{"id":54610,"date":"2019-12-30T00:00:00","date_gmt":"2019-12-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62"},"modified":"2020-02-18T14:02:39","modified_gmt":"2020-02-18T11:02:39","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","title":{"rendered":"Rivendosja e sistemit t\u00eb izolimit t\u00eb aplikacioneve Firejail 0.9.62","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pas gjasht\u00eb muajve zhvillimi \u00ebsht\u00eb n\u00eb dispozicion<\/a><\/noindex> l\u00ebshimi i projektit Firejail 0.9.62<\/a><\/noindex>, n\u00eb kuad\u00ebr t\u00eb s\u00eb cil\u00ebs po zhvillohet nj\u00eb sistem p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve grafike, konsol\u00eb dhe server\u00eb. P\u00ebrdorimi i Firejail lejon minimizimin e rrezikut t\u00eb kompromitimit t\u00eb sistemit kryesor gjat\u00eb ekzekutimit t\u00eb programeve t\u00eb paq\u00ebndrueshme ose potencialisht t\u00eb ndjeshme. Programi \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C, shp\u00ebrndahet<\/a><\/noindex> n\u00ebn licenc\u00ebn GPLv2 dhe mund t\u00eb punoj\u00eb n\u00eb \u00e7do shp\u00ebrndarje Linux me b\u00ebrtham\u00eb m\u00eb t\u00eb lart\u00ebn 3.0. Paketat e gatshme me Firejail jan\u00eb p\u00ebrgatitur<\/a><\/noindex> jan\u00eb n\u00eb formatet deb (Debian, Ubuntu) dhe rpm (CentOS, Fedora).<\/p>\n

P\u00ebr izolim n\u00eb Firejail p\u00ebrdoren<\/a><\/noindex> hap\u00ebsirat emrash (namespaces), AppArmor dhe filtrimi i thirrjeve sistemore (seccomp-bpf) n\u00eb Linux. Pasi t\u00eb startohet, programi dhe t\u00eb gjith\u00eb proceset e tij dyt\u00ebsore p\u00ebrdorin pamje t\u00eb ve\u00e7anta t\u00eb burimeve t\u00eb b\u00ebrtham\u00ebs, t\u00eb tilla si grumbulli i rrjetit, tabela e proceseve dhe pikat e montimit. Aplikacionet e varura nj\u00ebra nga tjetra mund t\u00eb bashkohen n\u00eb nj\u00eb sandbox t\u00eb p\u00ebrbashk\u00ebt. N\u00ebse d\u00ebshirohet, Firejail mund t\u00eb p\u00ebrdoret gjithashtu p\u00ebr t\u00eb nisur kontejner\u00ebt Docker, LXC dhe OpenVZ. <\/p>\n

N\u00eb krahasim me mjetet e izolimit t\u00eb kontejner\u00ebve, firejail \u00ebsht\u00eb ekstremisht i thjesht\u00eb<\/a><\/noindex> n\u00eb konfigurimin dhe nuk k\u00ebrkon p\u00ebrgatitjen e imazhit t\u00eb sistemit \u2014 p\u00ebrb\u00ebrja e kontejnerit formohet n\u00eb fluturim n\u00eb baz\u00eb t\u00eb p\u00ebrmbajtjes aktuale t\u00eb FS dhe fshihet pas p\u00ebrfundimit t\u00eb pun\u00ebs s\u00eb aplikacionit. Ofron mjete fleksibile p\u00ebr p\u00ebrcaktimin e rregullave t\u00eb qasjes n\u00eb sistemin e skedareve, mund t\u00eb p\u00ebrcaktohet n\u00eb cilat skedar\u00eb dhe direktor\u00eb \u00ebsht\u00eb lejuar ose ndaluar qasja, t\u00eb bashk\u00ebngjiten p\u00ebr t\u00eb dh\u00ebnat sisteme t\u00eb p\u00ebrkohshme (tmpfs), t\u00eb kufizohet qasja n\u00eb skedar\u00eb ose direktor\u00eb vet\u00ebm n\u00eb m\u00ebnyr\u00eb t\u00eb leximit, t\u00eb kombinohen direktor\u00eb p\u00ebrmes bind-mount dhe overlayfs.<\/p>\n

P\u00ebr nj\u00eb num\u00ebr t\u00eb madh aplikacionesh t\u00eb njohura, duke p\u00ebrfshir\u00eb Firefox, Chromium, VLC dhe Transmission, jan\u00eb p\u00ebrgatitur profile<\/a><\/noindex> izolimi i thirrjeve sistemore. P\u00ebr t\u00eb marr\u00eb privilegjet e nevojshme p\u00ebr t\u00eb konfiguruar nj\u00eb mjedis t\u00eb izoluar, skedari ekzekutiv firejail vendoset me flamurin SUID root (pas inicializimit privilegjet hiqen). P\u00ebr t\u00eb ekzekutuar nj\u00eb program n\u00eb modalitetin e izolimit, mjafton t\u00eb tregoni emrin e aplikacionit si nj\u00eb argument t\u00eb utilitarit firejail, p\u00ebr shembull, \u00abfirejail firefox\u00bb ose \u00absudo firejail \/etc\/init.d\/nginx start\u00bb. <\/p>\n

N\u00eb versionin e ri:<\/p>\n