Branch 'f13' - zh-CN/Security.po

[Transifex System User]

 zh-CN/Security.po |  231 +++++++++++-------------------------------------------
 1 file changed, 49 insertions(+), 182 deletions(-)

New commits:
commit 5895668849d6c1a211b2e124b8ada7d1c42e6f77
Author: tiansworld <tiansworld at fedoraproject.org>
Date:   Thu Apr 1 02:17:25 2010 +0000

    l10n: Updates to Chinese (China) (zh_CN) translation
    
    Transmitted-via: Transifex (translate.fedoraproject.org)

diff --git a/zh-CN/Security.po b/zh-CN/Security.po
index c1e0d6d..b3ac6b4 100644
--- a/zh-CN/Security.po
+++ b/zh-CN/Security.po
@@ -5,7 +5,7 @@
 # Leah Liu <lliu at redhat.com>, 2008, 2009.
 # Tian Shixiong <tiansworld at gmail.com>, 2008, 2009.
 # microcai <microcai at sina.com>, 2009
-#
+# 
 msgid ""
 msgstr ""
 "Project-Id-Version: docs-release-notes.f12-tx\n"
@@ -23,141 +23,78 @@ msgstr ""
 msgid "Security"
 msgstr "安全性"
 
-#. Tag: title
-#, no-c-format
-msgid "Dogtag Certificate System"
-msgstr ""
-
 #. Tag: para
 #, no-c-format
-msgid ""
-"<firstterm>Dogtag Certificate System</firstterm> (DGS) is an enterprise-"
-"class open-source <firstterm>Certificate Authority</firstterm> (CA) "
-"supporting all aspects of certificate lifecycle management including "
-"<firstterm>Certificate Authority</firstterm> (CA), <firstterm>Data Recovery "
-"Manager</firstterm> (DRM), <firstterm>Online Certificate Status Protocol</"
-"firstterm> (OCSP) Manager, <firstterm>Registration Authorit</firstterm>y "
-"(RA), <firstterm>Token Key Service</firstterm> (TKS), <firstterm>Token "
-"Processing System</firstterm> (TPS) and smartcard management, through "
-"<firstterm>Enterprise Security Client</firstterm> (ESC)."
-msgstr ""
+msgid "<firstterm>Dogtag Certificate System</firstterm> (DGS) is an enterprise-class open-source <firstterm>Certificate Authority</firstterm> (CA) supporting all aspects of certificate lifecycle management including <firstterm>Certificate Authority</firstterm> (CA), <firstterm>Data Recovery Manager</firstterm> (DRM), <firstterm>Online Certificate Status Protocol</firstterm> (OCSP) Manager, <firstterm>Registration Authorit</firstterm>y (RA), <firstterm>Token Key Service</firstterm> (TKS), <firstterm>Token Processing System</firstterm> (TPS) and smartcard management, through <firstterm>Enterprise Security Client</firstterm> (ESC)."
+msgstr "<firstterm>Dogtag Certificate System</firstterm> (DGS)是一个企业级的开源<firstterm>认证授权</firstterm> (CA)，它通过<firstterm>企业安全客户端</firstterm> (ESC)可支持各种认证周期管理，包括<firstterm>认证授权</firstterm> (CA)、<firstterm>数据恢复管理器</firstterm> (DRM)、<firstterm>在线认证状态协议</firstterm> (OCSP) 管理器、<firstterm>注册认证</firstterm> (RA)、<firstterm>令牌密匙服务</firstterm> (TKS)、<firstterm>令牌处理系统</firstterm> (TPS) 以及智能卡管理。 "
 
-#. Tag: para
+#. Tag: title
 #, no-c-format
-msgid ""
-"Refer to the <citetitle>Dogtag Certificate System</citetitle> page on the "
-"Fedora wiki for additional details — <ulink url=\"http://fedoraproject.org/w/"
-"index.php?title=Features/DogtagCertificateSystem\" />."
-msgstr ""
+msgid "Dogtag Certificate System"
+msgstr "Dogtag认证系统"
 
 #. Tag: title
 #, no-c-format
 msgid "modprobe Whitelist"
-msgstr ""
+msgstr "modprobe白名单"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"<application>modprobe</application> Whitelist allows system administrators "
-"in high-security situations to limit the modules loaded by "
-"<application>modprobe</application> to a specific list of modules configured "
-"by the administrator. This limit makes it impossible for unprivileged users "
-"to exploit vulnerabilities in modules that are not ordinarily used, for "
-"example, by attaching hardware. The amount of potentially vulnerable code "
-"that can run in the kernel is therefore limited."
-msgstr ""
+msgid "Refer to the <citetitle>Dogtag Certificate System</citetitle> page on the Fedora wiki for additional details — <ulink url=\"http://fedoraproject.org/w/index.php?title=Features/DogtagCertificateSystem\" />."
+msgstr "查看Fedora wiki的<citetitle>Dogtag Certificate System</citetitle>页面了解详情 — <ulink url=\"http://fedoraproject.org/w/index.php?title=Features/DogtagCertificateSystem\" />。"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"<application>modprobe</application> can also run specified commands instead "
-"of loading a module (using the <command>install</command> configuration "
-"directive); this is restricted using the same whitelist as well. To help "
-"system administrators compile the whitelist, additional functionality is "
-"added to <application>modprobe</application>: it will be possible to log all "
-"information (similar to using <command>modprobe&nbsp;-v</command>) to a "
-"specified file, including <application>modprobe</application> actions run in "
-"the <application>dracut</application> <filename>initrd</filename>. A script "
-"will be provided that compiles a proposed whitelist from the logged data."
-msgstr ""
+msgid "<application>modprobe</application> can also run specified commands instead of loading a module (using the <command>install</command> configuration directive); this is restricted using the same whitelist as well. To help system administrators compile the whitelist, additional functionality is added to <application>modprobe</application>: it will be possible to log all information (similar to using <command>modprobe&nbsp;-v</command>) to a specified file, including <application>modprobe</application> actions run in the <application>dracut</application> <filename>initrd</filename>. A script will be provided that compiles a proposed whitelist from the logged data."
+msgstr "<application>modprobe</application>é™¤åŠ è½½æ¨¡å—å¤–ä¹Ÿå¯ä»¥è¿è¡Œç‰¹å®šçš„å‘½ä»¤(使用<command>install</command>配置管理)；这可以通过同一个白名单做限制。为了让系统管理员编译白名单，<application>modprobe</application>åŠ å…¥äº†é¢å¤–çš„åŠŸèƒ½ï¼šå®ƒå¯ä»¥æŠŠæ‰€æœ‰ä¿¡æ¯(类似于用<command>modprobe&nbsp;-v</command>)记录到指定文件，包括<application>dracut</application> <filename>initrd</filename>中<application>modprobe</application>的动作。有脚本可用来从日志数据中编译白名单。"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"Use this whitelist to reduce the kernel-space attack surface considerably "
-"and avoid risk of vulnerabilities in rarely-used kernel-mode code. A sample "
-"desktop Fedora system currently has 79 modules loaded, out of 1964 available "
-"modules (4%). When counting code size, and the main kernel file (<filename>/"
-"boot/vmlinuz*</filename>) is included, the sample desktop system runs 8.36 "
-"MB of kernel-space code, out of 34.66 MB available (24%)."
-msgstr ""
+msgid "<application>modprobe</application> Whitelist allows system administrators in high-security situations to limit the modules loaded by <application>modprobe</application> to a specific list of modules configured by the administrator. This limit makes it impossible for unprivileged users to exploit vulnerabilities in modules that are not ordinarily used, for example, by attaching hardware. The amount of potentially vulnerable code that can run in the kernel is therefore limited."
+msgstr "<application>modprobe</application>白名单可让管理员在高安全环境下把<application>modprobe</application>åŠ è½½çš„æ¨¡å—é™åˆ¶åœ¨ç®¡ç†å‘˜é…ç½®å¥½çš„æ¨¡å—åˆ—è¡¨å†…ã€‚è¿™ä¸€é™åˆ¶ä½¿æœªç»æŽˆæƒçš„ç”¨æˆ·æ— æ³•å†åˆ©ç”¨ä¸å¸¸ç”¨çš„æ¨¡å—(å¦‚é™„åŠ ç¡¬ä»¶)ä¸­çš„æ¼æ´žã€‚å› æ­¤ä¹Ÿå°±é™åˆ¶äº†å¯è¿è¡ŒäºŽå†…æ ¸ä¸­çš„æ½œåœ¨æ¼æ´žä»£ç çš„æ•°é‡ã€‚"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"Refer to the <citetitle>Modprobe Whitelist </citetitle> feature page on the "
-"Fedora wiki for a more complete description of this feature: <ulink url="
-"\"http://fedoraproject.org/w/index.php?title=Features/ModprobeWhitelist\" />"
-msgstr ""
+msgid "Refer to the <citetitle>Modprobe Whitelist </citetitle> feature page on the Fedora wiki for a more complete description of this feature: <ulink url=\"http://fedoraproject.org/w/index.php?title=Features/ModprobeWhitelist\" />"
+msgstr "更完整的介绍请参考Fedora wiki中的<citetitle>Modprobe Whitelist </citetitle>特性页面：<ulink url=\"http://fedoraproject.org/w/index.php?title=Features/ModprobeWhitelist\" />"
 
-#. Tag: title
+#. Tag: para
 #, no-c-format
-msgid "User Account Dialog"
-msgstr ""
+msgid "Use this whitelist to reduce the kernel-space attack surface considerably and avoid risk of vulnerabilities in rarely-used kernel-mode code. A sample desktop Fedora system currently has 79 modules loaded, out of 1964 available modules (4%). When counting code size, and the main kernel file (<filename>/boot/vmlinuz*</filename>) is included, the sample desktop system runs 8.36 MB of kernel-space code, out of 34.66 MB available (24%)."
+msgstr "ä½¿ç”¨ç™½åå•å¯å¤§å¤§å‡å°‘å†…æ ¸ç©ºé—´çš„æ”»å‡»å¹¶å¯é¿å…å¾ˆå°‘ä½¿ç”¨çš„å†…æ ¸æ¨¡å¼ä»£ç æ¼æ´žå¸¦æ¥çš„é£Žé™©ã€‚ä»Žä¸€ä¸ªæ ·æœ¬Fedoraæ¡Œé¢ç³»ç»Ÿæ¥çœ‹ï¼Œå…±åŠ è½½1964个可用模块中的79个(4%)ã€‚æŒ‰ä»£ç é‡è®¡ç®—ï¼ŒåŒ…æ‹¬ä¸»å†…æ ¸æ–‡ä»¶(<filename>/boot/vmlinuz*</filename>)åœ¨å†…ï¼Œæ ·æœ¬æ¡Œé¢ç³»ç»Ÿè¿è¡Œ8.36MBçš„å†…æ ¸ç©ºé—´ä»£ç ï¼Œå 34.66MB总量的24%。"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"A new User Account Dialog is redesigned and implemented to create new users "
-"and edit user-related information in single-user systems or small "
-"deployments. This new dialog supersedes functionality that was previously "
-"available in a variety of tools, such as <application>system-config-user</"
-"application>, <application>gnome-about-me</application>, "
-"<application>gdmsetup</application> and <application>polkit-gnome-"
-"authorization</application>, and makes it available in one place."
-msgstr ""
+msgid "A new User Account Dialog is redesigned and implemented to create new users and edit user-related information in single-user systems or small deployments. This new dialog supersedes functionality that was previously available in a variety of tools, such as <application>system-config-user</application>, <application>gnome-about-me</application>, <application>gdmsetup</application> and <application>polkit-gnome-authorization</application>, and makes it available in one place."
+msgstr "ç”¨æˆ·å¸æˆ·ä¼šè¯ç»è¿‡é‡æ–°è®¾è®¡èƒ½å¤Ÿåœ¨å•ä¸€ç”¨æˆ·ç³»ç»Ÿæˆ–å°éƒ¨ç½²ç³»ç»Ÿä¸Šåˆ›å»ºæ–°ç”¨æˆ·ä»¥åŠä¿®æ”¹ç”¨æˆ·ç›¸å…³ä¿¡æ¯ã€‚æ–°ä¼šè¯åœ¨åŠŸèƒ½ä¸Šä»£æ›¿äº†ä¹‹å‰çš„å‡ ä¸ªå·¥å…·ï¼Œå¦‚<application>system-config-user</application>、 <application>gnome-about-me</application>、 <application>gdmsetup</application>å’Œ<application>polkit-gnome-authorization</application>，使得这些功能可以在同一位置设置。"
 
-#. Tag: para
+#. Tag: title
 #, no-c-format
-msgid ""
-"The <citetitle>User Account Dialog</citetitle> page on the Fedora wiki "
-"includes more details: <ulink url=\"http://fedoraproject.org/w/index.php?"
-"title=Features/UserAccountDialog\" />"
-msgstr ""
+msgid "User Account Dialog"
+msgstr "用户帐户会话"
 
 #. Tag: title
 #, no-c-format
 msgid "Policy Kit One"
-msgstr ""
+msgstr "Policy Kit One"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"<application>PolicyKitOne</application> replaces the old deprecated "
-"<application>PolicyKit </application> and gives KDE users a better "
-"experience of their applications and desktop in general. The Fedora&nbsp;12 "
-"KDE Desktop Edition used <application>Gnome Authentication Agent </"
-"application>. <application>PolicyKitOne</application> makes it possible to "
-"utilize the native KDE authentication agent, <application>KAuth</"
-"application> in Fedora&nbsp;13."
-msgstr ""
+msgid "The <citetitle>User Account Dialog</citetitle> page on the Fedora wiki includes more details: <ulink url=\"http://fedoraproject.org/w/index.php?title=Features/UserAccountDialog\" />"
+msgstr "Fedora wiki页面<citetitle>User Account Dialog</citetitle>介绍了更多信息：<ulink url=\"http://fedoraproject.org/w/index.php?title=Features/UserAccountDialog\" />"
 
 #. Tag: para
 #, no-c-format
-msgid ""
-"For a complete description of this feature, refer to the <citetitle>KDE "
-"PolicyKit One Qt</citetitle> page on the Fedora wiki: <ulink url=\"http://"
-"fedoraproject.org/w/index.php?title=Features/KDE_PolicyKitOneQt\" />"
-msgstr ""
+msgid "For a complete description of this feature, refer to the <citetitle>KDE PolicyKit One Qt</citetitle> page on the Fedora wiki: <ulink url=\"http://fedoraproject.org/w/index.php?title=Features/KDE_PolicyKitOneQt\" />"
+msgstr "有关本特性的完整介绍请查看Fedora wiki页面<citetitle>KDE PolicyKit One Qt</citetitle>：<ulink url=\"http://fedoraproject.org/w/index.php?title=Features/KDE_PolicyKitOneQt\" />"
+
+#. Tag: para
+#, no-c-format
+msgid "<application>PolicyKitOne</application> replaces the old deprecated <application>PolicyKit </application> and gives KDE users a better experience of their applications and desktop in general. The Fedora&nbsp;12 KDE Desktop Edition used <application>Gnome Authentication Agent </application>. <application>PolicyKitOne</application> makes it possible to utilize the native KDE authentication agent, <application>KAuth</application> in Fedora&nbsp;13."
+msgstr "<application>PolicyKitOne</application>代替了<application>PolicyKit </application>，给KDE用户带来更好地应用程序及桌面体验。Fedora&nbsp;12 KDE桌面版使用<application>Gnome Authentication Agent </application>。<application>PolicyKitOne</application>让Fedora&nbsp;13中的<application>KAuth</application>利用本地KDE验证代理变为可能。"
 
-#~ msgid ""
-#~ "This beat is located here: <ulink type=\"http\" url=\"https://"
-#~ "fedoraproject.org/wiki/Docs/Beats/Security\">https://fedoraproject.org/"
-#~ "wiki/Docs/Beats/Security</ulink>"
-#~ msgstr ""
-#~ "这个 beat位于：<ulink type=\"http\" url=\"https://fedoraproject.org/wiki/"
-#~ "Docs/Beats/Security\">https://fedoraproject.org/wiki/Docs/Beats/Security</"
-#~ "ulink>"
+#~ msgid "This beat is located here: <ulink type=\"http\" url=\"https://fedoraproject.org/wiki/Docs/Beats/Security\">https://fedoraproject.org/wiki/Docs/Beats/Security</ulink>"
+#~ msgstr "这个 beat位于：<ulink type=\"http\" url=\"https://fedoraproject.org/wiki/Docs/Beats/Security\">https://fedoraproject.org/wiki/Docs/Beats/Security</ulink>"
 
 #~ msgid "This section highlights various security items from Fedora."
 #~ msgstr "è¿™ä¸€ç« è®°è¿° Fedora 的各种安全性项目。"
@@ -165,96 +102,26 @@ msgstr ""
 #~ msgid "Lower process capabilities"
 #~ msgstr "低处理能力"
 
-#~ msgid ""
-#~ "Daemons running as root have been reviewed and patched to run with lower "
-#~ "process capabilities. This reduces the desirability of using these "
-#~ "daemons for privilege escalation. Additionally, the shadow file "
-#~ "permissions have been changed to <literal>000</literal> and several "
-#~ "directories in <filename>$PATH</filename> have been set to <literal>555</"
-#~ "literal> in order to prevent daemons without <literal>DAC_OVERRIDE</"
-#~ "literal> from being able to access the shadow file or write to the "
-#~ "<filename>$PATH</filename> directories."
-#~ msgstr ""
-#~ "以rootç”¨æˆ·è¿è¡Œçš„å®ˆæŠ¤è¿›ç¨‹ç»è¿‡å®¡æ ¸å’Œè¡¥ä¸ï¼Œå¼€å§‹ä»¥ä½Žå¤„ç†èƒ½åŠ›è¿è¡Œã€‚è¿™é™ä½Žäº†ä½¿ç”¨"
-#~ "这些守护进程提升权限的风险。此外，卷影文件权限更改为<literal>000</"
-#~ "literal>，<filename>$PATH</filename>下的一些目录权限设置为<literal>555</"
-#~ "literal>，以防止守护进程在没有<literal>DAC_OVERRIDE</literal>时访问卷影文"
-#~ "件或向<filename>$PATH</filename>目录写入内容。"
+#~ msgid "Daemons running as root have been reviewed and patched to run with lower process capabilities. This reduces the desirability of using these daemons for privilege escalation. Additionally, the shadow file permissions have been changed to <literal>000</literal> and several directories in <filename>$PATH</filename> have been set to <literal>555</literal> in order to prevent daemons without <literal>DAC_OVERRIDE</literal> from being able to access the shadow file or write to the <filename>$PATH</filename> directories."
+#~ msgstr "以rootç”¨æˆ·è¿è¡Œçš„å®ˆæŠ¤è¿›ç¨‹ç»è¿‡å®¡æ ¸å’Œè¡¥ä¸ï¼Œå¼€å§‹ä»¥ä½Žå¤„ç†èƒ½åŠ›è¿è¡Œã€‚è¿™é™ä½Žäº†ä½¿ç”¨è¿™äº›å®ˆæŠ¤è¿›ç¨‹æå‡æƒé™çš„é£Žé™©ã€‚æ­¤å¤–ï¼Œå·å½±æ–‡ä»¶æƒé™æ›´æ”¹ä¸º<literal>000</literal>，<filename>$PATH</filename>下的一些目录权限设置为<literal>555</literal>，以防止守护进程在没有<literal>DAC_OVERRIDE</literal>时访问卷影文件或向<filename>$PATH</filename>目录写入内容。"
 
-#~ msgid ""
-#~ "When someone attacks a system, they normally can not do much unless they "
-#~ "can escalate privileges. This feature reduces the number of attack "
-#~ "targets that can be used to escalate privileges. If root processes do not "
-#~ "have all capabilities, they will be harder to use to subvert the system."
-#~ msgstr ""
-#~ "当有人入侵系统时，除非他们提高了自己的权限，否则一般做不了太多事情。此特性"
-#~ "é™ä½Žäº†å¯ç”¨æ¥æå‡æƒé™çš„æ”»å‡»ç›®æ ‡æ•°é‡ã€‚å¦‚æžœroot进程不包括所有能力，那么他们也"
-#~ "å¾ˆéš¾ç ´åç³»ç»Ÿã€‚"
+#~ msgid "When someone attacks a system, they normally can not do much unless they can escalate privileges. This feature reduces the number of attack targets that can be used to escalate privileges. If root processes do not have all capabilities, they will be harder to use to subvert the system."
+#~ msgstr "å½“æœ‰äººå…¥ä¾µç³»ç»Ÿæ—¶ï¼Œé™¤éžä»–ä»¬æé«˜äº†è‡ªå·±çš„æƒé™ï¼Œå¦åˆ™ä¸€èˆ¬åšä¸äº†å¤ªå¤šäº‹æƒ…ã€‚æ­¤ç‰¹æ€§é™ä½Žäº†å¯ç”¨æ¥æå‡æƒé™çš„æ”»å‡»ç›®æ ‡æ•°é‡ã€‚å¦‚æžœrootè¿›ç¨‹ä¸åŒ…æ‹¬æ‰€æœ‰èƒ½åŠ›ï¼Œé‚£ä¹ˆä»–ä»¬ä¹Ÿå¾ˆéš¾ç ´åç³»ç»Ÿã€‚"
 
-#~ msgid ""
-#~ "Processes with the root uid can still damage a system, because they can "
-#~ "write to nearly any file and of course read the <filename>/etc/shadow "
-#~ "file</filename>. However, if the system is hardened so that root requires "
-#~ "the <literal>DAC_OVERRIDE</literal> capability, then only a limited "
-#~ "number of processes can damage the system. This will not affect any admin "
-#~ "abilities because they always get full privileges which includes "
-#~ "<literal>DAC_OVERRIDE</literal>. Therefore, even if someone does "
-#~ "successfully attack a root process, it is now harder for them to take "
-#~ "advantage of this attack."
-#~ msgstr ""
-#~ "由于拥有root uidçš„è¿›ç¨‹å¯å‘å‡ ä¹Žæ‰€æœ‰çš„æ–‡ä»¶å†™å…¥å¹¶ä¸”å¯ä»¥è¯»å–<filename>/etc/"
-#~ "shadow file</filename>ï¼Œå› æ­¤è¿™äº›è¿›ç¨‹ä»å¯èƒ½ä¼šç ´åç³»ç»Ÿã€‚ç„¶è€Œå¦‚æžœå°†ç³»ç»Ÿå¼ºåŒ–ä½¿"
-#~ "å¾—root需要<literal>DAC_OVERRIDE</literal>èƒ½åŠ›ï¼Œé‚£ä¹ˆèƒ½å¤Ÿç ´åç³»ç»Ÿçš„è¿›ç¨‹åªå‰©"
-#~ "å°‘æ•°ã€‚è¿™ä¸ä¼šå¯¹ç®¡ç†èƒ½åŠ›é€ æˆå½±å“ï¼Œå› ä¸ºå®ƒä»¬éƒ½æ‹¥æœ‰åŒ…æ‹¬<literal>DAC_OVERRIDE</"
-#~ "literal>åœ¨å†…çš„å®Œæ•´æƒé™ã€‚å› æ­¤å³ä½¿æœ‰äººæˆåŠŸå…¥ä¾µäº†ä¸€ä¸ªroot进程，也很难利用此进"
-#~ "ç¨‹åšå‡ºæ›´å¤šç ´åã€‚"
+#~ msgid "Processes with the root uid can still damage a system, because they can write to nearly any file and of course read the <filename>/etc/shadow file</filename>. However, if the system is hardened so that root requires the <literal>DAC_OVERRIDE</literal> capability, then only a limited number of processes can damage the system. This will not affect any admin abilities because they always get full privileges which includes <literal>DAC_OVERRIDE</literal>. Therefore, even if someone does successfully attack a root process, it is now harder for them to take advantage of this attack."
+#~ msgstr "由于拥有root uidçš„è¿›ç¨‹å¯å‘å‡ ä¹Žæ‰€æœ‰çš„æ–‡ä»¶å†™å…¥å¹¶ä¸”å¯ä»¥è¯»å–<filename>/etc/shadow file</filename>ï¼Œå› æ­¤è¿™äº›è¿›ç¨‹ä»å¯èƒ½ä¼šç ´åç³»ç»Ÿã€‚ç„¶è€Œå¦‚æžœå°†ç³»ç»Ÿå¼ºåŒ–ä½¿å¾—root需要<literal>DAC_OVERRIDE</literal>èƒ½åŠ›ï¼Œé‚£ä¹ˆèƒ½å¤Ÿç ´åç³»ç»Ÿçš„è¿›ç¨‹åªå‰©å°‘æ•°ã€‚è¿™ä¸ä¼šå¯¹ç®¡ç†èƒ½åŠ›é€ æˆå½±å“ï¼Œå› ä¸ºå®ƒä»¬éƒ½æ‹¥æœ‰åŒ…æ‹¬<literal>DAC_OVERRIDE</literal>åœ¨å†…çš„å®Œæ•´æƒé™ã€‚å› æ­¤å³ä½¿æœ‰äººæˆåŠŸå…¥ä¾µäº†ä¸€ä¸ªrootè¿›ç¨‹ï¼Œä¹Ÿå¾ˆéš¾åˆ©ç”¨æ­¤è¿›ç¨‹åšå‡ºæ›´å¤šç ´åã€‚"
 
-#~ msgid ""
-#~ "A hardened system would have permissions like: <literal>555</literal> "
-#~ "<filename>/bin</filename>, <literal>555</literal> <filename>/lib</"
-#~ "filename>, <literal>000</literal> <filename>/etc/shadow</filename> and so "
-#~ "on. The current scope is to cover the directories in <filename>$PATH</"
-#~ "filename> variable, library dirs, <filename>/boot</filename>, and "
-#~ "<filename>/root</filename>. This scheme does not affect SELinux in any "
-#~ "way and complements it since capabilities are DAC controls and they have "
-#~ "first vote on allowing an access."
-#~ msgstr ""
-#~ "强化的系统应该有类似的权限：<literal>555</literal> <filename>/bin</"
-#~ "filename>, <literal>555</literal> <filename>/lib</filename>, "
-#~ "<literal>000</literal> <filename>/etc/shadow</filename>等。当前范围是覆盖"
-#~ "<filename>$PATH</filename>变量下的目录、库目录、<filename>/boot</filename>"
-#~ "及<filename>/root</filename>。此方案不但不会影响SELinux，而且会对其进行补"
-#~ "å……ã€‚å› ä¸ºè¿™äº›èƒ½åŠ›å±žäºŽDAC controls，而它们首先决定是否允许访问。"
+#~ msgid "A hardened system would have permissions like: <literal>555</literal> <filename>/bin</filename>, <literal>555</literal> <filename>/lib</filename>, <literal>000</literal> <filename>/etc/shadow</filename> and so on. The current scope is to cover the directories in <filename>$PATH</filename> variable, library dirs, <filename>/boot</filename>, and <filename>/root</filename>. This scheme does not affect SELinux in any way and complements it since capabilities are DAC controls and they have first vote on allowing an access."
+#~ msgstr "强化的系统应该有类似的权限：<literal>555</literal> <filename>/bin</filename>, <literal>555</literal> <filename>/lib</filename>, <literal>000</literal> <filename>/etc/shadow</filename>等。当前范围是覆盖<filename>$PATH</filename>变量下的目录、库目录、<filename>/boot</filename>及<filename>/root</filename>。此方案不但不会影响SELinuxï¼Œè€Œä¸”ä¼šå¯¹å…¶è¿›è¡Œè¡¥å……ã€‚å› ä¸ºè¿™äº›èƒ½åŠ›å±žäºŽDAC controls，而它们首先决定是否允许访问。"
 
 #~ msgid "SELinux Sandbox"
 #~ msgstr "SELinux Sandbox"
 
-#~ msgid ""
-#~ "The SELinux sandbox allows a command to be run in a highly constrained "
-#~ "fashion. Unfortunately, the nature of GUI applications is such that it is "
-#~ "very difficult to use this capability on those applications that need it "
-#~ "most."
-#~ msgstr ""
-#~ "SeLinux sandbox允许命令以高限制的方式运行。不幸的是，由于GUI程序的特性，在"
-#~ "最那些需要的GUI程序上使用这个功能是非常困难的。"
+#~ msgid "The SELinux sandbox allows a command to be run in a highly constrained fashion. Unfortunately, the nature of GUI applications is such that it is very difficult to use this capability on those applications that need it most."
+#~ msgstr "SeLinux sandbox允许命令以高限制的方式运行。不幸的是，由于GUI程序的特性，在最那些需要的GUI程序上使用这个功能是非常困难的。"
 
-#~ msgid ""
-#~ "A new <command>sandbox -X</command> command allows many GUI applications "
-#~ "to be tightly constrained. By applying this within some web applications, "
-#~ "a user may specify, for example, that Open Office should run normally "
-#~ "when invoked by the user, but should be constrained when invoked from the "
-#~ "web."
-#~ msgstr ""
-#~ "新命令<command>sandbox -X</command>可用来限制多个GUI程序。用户可以在某些网"
-#~ "络程序中运行此命令，比如Open Office在用户调用后可以正常运行，但如果由网络"
-#~ "调用时，它会受到限制。"
+#~ msgid "A new <command>sandbox -X</command> command allows many GUI applications to be tightly constrained. By applying this within some web applications, a user may specify, for example, that Open Office should run normally when invoked by the user, but should be constrained when invoked from the web."
+#~ msgstr "新命令<command>sandbox -X</command>可用来限制多个GUI程序。用户可以在某些网络程序中运行此命令，比如Open Office在用户调用后可以正常运行，但如果由网络调用时，它会受到限制。"
 
-#~ msgid ""
-#~ "When run from the SELinux sandbox, a GUI application may only access a "
-#~ "limited directory structure which is destroyed on exit, is denied access "
-#~ "to the network, and runs in an isolated X-server, which prevents it from "
-#~ "accessing other X applications."
-#~ msgstr ""
-#~ "当GUI程序通过SELinux sandbox运行后，它只能读取有限的目录，这些目录在其退出"
-#~ "åŽå°±ä¼šè¢«åˆ é™¤ï¼Œå®ƒä¹Ÿæ— æ³•è®¿é—®ç½‘ç»œï¼Œå¹¶è¿è¡Œåœ¨ä¸€ä¸ªå­¤ç«‹çš„X-serverä¸­ï¼Œè¿™æ ·å°±é˜»æ­¢äº†"
-#~ "它读取其它X程序。"
+#~ msgid "When run from the SELinux sandbox, a GUI application may only access a limited directory structure which is destroyed on exit, is denied access to the network, and runs in an isolated X-server, which prevents it from accessing other X applications."
+#~ msgstr "当GUI程序通过SELinux sandboxè¿è¡ŒåŽï¼Œå®ƒåªèƒ½è¯»å–æœ‰é™çš„ç›®å½•ï¼Œè¿™äº›ç›®å½•åœ¨å…¶é€€å‡ºåŽå°±ä¼šè¢«åˆ é™¤ï¼Œå®ƒä¹Ÿæ— æ³•è®¿é—®ç½‘ç»œï¼Œå¹¶è¿è¡Œåœ¨ä¸€ä¸ªå­¤ç«‹çš„X-serverä¸­ï¼Œè¿™æ ·å°±é˜»æ­¢äº†å®ƒè¯»å–å…¶å®ƒX程序。"