A new version of the Bubblewrap toolkit for organizing isolated environments, version 0.11, has been released. It is used to limit individual applications of unprivileged users. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. Traditional Linux container virtualization technologies, based on cgroups, namespaces, Seccomp, and SELinux, are employed for isolation. The project code is written in C and is distributed under the LGPLv2+ license.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
To exclude all unnecessary user and process identifiers from the created isolated environment, the CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be used, while the PR_SET_NO_NEW_PRIVS mode is applied to prevent gaining new privileges. On systems with 'user namespace', Bubblewrap can be run under a regular user, whereas on systems without 'user namespace', it can be used with the suid root flag to perform the necessary initialization of the isolated environment.
In the new release:
- The capability to create mount points has been provided, using a single-layer file system OverlayFS, which combines several parts of other file systems. New command line options for managing the use of OverlayFS, such as ‘—overlay’, ‘—tmp-overlay’, ‘—ro-overlay’, and ‘—overlay-src’, have been introduced.
- An option ‘—level-prefix’ has been added for substituting the priority level in the syslog style into diagnostic output, allowing utilities like ‘logger’ and ‘systemd-cat’ to process the output.
- Support for the Autotools build system has been discontinued. The Meson toolkit is now required for building.
Source: opennet.ru
