{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu do t\u00eb kufizoj\u00eb qasjen n\u00eb user namespace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Canonical shpalli se ka b\u00ebr\u00eb ndryshime n\u00eb Ubuntu 23.10 q\u00eb kufizojn\u00eb aksesin e p\u00ebrdoruesve n\u00eb hap\u00ebsirat e identifikuesve t\u00eb p\u00ebrdoruesve (user namespace), duke rritur k\u00ebshtu sigurin\u00eb e sistemeve q\u00eb p\u00ebrdorin izolimin e konteiner\u00ebve, nga dob\u00ebsit\u00eb q\u00eb k\u00ebrkojn\u00eb manipulime me user namespace. Sipas Google, 44% e eksploit\u00ebve q\u00eb marrin pjes\u00eb n\u00eb programin p\u00ebr shp\u00ebrblime p\u00ebr identifikimin e dob\u00ebsive n\u00eb kernelin Linux k\u00ebrkojn\u00eb mund\u00ebsin\u00eb e krijimit t\u00eb hap\u00ebsirave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve. <\/p>\n
N\u00eb vend t\u00eb bllokimit t\u00eb plot\u00eb t\u00eb aksesit n\u00eb user namespace n\u00eb Ubuntu, \u00ebsht\u00eb aplikuar nj\u00eb skem\u00eb hibride, e cila lejon disa programe t\u00eb krijojn\u00eb user namespace n\u00ebse kan\u00eb nj\u00eb profil AppArmor me rregullin \u00aballow userns create\u00bb ose t\u00eb drejtat CAP_SYS_ADMIN. P\u00ebr shembull, p\u00ebr Chrome \u00ebsht\u00eb krijuar nj\u00eb profil n\u00eb \/etc\/apparmor.d\/opt.google.chrome.chrome, i cili mund t\u00eb p\u00ebrdoret si shembull p\u00ebr t\u00eb hapur aksesin n\u00eb user namespace p\u00ebr programe t\u00eb tjera. <\/p>\n
N\u00eb versionin e ardhsh\u00ebm t\u00eb Ubuntu 23.10, kufizimi i aksesit n\u00eb user namespace do t\u00eb ofrohet si nj\u00eb opsion, i cili nuk \u00ebsht\u00eb aktivizuar automatikisht. Gjat\u00eb disa jav\u00ebve pas lan\u00e7imit t\u00eb Ubuntu 23.10, zhvilluesit do t\u00eb mbledhin informacione p\u00ebr ndonj\u00eb ndikim negativ q\u00eb mund t\u00eb ket\u00eb \u00e7aktivizimi i aksesit n\u00eb user namespace n\u00eb funksionimin e paketave dhe do t\u00eb p\u00ebrgatisin profilin p\u00ebrkat\u00ebs t\u00eb AppArmor. M\u00eb pas, n\u00eb nj\u00eb nga p\u00ebrdit\u00ebsimet korrigjuese t\u00eb paket\u00ebs s\u00eb kernelit (Stable Release Updates), kufizimi do t\u00eb aktivizohet automatikisht. <\/p>\n
P\u00ebr aktivizimin e parakohsh\u00ebm t\u00eb kufizimit, mund t\u00eb p\u00ebrdoren komandat: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n