{"id":34673,"date":"2019-10-31T21:59:45","date_gmt":"2019-10-31T18:59:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60\/"},"modified":"2019-10-31T21:59:45","modified_gmt":"2019-10-31T18:59:45","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","title":{"rendered":"L\u00ebshimi i sistemit t\u00eb izolimit t\u00eb aplikacioneve Firejail 0.9.60","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ishte n\u00eb drit\u00eb<\/a><\/noindex> l\u00ebshimi i projektit Firejail 0.9.60<\/a><\/noindex>, n\u00eb kuad\u00ebr t\u00eb s\u00eb cil\u00ebs po zhvillohet nj\u00eb sistem p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve grafike, konsol\u00eb dhe server\u00eb. P\u00ebrdorimi i Firejail lejon minimizimin e rrezikut t\u00eb kompromitimit t\u00eb sistemit kryesor gjat\u00eb ekzekutimit t\u00eb programeve t\u00eb paq\u00ebndrueshme ose potencialisht t\u00eb ndjeshme. Programi \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C, shp\u00ebrndahet<\/a><\/noindex> n\u00ebn licenc\u00ebn GPLv2 dhe mund t\u00eb punoj\u00eb n\u00eb \u00e7do shp\u00ebrndarje Linux me b\u00ebrtham\u00eb m\u00eb t\u00eb lart\u00ebn 3.0. Paketat e gatshme me Firejail jan\u00eb p\u00ebrgatitur<\/a><\/noindex> jan\u00eb n\u00eb formatet deb (Debian, Ubuntu) dhe rpm (CentOS, Fedora).<\/p>\n

P\u00ebr izolim n\u00eb Firejail p\u00ebrdoren<\/a><\/noindex> hap\u00ebsira em\u00ebrtimi (namespaces), AppArmor dhe filtrimi i thirrjeve t\u00eb sistemit (seccomp-bpf) n\u00eb Linux. Pasi t\u00eb fillohet programi dhe t\u00eb gjitha proceset e tij dyt\u00ebsore p\u00ebrdorin pamje t\u00eb ve\u00e7anta t\u00eb burimeve t\u00eb b\u00ebrtham\u00ebs, si\u00e7 jan\u00eb steka rrjeti, tabela e proceseve dhe pik\u00ebt e montimit. Aplikacione t\u00eb lidhura me nj\u00ebra-tjetr\u00ebn mund t\u00eb mblidhen n\u00eb nj\u00eb sandbox t\u00eb p\u00ebrbashk\u00ebt. N\u00ebse d\u00ebshirohet, Firejail mund t\u00eb p\u00ebrdoret edhe p\u00ebr ekzekutimin e kontejner\u00ebve Docker, LXC dhe OpenVZ. <\/p>\n

N\u00eb krahasim me mjetet e izolimit t\u00eb kontejner\u00ebve, firejail \u00ebsht\u00eb ekstremisht i thjesht\u00eb<\/a><\/noindex> n\u00eb konfigurimin e saj dhe nuk k\u00ebrkon p\u00ebrgatitjen e nj\u00eb imazhi sistemor \u2014 p\u00ebrb\u00ebrja e kontejnerit formohet n\u00eb fluksa mbi baz\u00ebn e p\u00ebrmbajtjes aktuale t\u00eb FS dhe hiqet pas p\u00ebrfundimit t\u00eb pun\u00ebs s\u00eb aplikacionit. Ofrohen mjete fleksibile p\u00ebr p\u00ebrcaktimin e rregullave t\u00eb aksesit n\u00eb sistemin e skedar\u00ebve, duke lejuar p\u00ebrcaktimin se cilave skedar\u00eb dhe drejtime u lejohet ose iu ndalohet qasja; mund t\u00eb lidhen p\u00ebr t\u00eb dh\u00ebnat sisteme t\u00eb p\u00ebrkohshme t\u00eb skedar\u00ebve (tmpfs), t\u00eb kufizohet qasja n\u00eb skedar\u00eb ose drejtime vet\u00ebm p\u00ebr lexim, t\u00eb kombinohen drejtime p\u00ebrmes bind-mount dhe overlayfs.<\/p>\n

P\u00ebr nj\u00eb num\u00ebr t\u00eb madh aplikacionesh t\u00eb njohura, duke p\u00ebrfshir\u00eb Firefox, Chromium, VLC dhe Transmission, jan\u00eb p\u00ebrgatitur profile<\/a><\/noindex> izolimin e thirrjeve sistemike. P\u00ebr t\u00eb ekzekutuar nj\u00eb program n\u00eb modin e izolimit, mjafton t\u00eb jepni emrin e aplikacionit si argument t\u00eb utilitarit firejail, p\u00ebr shembull, \u00abfirejail firefox\u00bb ose \u00absudo firejail \/etc\/init.d\/nginx start\u00bb. <\/p>\n

N\u00eb versionin e ri:<\/p>\n