Muva nje kukhishwe inguqulo entsha yeFlatpak 1.12 lapho kwenziwe khona ezinye izinguquko nokuthuthuka, okuthuthukiswe kuzo iSteam, ukulungiswa kwamaphutha kanye nokuxhaswa kwezicelo ze-TUI.
Kulabo abangajwayelene neFlatpak, kufanele wazi ukuthi lokhu kwenza ukuthi abathuthukisi bezinhlelo bakwazi ukwenza lula ukusatshalaliswa kwezinhlelo zabo ezingafakwanga ezinqolobaneni zokusabalalisa ezijwayelekile ngokulungisa isitsha sendawo yonke ngaphandle kokwenza imihlangano ehlukene yokusatshalaliswa ngakunye.
Okwabasebenzisi abaqaphela ukuphepha, I-Flatpak ivumela uhlelo lokusebenza olungalungile ukuthi lusebenze esitsheni ngokunikeza ukufinyelela kuphela kwimisebenzi yenethiwekhi yomsebenzisi namafayela ahambisana nohlelo. Kubasebenzisi abanentshisekelo kumikhiqizo emisha, iFlatpak ibavumela ukuthi bafake izinhlobo zakamuva ezizinzile nezilingo zezinhlelo zokusebenza ngaphandle kwesidingo sokushintsha kwesistimu.
Ukwehlisa usayizi wephakeji, kufaka kuphela ukuncika okuqondene nohlelo, kanye nemitapo yolwazi eyisisekelo nemitapo yolwazi (i-GTK, Qt, GNOME, kanye nemitapo yolwazi ye-KDE, njll.) Yakhelwe njengezindawo ezijwayelekayo zesikhathi sokusebenza.
LUmehluko omkhulu phakathi kweFlatpak ne-Snap ukuthi i-Snap isebenzisa izinto ezisemqoka zohlelo lwemvelol nokuhlukaniswa ngokuya ngokuhlunga izingcingo zesistimu, ngenkathi i-Flatpak idala isitsha esihlukile kusuka ohlelweni futhi isebenza ngamasethi amakhulu wesikhathi sokusebenza, ukuhlinzeka hhayi ngamaphakeji njengokuncika, kepha okujwayelekile. Izindawo zesistimu (ngokwesibonelo, yonke imitapo yolwazi edingekayo ukusebenzisa izinhlelo ze-GNOME noma ze-KDE).
Ngokungeziwe endaweni ejwayelekile yohlelo (isikhathi sokusebenza) efakwe endaweni yokugcina ekhethekile, ukuncika okungeziwe (iphakheji) okudingekayo ukuze uhlelo lokusebenza lusebenze kunikezwa. Ngamafuphi, isikhathi sokusebenza nephakeji lakha inani leziqukathi, noma ngabe isikhathi sokusebenza sifakwa ngokwahlukana futhi sijoyina iziqukathi eziningi ngasikhathi sinye, kususwe isidingo sokuphinda amafayili wohlelo oluvamile eziqukathi.
Izici ezintsha eziyinhloko zeFlatpak 1.12
Kule nguqulo entsha ukuthuthukiswa okuthuthukisiwe kwama-sandboxes afakiwe kuqokonyisiwe isetshenziswe kwiphakethe le-flatpak neklayenti yensizakalo yokulethwa komdlalo uSteam. Kumabhokisi we-sanboxes ahlanganisiwe, kuvunyelwe ukudala ama-hierarchies ahlukile we-/ usr kanye / nezikhombisi zohlelo lokusebenza, uSteam alusebenzisayo ukwenza imidlalo esitsheni esihlukile ngesigaba sayo / se-usr, esihlukaniswe nemvelo neklayenti leSteam.
Futhi, konke izimo zephakeji ezine-ID yesicelo efanayo yabelana ngemikhombandlela / tmp kanye ne- $ XDG_RUNTIME_DIR futhi ngokuzikhethela, usebenzisa ifulegi le- "–allow = per-app-dev-shm", ungavumela ukusetshenziswa kwesiqondisi / i-dev / shm esabiwe.
Futhi kule nguqulo entsha ukusekelwa okuthuthukisiwe kwezinhlelo zokusebenza zombhalo womsebenzisi (TUI) kugqanyisiwe njenge-gdb, kanye nokuqaliswa okusheshayo komyalo we- "ostree prune" nakho kufakiwe kusakhiwo sokwakha-isibuyekezo-repo, esenzelwe ukusebenza ngezinqolobane zemodi yefayela.
Ngakolunye uhlangothi kushiwo lokho ubungozi be-CVE-2021-41133 bulungisiwe ekusetshenzisweni kwendlela yokungena, okuhlobene nokungavinjelwa kwamakholi wesistimu entsha ahlobene nokwahlukanisa okwandayo emithethweni ye-seccomp. Ukuba sengozini kuvumele uhlelo lokusebenza ukuthi lwenze i-sandbox efakwe esidlekeni ukudlula izindlela zokuqinisekisa ze-'phothali 'ezisetshenziselwa ukunikeza ukufinyelela kuzinsizakusebenza ezingaphandle kwesiqukathi.
Ngenxa yalokho, umhlaseli angadlula indlela yokuhlukaniswa kwe-sandbox ukwenza amakholi wesistimu ahlobene nentaba futhi uthole ukufinyelela okugcwele kokuqukethwe endaweni yokusingathwa. Ukuba sengozini kungaxhashazwa kuphela kumaphakeji anikeza izinhlelo ukufinyelela ngqo kumasokhethi we-AF_UNIX, njengalawo asetshenziswa yiWayland, iPipewire, ne-pipewire-pulse. Ukuba sengozini akuzange kulungiswe ngokuphelele enguqulweni 1.12.0, ngakho-ke ukubuyekeza i-1.12.1 kukhishwe ngokulandela okushisayo.
Okokugcina uma unesifiso sokwazi okwengeziwe ngakho mayelana nale nguqulo entsha, ungabheka imininingwane Kulesi sixhumanisi esilandelayo.