{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"Projekti Landrun po zhvillon nj\u00eb sistem izolimi t\u00eb aplikacioneve pa privilegje.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Projekti Landrun ka filluar zhvillimin e nj\u00eb sistemi t\u00eb ri p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve t\u00eb ve\u00e7anta. P\u00ebr izolimin p\u00ebrdoret moduli LSM i b\u00ebrtham\u00ebs Linux Landlock, q\u00eb lejon krijimin e nj\u00eb mjedisi sandbox pa kryer operacione me privilegje. N\u00eb detyrat e tij, Landrun \u00ebsht\u00eb i ngjash\u00ebm me utilitarin Firejail, por ndryshon p\u00ebr p\u00ebr realizimin m\u00eb t\u00eb thjesht\u00eb, leht\u00ebsin\u00eb e p\u00ebrdorimit dhe mund\u00ebsin\u00eb e pun\u00ebs n\u00ebn nj\u00eb p\u00ebrdorues jo t\u00eb privilegjuar pa u shkarkuar me flagun suid. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Go dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn GPLv2. <\/p>\n
Mekanizmi Landlock lejon programeve t\u00eb pa privilegjuara t\u00eb kufizojn\u00eb p\u00ebrdorimin e objekteve t\u00eb b\u00ebrtham\u00ebs Linux, si hierarkit\u00eb e skedar\u00ebve, soket\u00ebt rrjetor\u00eb dhe ioctl. Ndryshe nga hap\u00ebsirat emri dhe filtrimi i thirrjeve t\u00eb sistemit, ambienti i izoluar formohet nga b\u00ebrthama Linux n\u00eb form\u00ebn e nj\u00eb shtrese shtes\u00eb mbi mekanizmat ekzistues t\u00eb menaxhimit t\u00eb aksesit. P\u00ebr nd\u00ebrveprimin me n\u00ebn-sistemin Landlock, utilitari landrun p\u00ebrdor bibliotek\u00ebn go-landlock nga zhvilluesit e LandLock. <\/p>\n
Landrun ndihmon n\u00eb uljen e rrezikut t\u00eb komprometimit t\u00eb sistemit kryesor gjat\u00eb ekzekutimit t\u00eb programeve q\u00eb nuk g\u00ebzojn\u00eb besimin ose q\u00eb mund t\u00eb jen\u00eb t\u00eb ndjeshme. Among its features, it supports selective access limitations at the level of individual directories, binding permissions to file paths (granting or denying read, write and execute permissions), and controlling the initiation and receipt of TCP connections. <\/p>\n
P\u00ebr shembull, me ndihm\u00ebn e Landrun-it, procesit mund t'i ndalohet ekzekutimi i skedar\u00ebve, mund t\u00eb lejohet shkrimi vet\u00ebm n\u00eb nj\u00eb n\u00ebnfolder t\u00eb ve\u00e7ant\u00eb me t\u00eb dh\u00ebna, mund t\u00eb ndalohet krijimi i soketeve p\u00ebr t\u00eb pranuar lidhjet n\u00eb rrjet dhe mund t\u00eb lejohet d\u00ebrgimi i k\u00ebrkesave t\u00eb rrjetit vet\u00ebm n\u00eb portet TCP t\u00eb caktuara. N\u00eb rastin m\u00eb t\u00eb thjesht\u00eb, p\u00ebr t\u00eb ndaluar shkrimin, ekzekutimin dhe mund\u00ebsit\u00eb e rrjetit, programin mund ta ekzekutoni me komand\u00ebn \u00ablandrun \u2014ro \/\u00bb, dhe p\u00ebr izolimin e nginx-it mund t\u00eb p\u00ebrdorni: landrun \u2014rox \/usr\/bin \u2014ro \/lib,\/lib64,\/var\/www \u2014rwx \/var\/log \u2014bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n
N\u00eb planet p\u00ebr t\u00eb ardhmen p\u00ebrmendet menaxhimi i avancuar i aksesit n\u00eb sistemin e skedar\u00ebve, mb\u00ebshtetje p\u00ebr UDP dhe menaxhimi i burimeve t\u00eb proceseve. P\u00ebr t\u00eb kufizuar aksesin n\u00eb nivelin e sistemit t\u00eb skedar\u00ebve k\u00ebrkohet t\u00eb pakt\u00ebn b\u00ebrthama Linux 5.13, dhe p\u00ebr kufizimet rrjet\u00ebsore \u2014 6.8. <\/p>\n
S\u00eb fundi, mund t\u00eb p\u00ebrmendet se ndryshimet p\u00ebr sistemin e baz\u00ebs s\u00eb kodit Firejail tashm\u00eb jan\u00eb pranuar, duke lejuar p\u00ebrdorimin e n\u00ebn-sistemit t\u00eb b\u00ebrtham\u00ebs Landlock p\u00ebr izolimin pa bitin suid dhe rritjen e privilegjeve, por nj\u00eb version me k\u00ebt\u00eb mb\u00ebshtetje ende nuk \u00ebsht\u00eb publikuar. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"