{"id":107033,"date":"2023-03-02T06:48:15","date_gmt":"2023-03-02T04:48:15","guid":{"rendered":"https:\/\/prohoster.info\/?p=107033"},"modified":"2023-03-03T15:16:36","modified_gmt":"2023-03-03T13:16:36","slug":"vypusk-bubblewrap-0-8-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/vypusk-bubblewrap-0-8-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"L\u00ebshimi i Bubblewrap 0.8, nj\u00eb shtres\u00eb p\u00ebr krijimin e ambienteve t\u00eb izoluar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Versioni e mjeteve p\u00ebr organizimin e pun\u00ebs n\u00eb mjedise t\u00eb izoluar Bubblewrap 0.8 \u00ebsht\u00eb n\u00eb dispozicion, e cila zakonisht p\u00ebrdoret p\u00ebr t\u00eb kufizuar aplikacione t\u00eb ve\u00e7anta n\u00eb p\u00ebrdorim nga p\u00ebrdorues jo t\u00eb privilegjuar. N\u00eb praktik\u00eb, Bubblewrap aplikohet nga projekti Flatpak si nj\u00eb shtres\u00eb p\u00ebr izolimin e aplikacioneve t\u00eb shkarkuara nga pakot. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn LGPLv2+. <\/p>\n
P\u00ebr izolim, p\u00ebrdoren teknologjit\u00eb tradicionale t\u00eb virtualizimit t\u00eb konteiner\u00ebve n\u00eb Linux, t\u00eb bazuara n\u00eb p\u00ebrdorimin e cgroups, hap\u00ebsirave t\u00eb emrave (namespaces), Seccomp dhe SELinux. P\u00ebr t\u00eb kryer operacione me privilegje p\u00ebr konfigurimin e konteinerit, Bubblewrap \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0454\u0442\u044c\u0441\u044f \u0437 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root (skedari ekzekutiv me flamurin suid) dhe m\u00eb pas e humb privilegjin pas p\u00ebrfundimit t\u00eb inicializimit t\u00eb konteinerit. <\/p>\n
Aktivizimi i sistemit t\u00eb hap\u00ebsirave t\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesit (user namespaces), i cili lejon p\u00ebrdorimin n\u00eb kontejner\u00eb t\u00eb nj\u00eb grupi t\u00eb ve\u00e7ant\u00eb identifikuesish, nuk k\u00ebrkon asnj\u00eb veprim, pasi n\u00eb shumic\u00ebn e distribucioneve, gjith\u00e7ka funksionon si nj\u00eb parazgjedhje (Bubblewrap pozicionohet si nj\u00eb implementim i kufizuar suid i nj\u00eb n\u00ebngrupi t\u00eb mund\u00ebsive t\u00eb hap\u00ebsirave t\u00eb emrave t\u00eb p\u00ebrdoruesve \u2014 p\u00ebr t\u00eb p\u00ebrjashtuar t\u00eb gjith\u00eb identifikuesit e p\u00ebrdoruesve dhe proceseve nga mjedisi, p\u00ebrve\u00e7 atij aktual, p\u00ebrdoren modet CLONE_NEWUSER dhe CLONE_NEWPID). P\u00ebr mbrojtje shtes\u00eb, programet q\u00eb ekzekutohen n\u00ebn Bubblewrap startohen n\u00eb modin PR_SET_NO_NEW_PRIVS, i cili ndalon marrjen e privilegjeve t\u00eb reja, p\u00ebr shembull, n\u00eb pranin\u00eb e flak\u00ebs setuid. <\/p>\n
Izolimi n\u00eb nivelin e sistemit t\u00eb skedave b\u00ebhet p\u00ebrmes krijimit t\u00eb nj\u00eb hap\u00ebsire emrash t\u00eb pikave t\u00eb montimit (mount namespace) t\u00eb re, n\u00eb t\u00eb cil\u00ebn krijohet nj\u00eb ndarje bosh e rr\u00ebnj\u00ebs me tmpfs. N\u00eb k\u00ebt\u00eb ndarje, sipas nevoj\u00ebs, ngjiten pjes\u00ebt e sistemit t\u00eb skedave t\u00eb jashtme n\u00eb modalitetin 'mount \u2014bind' (p\u00ebr shembull, kur ekzekutohet me opsionin 'bwrap \u2014ro-bind \/usr \/usr', pjesa \/usr kalon nga sistemi kryesor n\u00eb modalitetin vet\u00ebm p\u00ebr lexim). Mund\u00ebsit\u00eb rrjet\u00ebsohen duke kufizuar qasjen n\u00eb nd\u00ebrfaqen loopback me izolimin e pilos rrjet\u00ebzimi p\u00ebrmes flagjeve CLONE_NEWNET dhe CLONE_NEWUTS. <\/p>\n
Dallimi kryesor nga projekti i ngjash\u00ebm Firejail, i cili gjithashtu p\u00ebrdor modelin e p\u00ebrpunimit me setuid, \u00ebsht\u00eb se n\u00eb Bubblewrap, shtresa p\u00ebr krijimin e kontejner\u00ebve p\u00ebrfshin vet\u00ebm minimumin e nevojsh\u00ebm t\u00eb funksionaliteteve, nd\u00ebrsa t\u00eb gjitha funksionet e avancuara, t\u00eb nevojshme p\u00ebr ekzekutimin e aplikacioneve grafike, nd\u00ebrveprimin me desktopin dhe filtrimin e k\u00ebrkesave n\u00eb Pulseaudio, jan\u00eb transferuar n\u00eb an\u00ebn e Flatpak dhe ekzekutohen pas heqjes s\u00eb privilegjeve. Firejail, nga ana tjet\u00ebr, bashkon n\u00eb nj\u00eb skedar ekzekutiv t\u00eb gjitha funksionalitetet p\u00ebrkat\u00ebse, \u00e7ka e komplikon auditimin e tij dhe ruajtjen e siguris\u00eb n\u00eb nivelin e duhur. <\/p>\n