ืคืืืขืจืืืฉืืื 0.9.78 ืืื ืืจืืืกืืขืืขืื ืืขืืืืจื. ืขืก ืื ืืืืืงืื ื ืกืืกืืขื ืคืืจ ืืคืืขืืื ืืขืจืืข ืืืืกืคืืจืื ื ืคืื ืืจืืคืืฉืข, ืงืื ืกืื, ืืื ืกืขืจืืืขืจ ืืคืืืงืืฆืืขืก, ืืื ืืืืืืจื ืืื ืืขื ืจืืืืงืข ืคืื โโืงืืืคืจืืืืืืจื ืืขื ืืืืกื ืกืืกืืขื ืืืขื ืืขื ืืืืคื ื ืืฉื-ืคืืจืืจืืืืข ืืืขืจ ืคืืืขื ืฆืืขื ืฉืืืืืข ืคืจืืืจืืืขื. ืื ืคืจืืืจืื ืืื ืืขืฉืจืืื ืืื C, ืคืืจืฉืคืจืืื ืืื ืืขืจ ืืขืจ GPLv2 ืืืฆืขื ืฅ, ืืื ืืืืคื ืืืืฃ ืืขืืขืจ ืคืืจืฉืคืจืืืืื ื. Linux ืืื ืึท ืงืขืจื ืขื ืขืืืขืจ ืืื 3.0. ืืจืืืืข ืคึผืึทืงืึทืืืฉืึทื ืืื Firejail ืืืขืจื ืฆืืืขืืจืืื ืืื deb ืคึฟืึธืจืืึทืื (Debian, Ubuntu) ืืื ืจืคึผื (CentOS, ืคืขืืึธืจืึท).
ืคืืืขืจืืืฉืืื ื ืืฆื ื ืขืื-ืกืคึผืืืกืื, ืึทืคึผืึทืจืืึธืจ, ืืื ืกืืกืืขื ืจืืฃ ืคึฟืืืืขืจืื ื (ืกืขืงืึธืืคึผ-ืืคึผืฃ) ืคึฟืึทืจ ืืืืึธืืึทืฆืืข. Linuxืึทืืึธื ืืึธื ืืฉื, ื ืืฆื ืึท ืคึผืจืึธืืจืึทื ืืื ืึทืืข ืืืจืข ืงืื ื ืคึผืจืึธืฆืขืกื ืืึทืืื ืืขืจืข ืจืขืคึผืจืขืืขื ืืึทืฆืืขืก ืคืื ืงืขืจื ืขื ืจืขืกืืจืกื, ืึทืืึท ืืื ืื ื ืขืฅ ืกืืขืง, ืคึผืจืึธืฆืขืก ืืึทืืขืืข, ืืื ืืึธืื ื ืคืื ืงืื. ืืื ืืขืจ-ืึธืคึผืืขื ืืืงืข ืึทืคึผืืึทืงืืืฉืึทื ื ืงืขื ืขื ืืืื ืงืึทืืืืื ื ืืื ืึท ืืืื ืืขืืืืื ืืึทืืืงืึทืกืื. ืคืืืขืจืืืฉืืื ืงืขื ืืืื ืืืื ืืขื ืืฆื ืฆื ืืืืคื ืืึธืงืขืจ, LXC, ืืื OpenVZ ืงืึทื ืืืื ืขืจื.
ืื ืืขืจืฉ ืืื ืงืื ืืขืื ืขืจ ืืืืืืืจืื ื ืืืฉืืจืื, ืืื ืคืืืขืจืืืฉืืื ืืืจ ืคืฉืื ืฆื ืงืื ืคืืืืจืืจื ืืื ืคืืจืืื ืื ื ืืฉื ืฆื ืฆืืืจืืืื ื ืกืืกืืขื ืืืืโืื ืืื ืืืื ืคืื ืขื ืงืื ืืขืื ืขืจ ืืืขืจื ืืขื ืขืจืืจื ืืืืคื ืคืืืฅ ืืืืืจื ืืืืฃ ืื ืืื ืืืื ืคืื ืขื ืืขืฆืืืื ืคืืื ืกืืกืืขื ืืื ืืืขืจื ืืืืกืืขืืขืงื ื ืืืืขื ืืืืก ืื ืืคืืืงืืฆืืข ืขื ืืืื ืืื. ืคืืขืงืกืืืืข ืคืืื ืกืืกืืขื ืฆืืืจืื ืจืืืก ืืืขืจื ืฆืืืขืฉืืขืื, ืืืืก ืขืจืืขืืืืื ืืืื ืฆื ืืขืคืื ืืจื ืืืขืืืข ืคืืืื ืืื ืืืจืขืงืืืจืืขืก ืืขื ืขื ืขืจืืืืื ืืืขืจ ืืขืืืืงื ื ืฆืืืจืื, ืืืื ืื ืฆืืืืืืืืืืืข ืคืืื ืกืืกืืขืืขื (tmpfs) ืคืืจ ืืืื, ืืืืจืขื ืขืฆื ืฆืืืจืื ืฆื ืคืืืื ืืืขืจ ืืืจืขืงืืืจืืขืก ืฆื ื ืืจ ืืืืขื ืขื, ืืื ืงืืืืื ืืจื ืืืจืขืงืืืจืืขืก ื ืืฆื ืืื ืืื ื-ืืืื ื ืืื ืืืืขืจืืืฃ.
ืคึฟืึทืจ ืึท ืืจืืืก ื ืืืขืจ ืคืื ืคืึธืืงืก ืึทืคึผืืึทืงืืืฉืึทื ื, ืึทืจืืึทื ืืขืจืขืื ื ืคืืจืขืคืึธืงืก, ืงืจืึธืืืืึทื, ืืืืง ืืื ืืจืึทื ืกืืืกืืข, ืคืึทืจืืืง ืกืืกืืขื ืจืืคื ืืคืืขืืื ืืขืจืืงืืื ืคึผืจืึธืืคืืืื ืืขื ืขื ืฆืืืขืืจืืื. ืฆื ืืึทืงืืืขื ืื ืคึผืจืืืืืืึทืืืฉืึทื ื ืืืืืง ืฆื ืฉืืขืื ืึท ืืึทืืืืึธืงืกืขื ืกืืืืืืข, ืื ืคืืจืขืืืฉืึทืื ืขืงืกืขืงืืืึทืืืข ืืื ืืื ืกืืึทืืืจื ืืื ืื SUID ืืืึธืจืฆื ืคืึธื (ืคึผืจืืืืืืึทืืืฉืึทื ืืขื ืขื ืืึทืฉืืขืืืง ื ืึธื ืื ืืืืึทืืืืืืฉืึทื). ืฆื ืืืืคื ืึท ืคึผืจืึธืืจืึทื ืืื ืืคืืขืืื ืืขืจืืงืืื ืืึธืืข, ืคืฉืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืึทืคึผืืึทืงืืืฉืึทื ื ืึธืืขื ืืื ืึทื ืึทืจืืืืขื ื ืฆื ืื ืคืืืจืืืฉืึทืื ื ืืฆื, ืืืฉื, "firejail firefox" ืึธืืขืจ "sudo firejail /etc/init.d/nginx start".
ืืื ืื ื ืืึทืข ืืขืืืื ื:
- ืื arg-max-count, arg-max-len, env-max-count, ืืื env-max-len ืึธืคึผืฆืืขืก ืืขื ืขื ืฆืืืขืืขืื ืืขืืืึธืจื ืฆื ืืขืจ firejail.config ืงืึธื ืคืืืืจืึทืฆืืข ืืขืงืข ืฆื ืขื ืืขืจื ืื ืืืืืื ืืืืฃ ืืขืจ ืฆืึธื ืืื ืืจืืืก ืคืื ืงืึธืืึทื ื-ืืื ืืข ืึธืคึผืฆืืขืก ืืื ืกืืืื ืืืขืจืืึทืืึทืื. ืืืจื ืคืขืืืงืืึทื, ืื ืฆืึธื ืคืื ืึทืจืืืืขื ืื ืืื ืืืืืืขื ืฆื 128, ืื ืฆืึธื ืคืื ืกืืืื ืืืขืจืืึทืืึทืื ืืื ืืืืืืขื ืฆื 256, ืืื ืื ืืจืืืก ืคืื ืืขืื ืึทืจืืืืขื ื ืืื PATH_MAX ืคึฟืื limits.h (ืืื Linux 40196) + 32.
- ืฆืืืขืืขืื ืื "--xephyr-extra-params" ืึธืคึผืฆืืข ืฆื ืกืคึผืขืฆืืคึฟืืฆืืจื ื ืึธื ืึธืคึผืฆืืขืก ืฆื Xephyr (ืืขื ืืฆื ืฆื ืฉืึทืคึฟื X11 ืืึทืืืงืึทืกืื ืกืืืืืช ืืื ืืืืขืจ ืืืืืขื ืขื X ืกืขืจืืืขืจ ืืืึธืก ืืืืคึฟื ืืื ืึท ืคึฟืขื ืฆืืขืจ) ืืืืฃ ืืขืจ ืงืึธืืึทื ื ืืื ืืข ืึธื ืฆื ืืึธืืืคึฟืืฆืืจื firejail.config.
- ืื bwrap (bubblewrap) ื ืืฆืืขืืงืืื ืืื ืกืืืืืจื ืืื ืืขืจ ืืึทืืืงืึทืกืื ืกืืืื ืืื ืืขืืืึธืจื ืขืจืืขืฆื ืืื ืืขืจ fbwrap ืืืืืืืขืจ, ืืืึธืก ืืึธื ืืฉื ืคึผืจืึธืืจืึทืืขื ืึธื ืกืึทื ืืืึธืงืกืื ื ืฆื ืกืึธืืืืขื ืคึผืจืึธืืืขืืขื ืืื Firefox, Thunderbird, ืืื GIMP ืืึธื ืืฉืื ื ืฆืืืื glycin 2.0.0 ืืืึธืก ืืืขืจื ืืขืจืืคื ืคึฟืื gdk-pixbuf2 ื ืืฆื ืืืง bwrap. ืื "--allow-bwrap" ืึธืคึผืฆืืข ืืื ืฆืืืขืืขืื ืืขืืืึธืจื ืฆื ืงืึธืคึผืืจื bwrap ืึทื ืฉืืึธื ืื ืืืืืืืขืจ.
- ืืขืจืืืึทื ืืืงื ืกืืกืืขื ืจืืฃ ืืึทืืขืืขืก ืคึฟืึทืจ seccomp. ื ืฒึทืข ืกืืกืืขื ืจืืคื, ืืื epoll_pwait2 ืืื futex_wait, ืืขื ืขื ืฆืืืขืืขืื ืืขืืืึธืจื.
- ืื "--disable-globalcfg" ืืืื ืืคืฆืืข ืืื ืืจืืคืืขื ืืืขื ืืขืืืืจื, ืืื ืฉืืืฆืข ืคืืจ overlayfs ("--overlay") ืืื IDS (Intrusion Detection System, "--ids") ืืึธืืืก ืืื ืืคืืขืฉืืขืื ืืขืืืืจื.
- ืฆืืืขืืขืื ืืืืึธืืึทืฆืืข ืคึผืจืึธืืคืืืื ืคึฟืึทืจ ืื ne ืืขืงืกื ืจืขืืึทืงืืึธืจ (ืืขืงืกื ืจืขืืึทืงืืึธืจ), ืืจืืืืึทืืขื ื ืืืขืืขืจืขืจ, โโืืื OpenRA, quakespasm, gzdoom, lzdoom, ืืื uzdoom ืฉืคึผืื ืขื ืืืฉืื ืก.
- ืืขืจืืืึทื ืืืงืืข ืคึผืจืึธืคึฟืืื ืคึฟืึทืจ ืืึทื ืืขืจืืขืจื, ืืืืื, ืงืืืืขืืจืึทืืืขืจ, ืคึฟืฒึทืขืจืคึฟืึธืงืก, ืืึธืืึธื, ืืืืกืง, ืืืืฐืึทื-ืืจืึทืืืขืจ, ืืืื ืง, ืกืืื, ssh, ืืจืืืื ืืื ืืขืฉืงืึทื.
ืืงืืจ: opennet.ru
