{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu begr\u00e4nsar \u00e5tkomsten till anv\u00e4ndarnamnrymden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Canonical har meddelat att det g\u00f6rs \u00e4ndringar i Ubuntu 23.10 som begr\u00e4nsar anv\u00e4ndarnas \u00e5tkomst till anv\u00e4ndarnamnens utrymmen (user namespace), vilket kommer att \u00f6ka s\u00e4kerheten f\u00f6r system som anv\u00e4nder containisolering, mot s\u00e5rbarheter som kr\u00e4ver manipulation av anv\u00e4ndarnamnens utrymmen. Enligt Google kr\u00e4ver 44% av de exploiteringar som deltar i programmet f\u00f6r att utdela bel\u00f6ningar f\u00f6r att uppt\u00e4cka s\u00e5rbarheter i Linux-k\u00e4rnan m\u00f6jligheten att skapa anv\u00e4ndarnamnens utrymmen. <\/p>\n

\u0412\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0439 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a user namespace \u0432 Ubuntu \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0430 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430, \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c user namespace \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043f\u0440\u043e\u0444\u0438\u043b\u044f AppArmor \u0441 \u043f\u0440\u0430\u0432\u0438\u043b\u043e\u043c «allow userns create» \u0438\u043b\u0438 \u043f\u0440\u0430\u0432 CAP_SYS_ADMIN. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f Chrome \u0441\u043e\u0437\u0434\u0430\u043d \u043f\u0440\u043e\u0444\u0438\u043b\u044c \/etc\/apparmor.d\/opt.google.chrome.chrome, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0434\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a user namespace \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. <\/p>\n

I den kommande versionen av Ubuntu 23.10 planeras begr\u00e4nsningen av \u00e5tkomst till anv\u00e4ndarnamnens utrymmen att erbjudas som ett alternativ som inte \u00e4r aktiverat som standard. Under n\u00e5gra veckor efter releasen av Ubuntu 23.10 kommer utvecklarna att samla in data om eventuell negativ p\u00e5verkan av att st\u00e4nga av \u00e5tkomst till anv\u00e4ndarnamnens utrymmen p\u00e5 hur paketen fungerar och f\u00f6rbereda motsvarande AppArmor-profiler. D\u00e4refter kommer begr\u00e4nsningen att aktiveras som standard i en av de korrigerande uppdateringarna av k\u00e4rnpaketet (Stable Release Updates). <\/p>\n

F\u00f6r att aktivt aktivera begr\u00e4nsningen kan f\u00f6ljande kommandon anv\u00e4ndas: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n

Och f\u00f6r att st\u00e4nga av den: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e, \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 user namespace. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, 44% \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110711","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ubuntu kommer att begr\u00e4nsa \u00e5tkomsten till anv\u00e4ndarnamnens utrymmen | ProHoster","description":"Canonical har meddelat att det g\u00f6rs \u00e4ndringar i Ubuntu 23.10 som begr\u00e4nsar anv\u00e4ndarnas \u00e5tkomst till anv\u00e4ndarnamnens utrymmen (user namespace), vilket kommer att \u00f6ka s\u00e4kerheten f\u00f6r systemen.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Ubuntu \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a user namespace | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Canonical \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0438 \u0432 Ubuntu 23.10 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (user namespace), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-10T01:10:26+00:00","article:modified_time":"2023-10-10T01:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=110711"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110711\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=110711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=110711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=110711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}