{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu do t\u00eb kufizoj\u00eb aksesin n\u00eb user namespace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Canonical njoftoi p\u00ebr ndryshimet n\u00eb Ubuntu 23.10 q\u00eb kufizojn\u00eb qasjen e p\u00ebrdoruesve n\u00eb hap\u00ebsirat e emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespace), \u00e7ka do t\u00eb rris\u00eb sigurin\u00eb e sistemeve q\u00eb p\u00ebrdorin izolimin me kontejner\u00eb nga cenueshm\u00ebrit\u00eb, p\u00ebr t\u00eb cilat \u00ebsht\u00eb e nevojshme t\u00eb b\u00ebhen manipulime me user namespace. Sipas Google, 44% e eksploit\u00ebve q\u00eb marrin pjes\u00eb n\u00eb programin p\u00ebr shp\u00ebrblime p\u00ebr identifikimin e cenueshm\u00ebrive n\u00eb b\u00ebrtham\u00ebn Linux, k\u00ebrkojn\u00eb mund\u00ebsin\u00eb e krijimit t\u00eb hap\u00ebsirave t\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve. <\/p>\n
N\u00eb vend t\u00eb bllokimit t\u00eb plot\u00eb t\u00eb aksesit n\u00eb user namespace n\u00eb Ubuntu, \u00ebsht\u00eb aplikuar nj\u00eb skem\u00eb hibride, e cila l\u00eb disa programa t\u00eb krijojn\u00eb user namespace n\u00eb prani t\u00eb nj\u00eb profili AppArmor me rregullin \"allow userns create\" ose duke pasur t\u00eb drejt\u00ebn CAP_SYS_ADMIN. P\u00ebr shembull, p\u00ebr Chrome \u00ebsht\u00eb krijuar nj\u00eb profil n\u00eb \/etc\/apparmor.d\/opt.google.chrome.chrome, i cili mund t\u00eb p\u00ebrdoret si shembull p\u00ebr t\u00eb hapur aksesin n\u00eb user namespace p\u00ebr programe t\u00eb tjera. <\/p>\n
N\u00eb versionin e ardhsh\u00ebm t\u00eb Ubuntu 23.10, kufizimi i qasjes n\u00eb user namespace planifikohet t\u00eb ofrohet si nj\u00eb opsion, q\u00eb nuk \u00ebsht\u00eb aktivizuar si standard. Brenda disa jav\u00ebsh pas lan\u00e7imit t\u00eb Ubuntu 23.10, zhvilluesit do t\u00eb mbledhin informacione n\u00eb lidhje me ndikimin negativ t\u00eb mundsh\u00ebm t\u00eb \u00e7aktivizimit t\u00eb qasjes n\u00eb user namespace n\u00eb pun\u00ebn e pakove dhe do t\u00eb p\u00ebrgatisin profila p\u00ebrkat\u00ebse AppArmor. Pastaj, n\u00eb nj\u00eb nga update-t e korrigjimit t\u00eb paket\u00ebs me b\u00ebrtham\u00ebn (Stable Release Updates), kufizimi do t\u00eb aktivizohet si standard. <\/p>\n
P\u00ebr aktivizimin e parakohsh\u00ebm t\u00eb kufizimit, mund t\u00eb p\u00ebrdoren komandat: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n