A new version of Bubblewrap 0.12, a tool for organizing isolated environments, has been published. It is used to restrict individual applications for unprivileged users. In practice, Bubblewrap is used by the Flatpak project as a layer for isolating applications launched from packages. Traditional methods for isolating are used for this purpose. Linux container virtualization technologies based on the use of cgroups, namespaces, Seccomp and SELinuxThe project code is written in C and distributed under the LGPLv2.1+ license.
Isolation at the filesystem level is done by creating a new mount namespace by default, in which an empty root partition is created using tmpfs. If necessary, partitions of an external FS are attached to this partition in the "mount --bind" mode (for example, when you start it with the "bwrap --ro-bind /usr /usr" option, the /usr partition is forwarded from the main system in read-only mode). Networking is limited to accessing the loopback interface with network stack isolation via the CLONE_NEWNET and CLONE_NEWUTS flags.
To exclude all unnecessary user and process IDs from the created isolated environment, the CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be used, and the PR_SET_NO_NEW_PRIVS mode is used to prevent the acquisition of new privileges. The "user namespace" is used to acquire the necessary privileges.
In the new release:
- The code license has been changed from LGPL 2.0+ to LGPL 2.1+.
- Support for building as an executable file that gains additional privileges using the suid root flag has been discontinued. Support for "user namespace" is now mandatory. The reason cited is the complexity of maintaining the suid flag, given the widespread support for "user namespace" in distributions.
- Added the "--not-a-security-boundary" option, which, when set, prevents certain failures when setting up an isolated sandbox environment, such as remounting a subkey, from causing a crash.
- Added build option "assume_kernel" to disable backward compatibility with kernels Linux, older than the specified version. For example, specifying versions 5.6.0+ will exclude the alternative implementation of the "openat2(RESOLVE_IN_ROOT)" functionality.
Source: opennet.ru
