The release of the Bubblewrap 0.8 toolkit, typically used to restrict individual applications of unprivileged users, is now available. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. The project's code is written in C and is distributed under the LGPLv2+ license.
Isolation employs traditional Linux container virtualization technologies, based on the use of cgroups, namespaces, Seccomp, and SELinux. To perform privileged operations for container setup, Bubblewrap runs with root privileges (the executable file has the suid flag) and subsequently drops those privileges after container initialization.
Activation of user namespace support in the system, which allows the use of a separate set of identifiers within containers, is not required, as it is generally non-functional in many distributions (Bubblewrap is positioned as a limited suid implementation of a subset of user namespace capabilities — the CLONE_NEWUSER and CLONE_NEWPID modes are used to exclude all user and process identifiers from the environment except for the current one). For additional protection, programs executed under Bubblewrap are run in PR_SET_NO_NEW_PRIVS mode, preventing the gain of new privileges, for instance, when the setuid flag is set.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
The key difference from the similar project Firejail, which also uses a setuid launch model, is that in Bubblewrap, the layer for creating containers includes only the essential minimum capabilities. All the advanced features necessary for running graphical applications, interacting with the desktop, and filtering requests to Pulseaudio are handled by Flatpak after privilege dropping. Firejail, on the other hand, combines all auxiliary functions into a single executable file, complicating its audit and maintaining security at the required level.
In the new release:
- An option "—disable-userns" has been added to disable the creation of a nested user namespace in the sandbox environment.
- An option "—assert-userns-disabled" has been added to verify that when using the "—disable-userns" option, the existing user namespace is applied.
- The clarity of error messages related to the disabling of kernel settings CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER has been improved.
Source: opennet.ru
