb mjediseve t\u00eb izoluara Bubblewrap 0.5.0, zakonisht i p\u00ebrdorur p\u00ebr t\u00eb kufizuar aplikacione t\u00eb ve\u00e7anta t\u00eb p\u00ebrdoruesve pa privilegje. N\u00eb praktik\u00eb, Bubblewrap p\u00ebrdoret nga projekti Flatpak si nj\u00eb shtres\u00eb p\u00ebr izolimin e aplikacioneve t\u00eb nisura nga paketat. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn LGPLv2+. <\/p>\n
P\u00ebr izolimin p\u00ebrdoren teknologjit\u00eb tradicionale t\u00eb virtualizimit t\u00eb kontejner\u00ebve n\u00eb Linux, t\u00eb bazuara n\u00eb p\u00ebrdorimin e cgroups, hap\u00ebsirave t\u00eb emrave (namespaces), Seccomp dhe SELinux. P\u00ebr t\u00eb kryer operacione me privilegje p\u00ebr konfigurimin e kontejnerit, Bubblewrap ekzekutohet me t\u00eb drejta root (skedari ekzekutiv me shenj\u00ebn suid), duke i hequr m\u00eb pas privilegjet pas p\u00ebrfundimit t\u00eb inicializimit t\u00eb kontejnerit. <\/p>\n
Aktivimi i sistemit t\u00eb hap\u00ebsirave t\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespaces), q\u00eb lejojn\u00eb p\u00ebrdorimin n\u00eb kontejner\u00eb t\u00eb nj\u00eb seti t\u00eb ve\u00e7ant\u00eb identifikuesish, nuk k\u00ebrkohet p\u00ebr pun\u00eb, sepse nga e default nuk funksionon n\u00eb shum\u00eb shp\u00ebrndarje (Bubblewrap pozicionohet si nj\u00eb implementim i kufizuar i suid p\u00ebr nj\u00eb n\u00ebngrup t\u00eb mund\u00ebsive t\u00eb hap\u00ebsirave t\u00eb emrave t\u00eb identifikuesve \u2014 p\u00ebr t\u00eb p\u00ebrjashtuar t\u00eb gjith\u00eb identifikuesit e p\u00ebrdoruesve dhe proceseve nga ambienti, p\u00ebrve\u00e7 atij aktual, p\u00ebrdoren m\u00ebnyrat CLONE_NEWUSER dhe CLONE_NEWPID). P\u00ebr mbrojtje shtes\u00eb, programet e ekzekutuara n\u00ebn Bubblewrap fillojn\u00eb n\u00eb m\u00ebnyr\u00ebn PR_SET_NO_NEW_PRIVS, q\u00eb ndalon marrjen e privilegjeve t\u00eb reja, p\u00ebr shembull, n\u00eb rast se ka flamur setuid. <\/p>\n
Izolimi n\u00eb nivelin e sistemit t\u00eb dosjeve b\u00ebhet p\u00ebrmes krijimit t\u00eb default nj\u00eb hap\u00ebsire t\u00eb re em\u00ebrimi p\u00ebr pik\u00ebt e montimit (mount namespace), n\u00eb t\u00eb cilin me ndihm\u00ebn e tmpfs krijohet nj\u00eb ndarje bosh rr\u00ebnjore. N\u00eb k\u00ebt\u00eb ndarje mund t\u00eb lidhen ndarjet e FS-s\u00eb s\u00eb jashtme n\u00eb modin \"mount \u2014bind\" (p.sh., gjat\u00eb ekzekutimit me opsionin \"bwrap \u2014ro-bind \/usr \/usr\" ndarja \/usr kalon nga sistemi kryesor n\u00eb modin vet\u00ebm p\u00ebr lexim). Mund\u00ebsit\u00eb rrjet\u00ebsohen duke kufizuar qasjen n\u00eb nd\u00ebrfaqen loopback me izolimin e grak\u00ebs rrjet t\u00eb p\u00ebrmes flamujve CLONE_NEWNET dhe CLONE_NEWUTS. <\/p>\n
Dallimi kryesor nga projekti i ngjash\u00ebm Firejail, i cili gjithashtu p\u00ebrdor modelin e nisjes me setuid, \u00ebsht\u00eb se te Bubblewrap shtresa p\u00ebr krijimin e kontejner\u00ebve p\u00ebrfshin vet\u00ebm minimumin e nevojsh\u00ebm t\u00eb funksioneve, nd\u00ebrsa t\u00eb gjitha ve\u00e7orit\u00eb e avancuara t\u00eb nevojshme p\u00ebr nisjen e aplikacioneve grafike, nd\u00ebrveprimin me desktop-in dhe filtrimin e thirrjeve ndaj Pulseaudio jan\u00eb zhvendosur te Flatpak dhe ekzekutohen vet\u00ebm pasi privilegjet t\u00eb jen\u00eb hequr. Nd\u00ebrsa Firejail bashkon n\u00eb nj\u00eb skedar t\u00eb vet\u00ebm t\u00eb ekzekutuesh\u00ebm t\u00eb gjitha funksionet shoq\u00ebruese, gj\u00eb q\u00eb e b\u00ebn m\u00eb t\u00eb v\u00ebshtir\u00eb auditimin dhe ruajtjen e siguris\u00eb n\u00eb nivelin e duhur. <\/p>\n
N\u00eb numrin e ri ofrohen opsionet: \u00abchmod\u00bb p\u00ebr ndryshimin e t\u00eb drejtave t\u00eb aksesit, \u00abclearenv\u00bb p\u00ebr pastrimin e variablave t\u00eb mjedisit (p\u00ebrve\u00e7 PWD) dhe \u00abperms\u00bb p\u00ebr t\u00eb p\u00ebrcaktuar t\u00eb drejtat e aksesit q\u00eb aplikohen gjat\u00eb kryerjes s\u00eb operacioneve \u00abbind-data\u00bb, \u00abdir\u00bb, \u00abfile\u00bb, \u00abro-bind-data\u00bb dhe \u00abtmpfs\u00bb. Diagnostikimi i problemeve q\u00eb ndodhin gjat\u00eb d\u00ebshtimit t\u00eb montimit n\u00eb modin bind \u00ebsht\u00eb p\u00ebrmir\u00ebsuar. P\u00ebr zsh \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr plot\u00ebsimin e automatik t\u00eb komandave me shtypjen e tabulimit. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"