A new version of the Bubblewrap toolkit 0.12 has been released, which is used to limit individual applications of unprivileged users. In practice, Bubblewrap is used by the Flatpak project as a layer for isolating applications launched from packages. Traditional Linux container virtualization technologies are employed for isolation, based on the use of cgroups, namespaces, Seccomp, and SELinux. The project code is written in C and distributed under the LGPLv2.1+ license.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
To exclude all unnecessary user and process identifiers from the created isolated environment, the CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be used, while the PR_SET_NO_NEW_PRIVS mode is applied to prevent the acquisition of new privileges. The necessary privileges are obtained through the 'user namespace'.
In the new release:
- The code license has been changed from LGPL 2.0+ to LGPL 2.1+.
- Support for building a binary that receives additional privileges using the suid root flag has been discontinued. Support for 'user namespace' is now mandatory. The reason cited is the complexity of maintaining the version with the suid flag against the backdrop of widespread support for 'user namespace' in distributions.
- A new option ‘--not-a-security-boundary’ has been added, which means that certain configuration failures in the sandbox environment, such as remounting a subvolume, do not lead to a crash.
- A build option ‘assume_kernel’ has been added, which disables backward compatibility with Linux kernels older than the specified version. For example, specifying versions 5.6.0+ will exclude the alternative implementation of the 'openat2(RESOLVE_IN_ROOT)' functionality.
Source: opennet.ru
