The release of the Bubblewrap toolkit for organizing isolated environments 0.5.0 is now available, typically used to restrict individual applications of unprivileged users. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. The project code is written in C and distributed under the LGPLv2+ license.
Isolation employs traditional Linux container virtualization technologies, based on the use of cgroups, namespaces, Seccomp, and SELinux. To perform privileged operations for container setup, Bubblewrap runs with root privileges (the executable file has the suid flag) and subsequently drops those privileges after container initialization.
Activation of user namespace support in the system, which allows the use of a separate set of identifiers within containers, is not required, as it is generally non-functional in many distributions (Bubblewrap is positioned as a limited suid implementation of a subset of user namespace capabilities — the CLONE_NEWUSER and CLONE_NEWPID modes are used to exclude all user and process identifiers from the environment except for the current one). For additional protection, programs executed under Bubblewrap are run in PR_SET_NO_NEW_PRIVS mode, preventing the gain of new privileges, for instance, when the setuid flag is set.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
The key difference from the similar project Firejail, which also uses a setuid launch model, is that in Bubblewrap, the layer for creating containers includes only the essential minimum capabilities. All the advanced features necessary for running graphical applications, interacting with the desktop, and filtering requests to Pulseaudio are handled by Flatpak after privilege dropping. Firejail, on the other hand, combines all auxiliary functions into a single executable file, complicating its audit and maintaining security at the required level.
The new release offers options: "--chmod" for changing permissions, "--clearenv" for clearing environment variables (except PWD), and "--perms" for defining permissions applied during operations like "--bind-data", "--dir", "--file", "--ro-bind-data", and "--tmpfs". Diagnostics for issues arising during bind mount failures have been improved. For zsh, command auto-completion is now supported with the tab key.
Source: opennet.ru
