new release of the toolkit , designed for organizing the work of isolated environments in Linux and operating at the application level of non-privileged users. In practice, Bubblewrap is used by the Flatpak project as a layer for isolating applications run from packages. The project code is written in C and is licensed under LGPLv2+.
Isolation employs traditional Linux container virtualization technologies, based on the use of cgroups, namespaces, Seccomp, and SELinux. To perform privileged operations for container setup, Bubblewrap runs with root privileges (the executable file has the suid flag) and subsequently drops those privileges after container initialization.
Activation in the user namespace system, allowing the use of a separate set of identifiers in containers, is not required for operation, as it is not enabled by default in many distributions (Bubblewrap is positioned as a limited suid implementation of a subset of user namespace capabilities — to exclude all user and process identifiers from the environment except for the current one, CLONE_NEWUSER and CLONE_NEWPID modes are used). For additional protection, programs running under
Bubblewrap are launched in PR_SET_NO_NEW_PRIVS mode, preventing the acquisition of new privileges, for instance, when a setuid flag is present.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
The key difference from a similar project , which also uses a launch model with setuid, is that in Bubblewrap the layer for creating containers includes only the necessary minimum of capabilities, while all extended functions required for running graphical applications, interacting with the desktop, and filtering requests to Pulseaudio are outsourced to Flatpak and executed after privilege drop. Firejail, on the other hand, combines all accompanying functions in one executable file, which complicates its auditing and maintaining security at .
The new release is notable for implementing support for attaching existing user namespaces and process (pid namespaces). To manage the connection of namespaces, the flags ‘—userns’, ‘—userns2’, and ‘—pidns’ have been added.
This feature does not work in setuid mode and requires the use of a separate mode that can operate without root privileges but requires activation of
user namespaces in the system (disabled by default in Debian and RHEL/CentOS) and does not eliminate the possibility of for the restrictions rim "user namespaces." Among the new features of Bubblewrap 0.4, there is also the ability to build with the musl C library instead of glibc and support for saving namespace information to a statistics file in JSON format.
Source: opennet.ru
