{"id":120438,"date":"2024-10-31T19:09:22","date_gmt":"2024-10-31T17:09:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2024-10-31T19:09:22","modified_gmt":"2024-10-31T17:09:22","slug":"vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"L\u00ebshimi i Bubblewrap 0.11, nj\u00eb shtres\u00eb p\u00ebr krijimin e mjediseve t\u00eb izoluara","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar nj\u00eb version i ri i mjetit p\u00ebr organizimin e pun\u00ebs n\u00eb mjedise t\u00eb izoluar Bubblewrap 0.11, i cili p\u00ebrdoret p\u00ebr t\u00eb kufizuar aplikacionet e p\u00ebrdoruesve pa privilegje. N\u00eb praktik\u00eb, Bubblewrap p\u00ebrdoret nga projekti Flatpak si nj\u00eb penges\u00eb p\u00ebr izolimin e aplikacioneve t\u00eb hapura nga paketat. P\u00ebr izolimin p\u00ebrdoren teknologjit\u00eb tradicionale t\u00eb virtualizimit t\u00eb konteiner\u00ebve p\u00ebr Linux, t\u00eb bazuara n\u00eb p\u00ebrdorimin e cgroups, hap\u00ebsirave t\u00eb emrave (namespaces), Seccomp dhe SELinux. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn LGPLv2+. <\/p>\n
Izolimi n\u00eb nivelin e sistemit t\u00eb dosjeve b\u00ebhet p\u00ebrmes krijimit t\u00eb default nj\u00eb hap\u00ebsire t\u00eb re em\u00ebrimi p\u00ebr pik\u00ebt e montimit (mount namespace), n\u00eb t\u00eb cilin me ndihm\u00ebn e tmpfs krijohet nj\u00eb ndarje bosh rr\u00ebnjore. N\u00eb k\u00ebt\u00eb ndarje mund t\u00eb lidhen ndarjet e FS-s\u00eb s\u00eb jashtme n\u00eb modin \"mount \u2014bind\" (p.sh., gjat\u00eb ekzekutimit me opsionin \"bwrap \u2014ro-bind \/usr \/usr\" ndarja \/usr kalon nga sistemi kryesor n\u00eb modin vet\u00ebm p\u00ebr lexim). Mund\u00ebsit\u00eb rrjet\u00ebsohen duke kufizuar qasjen n\u00eb nd\u00ebrfaqen loopback me izolimin e grak\u00ebs rrjet t\u00eb p\u00ebrmes flamujve CLONE_NEWNET dhe CLONE_NEWUTS. <\/p>\n
P\u00ebr t\u00eb p\u00ebrjashtuar t\u00eb gjitha identifikimet e panevojshme t\u00eb p\u00ebrdoruesve dhe proceseve nga ambienti i izoluar q\u00eb krijohet, mund t\u00eb p\u00ebrdoren modet CLONE_NEWUSER (user namespace) dhe CLONE_NEWPID (PID namespace), dhe p\u00ebr t\u00eb ndaluar marrjen e privilegjeve t\u00eb reja, p\u00ebrdoret moda PR_SET_NO_NEW_PRIVS. N\u00eb sistemet me «user namespace», Bubblewrap mund t\u00eb ekzekutohet nga p\u00ebrdoruesi i zakonsh\u00ebm, nd\u00ebrsa n\u00eb sistemet pa «user namespace» mund t\u00eb p\u00ebrdoret me flamurin suid root p\u00ebr t\u00eb kryer inicializimin e nevojsh\u00ebm t\u00eb ambientit t\u00eb izoluar. <\/p>\n
N\u00eb versionin e ri: <\/p>\n
\n
\u00ebsht\u00eb ofruar mund\u00ebsia p\u00ebr t\u00eb krijuar pika montimi ku p\u00ebrdoret sistemi i skedar\u00ebve me nj\u00eb shtres\u00eb OverlayFS, i cili bashkon disa pjes\u00eb t\u00eb sistemeve t\u00eb tjera t\u00eb skedar\u00ebve. P\u00ebr t\u00eb menaxhuar p\u00ebrdorimin e OverlayFS jan\u00eb propozuar opsione t\u00eb reja n\u00eb komand\u00ebn e linj\u00ebs «—overlay», «—tmp-overlay», «—ro-overlay» dhe «—overlay-src».\n
\u00ebsht\u00eb shtuar opsioni «—level-prefix» p\u00ebr t\u00eb futur n\u00eb daljen diagnostike nivelin e prioritetit n\u00eb stilin syslog, q\u00eb lejon p\u00ebrdorimin e utiliteteve p\u00ebr p\u00ebrpunimin e daljes si «logger» dhe «systemd-cat».\n
\u00cbsht\u00eb nd\u00ebrprer\u00eb mb\u00ebshtetja p\u00ebr sistemin e nd\u00ebrtimit Autotools. Tani k\u00ebrkohet mjet i nd\u00ebrtimit Meson p\u00ebr nd\u00ebrtim. <\/ul>\n