N\u00eb mjetin p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve Firejail u identifikua nj\u00eb dob\u00ebsi (CVE-2022-31214), e cila lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb sistemin kryesor. Nj\u00eb eksploit i punuesh\u00ebm \u00ebsht\u00eb n\u00eb dispozicion publik, e verifikuar n\u00eb versionet aktuale t\u00eb openSUSE, Debian, Arch, Gentoo dhe Fedora me mjetin firejail t\u00eb instaluar. Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionin firejail 0.9.70. Si nj\u00eb m\u00ebnyr\u00eb alternative mbrojtjeje, mund t\u00eb vendosni n\u00eb konfigurimin (\\\/etc\\\/firejail\\\/firejail.config) parametrat \"join no\" dhe \"force-nonewprivs yes.\" <\/p>\n
Firejail p\u00ebrdor mekanizmin e hap\u00ebsirave t\u00eb emrave (namespaces), AppArmor dhe filtrimin e thirrjeve sistemore (seccomp-bpf) n\u00eb Linux p\u00ebr izolim, por p\u00ebr t\u00eb konfiguruar ekzekutimin e izoluar k\u00ebrkon privilegje t\u00eb rritura, t\u00eb cilat i fiton p\u00ebrmes lidhjes me mjetin e flamurit suid root ose nga ekzekutimi me sudo. Dob\u00ebsia \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb logjik\u00ebn e funksionit \"--join=\", i cili \u00ebsht\u00eb i destinuar p\u00ebr t'u lidhur me nj\u00eb ambient t\u00eb izoluar q\u00eb tashm\u00eb \u00ebsht\u00eb n\u00eb pun\u00eb (analog me komand\u00ebn login p\u00ebr ambientin sandbox) duke p\u00ebrcaktuar ambientin sipas identifikuesit t\u00eb procesit q\u00eb po punon. N\u00eb faz\u00ebn para se t\u00eb hiqen privilegjet, firejail p\u00ebrcakton privilegjet e procesit t\u00eb specifikuar dhe i aplikon ato n\u00eb nj\u00eb proces t\u00eb ri, t\u00eb lidhur me ambientin p\u00ebrmes opsionit \"--join.\" <\/p>\n
Para se t\u00eb lidhesh, b\u00ebhet nj\u00eb verifikim p\u00ebr t\u00eb par\u00eb n\u00ebse procesi i specifikuar \u00ebsht\u00eb duke u ekzekutuar n\u00eb ambientin firejail. Kjo verifikim vler\u00ebson pranin\u00eb e skedarit \\\/run\\\/firejail\\\/mnt\\\/join. P\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb, sulmuesi mund t\u00eb simuloj\u00eb nj\u00eb ambient t\u00eb pavarur firejail duke p\u00ebrdorur hap\u00ebsir\u00ebn e pikave t\u00eb montimit (mount namespace), pastaj t\u00eb lidhet me t\u00eb p\u00ebrmes opsionit \"--join.\" N\u00ebse n\u00eb konfigurim nuk \u00ebsht\u00eb aktivizuar modaliteti i ndalimit t\u00eb fitimit t\u00eb privilegjeve t\u00eb tjera n\u00eb proceset e reja (prctl NO_NEW_PRIVS), firejail do t\u00eb lidh\u00eb p\u00ebrdoruesin n\u00eb ambientin e simuluar dhe do t\u00eb p\u00ebrpiqet t\u00eb aplikoj\u00eb parametrat e hap\u00ebsir\u00ebs s\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespace) t\u00eb procesit init (PID 1). <\/p>\n
P\u00ebrfundimisht, procesi i lidhur p\u00ebrmes «firejail —join» do t\u00eb ndodhet n\u00eb hap\u00ebsir\u00ebn e identifikimit t\u00eb p\u00ebrdoruesve p\u00ebr p\u00ebrdoruesin, me privilegje t\u00eb pandryshuara, por n\u00eb nj\u00eb hap\u00ebsir\u00eb tjet\u00ebr pikash montimi, e cila kontrollohet plot\u00ebsisht nga sulmuesi. P\u00ebr m\u00eb tep\u00ebr, sulmuesi mund t\u00eb ekzekutoj\u00eb programe setuid-root n\u00eb hap\u00ebsir\u00ebn e tij t\u00eb pikave t\u00eb montimit, gj\u00eb q\u00eb lejon, p\u00ebr shembull, t\u00eb ndryshoj\u00eb konfigurimin e \"\/etc\/sudoers\" ose parametrat PAM n\u00eb hierarkin\u00eb e tij t\u00eb skedar\u00ebve dhe t\u00eb fitoj\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar komanda me t\u00eb drejtat root p\u00ebrmes mjeteve sudo ose su. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"