{"id":153282,"date":"2026-01-04T11:12:36","date_gmt":"2026-01-04T09:12:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78"},"modified":"2026-01-04T11:12:36","modified_gmt":"2026-01-04T09:12:36","slug":"reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78","title":{"rendered":"L\u00ebshimi i sistemit t\u00eb izolimit t\u00eb aplikacioneve Firejail 0.9.78","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar versioni i projektit Firejail 0.9.78, i cili zhvillon nj\u00eb sistem p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve grafike, konsol\u00eb dhe server. Kjo lejon minimizimin e rrezikut t\u00eb komprometimit t\u00eb sistemit kryesor kur ekzekutohen programe t\u00eb pasigurta ose potencialisht t\u00eb prekshme. Programi \u00ebsht\u00eb i shkruar n\u00eb gjuh\u00ebn C, shp\u00ebrndahet n\u00ebn licenc\u00ebn GPLv2 dhe mund t\u00eb funksionoj\u00eb n\u00eb \u00e7do shp\u00ebrndarje Linux me nj\u00eb b\u00ebrtham\u00eb m\u00eb t\u00eb re se 3.0. Paketat e gatshme me Firejail jan\u00eb p\u00ebrgatitur n\u00eb formate deb (Debian, Ubuntu) dhe rpm (CentOS, Fedora). <\/p>\n
P\u00ebr izolimin n\u00eb Firejail p\u00ebrdoren hap\u00ebsira emrash (namespaces), AppArmor dhe filtrimi i thirrjeve sistemike (seccomp-bpf) n\u00eb Linux. Pas nisjes, programi dhe t\u00eb gjith\u00eb proceset e tij t\u00eb bir\u00ebsuara p\u00ebrdorin pamje t\u00eb ve\u00e7anta t\u00eb burimeve t\u00eb b\u00ebrtham\u00ebs, si\u00e7 jan\u00eb steka rrjetit, tabela e proceseve dhe pik\u00ebt e montimit. Aplikacionet e lidhura mund t\u00eb grupohen n\u00eb nj\u00eb sandbox t\u00eb p\u00ebrbashk\u00ebt. N\u00ebse d\u00ebshirohet, Firejail mund t\u00eb p\u00ebrdoret gjithashtu p\u00ebr ekzekutimin e konteiner\u00ebve Docker, LXC dhe OpenVZ. <\/p>\n
Ndryshe nga mjetet e izolimit t\u00eb konteiner\u00ebve, firejail \u00ebsht\u00eb ekstremisht i thjesht\u00eb p\u00ebr t'u konfiguruar dhe nuk k\u00ebrkon p\u00ebrgatitjen e nj\u00eb imazhi sistemor \u2014 struktura e konteinerit formohet n\u00eb koh\u00eb reale mbi baz\u00ebn e p\u00ebrmbajtjes aktuale t\u00eb FS-s\u00eb dhe fshihet pas p\u00ebrfundimit t\u00eb aplikacionit. Ofron mjete fleksibile p\u00ebr caktimin e rregullave t\u00eb aksesit n\u00eb sistemin e skedar\u00ebve, duke lejuar t\u00eb p\u00ebrcaktoni se n\u00eb cilat skedar\u00eb dhe drejtime lejohet apo ndalohet aksesin, t\u00eb lidhni sistemet e skedar\u00ebve t\u00eb p\u00ebrkohshme (tmpfs), t\u00eb kufizoni aksesin n\u00eb skedar\u00eb ose drejtime vet\u00ebm n\u00eb lexim, dhe t\u00eb bashkoni drejtime p\u00ebrmes bind-mount dhe overlayfs. <\/p>\n
P\u00ebr nj\u00eb num\u00ebr t\u00eb madh aplikacionesh t\u00eb njohura, p\u00ebrfshir\u00eb Firefox, Chromium, VLC dhe Transmission, jan\u00eb p\u00ebrgatitur profile t\u00eb gatshme p\u00ebr izolimin e thirrjeve sistemore. P\u00ebr t\u00eb fituar privilegjet e nevojshme p\u00ebr konfigurimin e nj\u00eb mjedisi t\u00eb izoluar, skedari ekzekutiv firejail instalohet me flag SUID root (pas inizializimit, privilegjet hiqen). P\u00ebr t\u00eb ekzekutuar programin n\u00eb modalitetin e izolimit, mjafton t\u00eb jepni emrin e aplikacionit si argument t\u00eb utilitarit firejail, p\u00ebr shembull, \u00abfirejail firefox\u00bb ose \u00absudo firejail \/etc\/init.d\/nginx start\u00bb. <\/p>\n
N\u00eb l\u00ebshimin e ri: <\/p>\n
\n
N\u00eb skedarin e konfigurimit firejail.config jan\u00eb shtuar opsionet arg-max-count, arg-max-len, env-max-count dhe env-max-len p\u00ebr t\u00eb ndryshuar kufijt\u00eb e numrit dhe madh\u00ebsis\u00eb s\u00eb opsioneve t\u00eb komand\u00ebs dhe variablave t\u00eb mjedisit. N\u00eb m\u00ebnyr\u00eb t\u00eb parazgjedhur, numri i argumenteve \u00ebsht\u00eb i kufizuar n\u00eb 128, numri i variablave t\u00eb mjedisit 256, dhe madh\u00ebsia e secilit argument \u00ebsht\u00eb PATH_MAX nga limits.h (n\u00eb Linux 40196) + 32.\n
\u00cbsht\u00eb shtuar opsioni \u00ab--xephyr-extra-params\u00bb p\u00ebr t\u00eb caktuar opsione shtes\u00eb p\u00ebr Xephyr (p\u00ebrdoret p\u00ebr krijimin e ambienteve sandbox X11 me serverin e tij X, t\u00eb aktivizuar n\u00eb nj\u00eb dritare) n\u00eb komand\u00ebn pa ndryshuar firejail.config.\n
Utilitari i instaluar n\u00eb ambientin sandbox bwrap (bubblewrap) \u00ebsht\u00eb z\u00ebvend\u00ebsuar me nj\u00eb nd\u00ebrfaqe fbwrap, e cila aktivizon programet pa izolim p\u00ebr t\u00eb zgjidhur problemet me aktivizimin e Firefox, Thunderbird, GIMP p\u00ebr shkak t\u00eb thirrjes glycin 2.0.0 nga gdk-pixbuf2 duke p\u00ebrdorur bwrap. P\u00ebr t\u00eb kopjuar bwrap n\u00eb vend t\u00eb nd\u00ebrfaqes, \u00ebsht\u00eb shtuar opsioni \u00ab--allow-bwrap\u00bb.\n
Tabela e thirrjeve sistemore p\u00ebr seccomp \u00ebsht\u00eb p\u00ebrdit\u00ebsuar. Jan\u00eb shtuar thirrje t\u00eb reja sistemore, si epoll_pwait2 dhe futex_wait.\n
\u00cbsht\u00eb hequr opsioni i nd\u00ebrtimit \u00ab--disable-globalcfg\u00bb, \u00ebsht\u00eb ndalur mb\u00ebshtetje p\u00ebr overlayfs (\u00ab--overlay\u00bb) dhe modin IDS (Sistemi i Zbulimit t\u00eb Intruzionit, \u00ab--ids\u00bb).\n
Jan\u00eb shtuar profile t\u00eb izolimit p\u00ebr redaktorin e teksteve ne (redaktori i teksteve), shfletuesin Trivalent dhe motor\u00ebt e loj\u00ebrave OpenRA, quakespasm, gzdoom, lzdoom, uzdoom.\n