{"id":53324,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2020-02-18T14:01:13","modified_gmt":"2020-02-18T11:01:13","slug":"vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"L\u00ebshimi i Bubblewrap 0.4.0, midis p\u00ebr krijimin e mjediseve t\u00eb izoluara","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I disponuesh\u00ebm<\/a><\/noindex> numri i ri i mjetit Bubblewrap 0.4.0<\/a><\/noindex>, i destinuar p\u00ebr organizimin e pun\u00ebs s\u00eb mjediseve t\u00eb izoluara n\u00eb Linux dhe q\u00eb funksionon n\u00eb nivelin e aplikacioneve t\u00eb p\u00ebrdoruesve t\u00eb paburgosur. N\u00eb praktik\u00eb, Bubblewrap p\u00ebrdoret nga projekti Flatpak si nj\u00eb nd\u00ebrfaqe p\u00ebr izolimin e aplikacioneve q\u00eb ekzekutohen nga paketat. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet<\/a><\/noindex> n\u00ebn licenc\u00ebn LGPLv2+.<\/p>\n

P\u00ebr izolimin p\u00ebrdoren teknologjit\u00eb tradicionale t\u00eb virtualizimit t\u00eb kontejner\u00ebve n\u00eb Linux, t\u00eb bazuara n\u00eb p\u00ebrdorimin e cgroups, hap\u00ebsirave t\u00eb emrave (namespaces), Seccomp dhe SELinux. P\u00ebr t\u00eb kryer operacione me privilegje p\u00ebr konfigurimin e kontejnerit, Bubblewrap ekzekutohet me t\u00eb drejta root (skedari ekzekutiv me shenj\u00ebn suid), duke i hequr m\u00eb pas privilegjet pas p\u00ebrfundimit t\u00eb inicializimit t\u00eb kontejnerit. <\/p>\n

Aktivizimi n\u00eb sistemin e hap\u00ebsirave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespaces), q\u00eb lejojn\u00eb p\u00ebrdorimin n\u00eb kontejner\u00eb t\u00eb nj\u00eb grupi t\u00eb ve\u00e7ant\u00eb identifikuesish, nuk k\u00ebrkon ndonj\u00eb veprim, pasi p\u00ebr default nuk punon n\u00eb shum\u00eb distribuera (Bubblewrap pozicionohet si nj\u00eb implementim i kufizuar i mund\u00ebsive t\u00eb hap\u00ebsirave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve \u2014 p\u00ebr t\u00eb p\u00ebrjashtuar t\u00eb gjith\u00eb identifikuesit e p\u00ebrdoruesve dhe proceseve nga ambienti, p\u00ebrve\u00e7 atij aktual, p\u00ebrdoren modet CLONE_NEWUSER dhe CLONE_NEWPID). P\u00ebr mbrojtje t\u00eb shtuar, ekzekutimet n\u00ebn
\n Bubblewrap ekzekutohen n\u00eb modin PR_SET_NO_NEW_PRIVS, q\u00eb ndalon marrjen e privilegjeve t\u00eb reja, p\u00ebr shembull, kur ka nj\u00eb flamur setuid. <\/p>\n

Izolimi n\u00eb nivelin e sistemit t\u00eb dosjeve b\u00ebhet p\u00ebrmes krijimit t\u00eb default nj\u00eb hap\u00ebsire t\u00eb re em\u00ebrimi p\u00ebr pik\u00ebt e montimit (mount namespace), n\u00eb t\u00eb cilin me ndihm\u00ebn e tmpfs krijohet nj\u00eb ndarje bosh rr\u00ebnjore. N\u00eb k\u00ebt\u00eb ndarje mund t\u00eb lidhen ndarjet e FS-s\u00eb s\u00eb jashtme n\u00eb modin \"mount \u2014bind\" (p.sh., gjat\u00eb ekzekutimit me opsionin \"bwrap \u2014ro-bind \/usr \/usr\" ndarja \/usr kalon nga sistemi kryesor n\u00eb modin vet\u00ebm p\u00ebr lexim). Mund\u00ebsit\u00eb rrjet\u00ebsohen duke kufizuar qasjen n\u00eb nd\u00ebrfaqen loopback me izolimin e grak\u00ebs rrjet t\u00eb p\u00ebrmes flamujve CLONE_NEWNET dhe CLONE_NEWUTS.<\/p>\n

Dallimi kryesor nga projekti i ngjash\u00ebm Firejail<\/a><\/noindex>, i cili gjithashtu p\u00ebrdor modelin e nisjes me aplikimin e setuid, \u00ebsht\u00eb se n\u00eb Bubblewrap, shtresa p\u00ebr krijimin e kontejner\u00ebve p\u00ebrfshin vet\u00ebm minimumin e nevojsh\u00ebm t\u00eb aft\u00ebsive, nd\u00ebrsa t\u00eb gjitha funksionet e avancuara, t\u00eb nevojshme p\u00ebr t\u00eb nisur aplikacione grafike, p\u00ebr t\u00eb nd\u00ebrvepruar me desktopin dhe p\u00ebr t\u00eb filtruar k\u00ebrkesat n\u00eb Pulseaudio, jan\u00eb t\u00eb transferuara n\u00eb an\u00ebn e Flatpak dhe ekzekutohen pas heqjes s\u00eb privilegjeve. Firejail, nga ana tjet\u00ebr, bashkon n\u00eb nj\u00eb skedar ekzekutiv t\u00eb gjitha funksionet p\u00ebrkat\u00ebse, gj\u00eb q\u00eb e komplikon auditimin e tij dhe ruajtjen e siguris\u00eb. n\u00eb nivelin e duhur<\/a><\/noindex>.<\/p>\n

\u00c7lirimi i ri \u00ebsht\u00eb i r\u00ebnd\u00ebsish\u00ebm p\u00ebr implementimin e mb\u00ebshtetjes p\u00ebr lidhen e hap\u00ebsirave ekzistuese t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespaces) dhe proceseve (pid namespaces). P\u00ebr menaxhimin e lidhjes s\u00eb hap\u00ebsirave t\u00eb emrave, jan\u00eb shtuar flamujt \"\u2014userns\", \"\u2014userns2\" dhe \"\u2014pidns\".
\nKjo mund\u00ebsi nuk funksionon n\u00eb modalitetin setuid dhe k\u00ebrkon aplikimin e nj\u00eb modaliteti t\u00eb ve\u00e7ant\u00eb, i cili mund t\u00eb funksionoj\u00eb pa marr\u00eb t\u00eb drejtat root, por k\u00ebrkon aktivizim
\nhap\u00ebsirat e p\u00ebrdoruesve n\u00eb sistem (nga default jan\u00eb t\u00eb \u00e7aktivizuara n\u00eb Debian dhe RHEL\/CentOS) dhe nuk p\u00ebrjashton mund\u00ebsin\u00eb shfryt\u00ebzimin<\/a><\/noindex> e mundshme<\/a><\/noindex> e mbetur<\/a><\/noindex> dob\u00ebsive<\/a><\/noindex> p\u00ebr t'i paraprir\u00eb kufizimeve \"user namespaces\". Nga mund\u00ebsit\u00eb e reja, edhe me versionin 0.4 t\u00eb Bubblewrap \u00ebsht\u00eb e mundur nd\u00ebrtimi me bibliotek\u00ebn C musl n\u00eb vend t\u00eb glibc dhe mb\u00ebshtetje p\u00ebr ruajtjen e informacionit p\u00ebr hap\u00ebsirat e emrave n\u00eb nj\u00eb sked\u00eb statistikash n\u00eb formatin JSON.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Bubblewrap 0.4.0, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0432 Linux \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 Bubblewrap \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Flatpak \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 LGPLv2+. \u0414\u043b\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u043b\u044f Linux \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53324","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47L\u00ebshimi i Bubblewrap 0.4.0, shtresa p\u00ebr krijimin e ambjenteve t\u00eb izoluara | ProHoster","description":"\u00cbsht\u00eb n\u00eb dispozicion nj\u00eb l\u00ebshim i ri i mjetit","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bubblewrap 0.4.0, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-bubblewrap-0-4-0-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53324","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:56:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53324"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53324\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}