linux 运行可执行文件_如何在Linux上安全运行不受信任的可执行文件？

linux 运行可执行文件

In this day and age, it is not a bad idea to be leery of untrusted executable files, but is there a safe way to run one on your Linux system if you really need to do so? Today’s SuperUser Q&A post has some helpful advice in response to a worried reader’s query.

在当今时代，警惕不受信任的可执行文件并不是一个坏主意，但是如果您确实需要这样做，是否可以在Linux系统上运行一个安全的方法呢？ 今天的“超级用户问答”帖子提供了一些有用的建议，以回应读者担心的查询。

Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.

今天的“问答”环节由SuperUser提供，它是Stack Exchange的一个分支，该社区是由社区驱动的Q＆A网站分组。

问题 (The Question)

SuperUser reader Emanuele wants to know how to safely run an untrusted executable file on Linux:

超级用户阅读器Emanuele想要了解如何在Linux上安全地运行不受信任的可执行文件：

I have downloaded an executable file compiled by a third party and I need to run it on my system (Ubuntu Linux 16.04, x64) with full access to HW resources such as the CPU and GPU (through the NVIDIA drivers).

我已经下载了由第三方编译的可执行文件，并且需要在我的系统(Ubuntu Linux 16.04，x64)上运行该文件，并且可以完全访问硬件资源，例如CPU和GPU(通过NVIDIA驱动程序)。

Suppose this executable file contains a virus or backdoor, how should I run it? Should I create a new user profile, run it, then delete the user profile?

假设此可执行文件包含病毒或后门，我应该如何运行它？ 我应该创建一个新的用户配置文件，运行它，然后删除该用户配置文件吗？

How do you safely run an untrusted executable file on Linux?

您如何在Linux上安全地运行不受信任的可执行文件？

答案 (The Answer)

SuperUser contributors Shiki and Emanuele have the answer for us. First up, Shiki:

超级用户贡献者Shiki和Emanuele为我们找到了答案。 首先，Shiki：

First and foremost, if it is a very high risk binary file, you would have to set up an isolated physical machine, run the binary file, then physically destroy the hard drive, the motherboard, and basically all the rest because in this day and age, even your robot vacuum can spread malware. And what if the program already infected your microwave through the computer’s speakers using high-frequency data transmitting?!

首先，如果它是一个非常高风险的二进制文件，则必须设置隔离的物理机，运行该二进制文件，然后物理破坏硬盘驱动器，主板以及基本上所有的其余部分，因为在这一天，年龄，甚至您的机器人吸尘器也可以传播恶意软件。 而且，如果程序已经使用高频数据传输通过计算机的扬声器感染了微波炉，该怎么办？

But let’s take off that tinfoil hat and jump back to reality for a bit.

但是，让我们摘下锡箔帽子，然后跳回现实。

No Virtualization – Quick to Use

没有虚拟化–使用快速

Firejail

火狱

I had to run a similar untrusted binary file just a few days ago and my search led to this very cool small program. It is already packaged for Ubuntu, very small, and has virtually no dependencies. You can install it on Ubuntu using: sudo apt-get install firejail

几天前，我不得不运行一个类似的不受信任的二进制文件，我的搜索导致了这个非常酷的小程序。 它已经为Ubuntu打包了，很小，几乎没有依赖性。 您可以使用以下命令在Ubuntu上安装： sudo apt-get install firejail

Package info:

套餐信息：

Virtualization

虚拟化

KVM or Virtualbox

KVM或Virtualbox

This is the safest bet depending on the binary, but hey, see above. If it has been sent by “Mr. Hacker” who is a black belt, black hat programmer, there is a chance that the binary can escape a virtualized environment.

根据二进制文件，这是最安全的选择，但是，请参见上文。 如果是“先生先生”发送的 黑客”是黑带，戴着黑帽子的程序员，二进制文件有可能逃脱虚拟化环境。

Malware Binary – Cost Saver Method

恶意软件二进制文件-节省成本的方法

Rent a virtual machine! For example, virtual server providers like Amazon (AWS), Microsoft (Azure), DigitalOcean, Linode, Vultr, and Ramnode. You rent the machine, run whatever you need, then they will wipe it out. Most of the bigger providers bill by the hour, so it really is cheap.

租用虚拟机！ 例如，虚拟服务器提供商，例如Amazon(AWS)，Microsoft(Azure)，DigitalOcean，Linode，Vultr和Ramnode。 您租用机器，运行所需的任何东西，然后他们就会将其清除。 大多数较大的提供商按小时收费，因此它确实很便宜。

Followed by the answer from Emanuele:

随后是Emanuele的回答：

A word of caution. Firejail is OK, but one has to be extremely careful in specifying all the options in terms of the blacklist and whitelist. By default, it does not do what is cited in this Linux Magazine article. Firejail’s author has also left some comments about known issues at Github.

请注意。 Firejail可以，但是在指定黑名单和白名单的所有选项时必须格外小心。 默认情况下，它不执行此Linux Magazine文章中引用的内容 。 Firejail的作者还在Github上对已知问题发表了一些评论 。

Be extremely careful when you use it, it might give you a false sense of security without the right options.

使用它时要格外小心，如果没有正确的选择 ，它可能会给您带来虚假的安全感。

---

---

Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.

有什么补充说明吗？ 在评论中听起来不错。 是否想从其他精通Stack Exchange的用户那里获得更多答案？ 在此处查看完整的讨论线程 。

Image Credit: Prison Cell Clip Art (Clker.com)

图片来源： 监狱牢房剪贴画(Clker.com)

翻译自: https://www.howtogeek.com/285595/how-do-you-safely-run-an-untrusted-executable-file-on-linux/

linux 运行可执行文件