Kutyhilwe uSimon McVittie kutshanje echonge ukuba semngciphekweni (CVE-2021-21261) ukuba kuthintela ukubekwa bodwa kwendawo ethe qelele kwaye usebenze ikhowudi engenakuphikiswa kwinkqubo yommandla wokusingathwa kwiphakheji kunye nokusetyenziswa kolawulo Flatpak.
Ukuba sesichengeni ikhona kwinkonzo ye-D-Bus flatpak-portal (Iflethi yefayile ikwaziwa ngegama layo lenkonzo iD-Bus org.freedesktop.portal.Flatpak), ebonelela ngokusungulwa "kwamasango" asetyenziselwa ukuqokelela ukufikelela kwizibonelelo ezingaphandle kwesikhongozeli.
Malunga nesigwebo
Kwaye kukuba semngciphekweni okhankanyiweyo akunjalo, kuba kungenxa yokusebenza kwenkonzo "I-Flatpak-portal" ivumela usetyenziso lwebhokisi yesanti ukuba iqale eyabo inkqubo yomntwana kwindawo entsha yesanti, apho kusetyenziswa khona iisetingi ezifanayo okanye ezinamandla (umzekelo, ukuphatha umxholo ongathembekanga).
Ukuba sesichengeni kuyaxhatshazwa, kuba idlulisa imeko engqongileyo yenkqubo yokubiza kubalawuli abangabodwa ukusuka kwinkqubo yokubamba (umzekelo, ngokusebenzisa umyalelo «flatpak ukubaleka«). Isicelo esibi sinokuveza imeko-bume echaphazela ukwenziwa kweplppak kwaye isebenze nayiphi na ikhowudi kwicala lomamkeli.
Inkonzo yokuncedisa iflatpak-yeseshoni (i-intanethi ngubani ongenayo flatpak-spawn -ukuphila) yenzelwe ukubonelela ngezicelo eziphawuliweyo ngakumbi ukukwazi ukwenza ikhowudi engalawulekiyo kwinkqubo yokubamba, ke ayisiyongxaki yokuba ixhomekeke kwindalo esingqongileyo ebonelelweyo kuyo.
Ukunika ukufikelela kwi-org.freedesktop.Flatpak service ibonisa ukuba isicelo sithembekile kwaye sinokwenza ngokusemthethweni ikhowudi yokuchasana ngaphandle kwebhokisi yesanti. Umzekelo, i-GNOME Builder yophuhliso lwendalo edityanisiweyo iphawulwe njengokuthenjwa ngale ndlela.
Inkonzo ye-D-Bus ye-Flatpak portal ivumela usetyenziso kwibhokisi yesanti yePlppak ukuba isungule eyayo imisonto kwibhokisi yesanti entsha, nokuba inezicwangciso ezifanayo zokhuseleko njengomfowni okanye noseto lokhuseleko oluthintelayo.
Umzekelo woku, Kuyakhankanywa ukuba kwizikhangeli zewebhu ezipakishwe ngeFlatpak njenge IChromium, ukuqala imisonto eya kuthi iqhubekeke nomxholo wewebhu ongathembekanga kwaye inike loo misonto ibhokisi yesanti ethintelekileyo kunesikhangeli ngokwaso.
Kwiinguqulelo ezisemngciphekweni, i-Flatpak portal service igqitha izinto eziguquguqukayo ezichazwe ngulowo ufowunayo kwiinkqubo ezingezizo ezesandeki kwinkqubo yomamkeli, kwaye ngakumbi kumyalelo wokubaleka we-flatpak osetyenziselwa ukumilisela imeko entsha yesanti.
Isicelo seFlatpak esingalunganga okanye esonakalisiweyo sinokusetha iimeko eziguquguqukayo ezithembakeleyo ngumyalelo wokubaleka we-flatpak kwaye uzisebenzise ukwenza ikhowudi yokuchasana engekho kwi-sandbox.
Kufuneka ikhunjulwe ukuba uninzi lweplatpak yabaphuhlisi bakhubaza indlela yokuzahlula okanye banike ukufikelela okupheleleyo kulawulo lwasekhaya.
Umzekelo, i-GIMP, i-VSCodium, i-PyCharm, i-Octave, i-Inkscape, i-Audacity, kunye neephakeji ze-VLC ziza nemodi yokuzihlukanisa. Ukuba iipakeji ezinokufikelela kulawulo lwasekhaya zisesichengeni, ngaphandle kwethegi «sandbox»Kwinkcazo yephakheji, umhlaseli kufuneka aguqule ~ / .bashrc ifayile yokwenza ikhowudi yakhe.
Umcimbi owahlukileyo kukulawulwa kotshintsho lwephakeji kunye nokuthembela kubenzi beephakeji, abadla ngokungahambelani neprojekthi ephambili okanye ulwabiwo.
Solution
Kukhankanyiwe ukuba ingxaki yalungiswa kwiinguqulelo zeFlppak 1.10.0 kunye no-1.8.5, kodwa kamva utshintsho oluhlehleleyo lwavela kuhlaziyo olwabangela iingxaki zokudityaniswa kweenkqubo ngenkxaso ye-bubblewrap ebekwe neflegi yeseti.
Emva koko ukuhlengahlengiswa okukhankanyiweyo kwalungiswa kwinguqulelo 1.10.1 (ngelixa uhlaziyo lwesebe le-1.8.x lingekafumaneki).
Gqibela ukuba unomdla wokwazi okungakumbi ngayo Malunga nengxelo yokuba sesichengeni, unokujonga iinkcukacha Kule khonkco ilandelayo.