After a year of development, a new version of the tool for organizing the work of isolated environments, Bubblewrap 0.9, has been released, which is used to limit individual applications of unprivileged users. In practice, Bubblewrap is applied by the Flatpak project as a layer for isolating applications launched from packages. The project code is written in C and is distributed under the LGPLv2+ license.
Isolation employs traditional Linux container virtualization technologies, based on the use of cgroups, namespaces, Seccomp, and SELinux. To perform privileged operations for container setup, Bubblewrap runs with root privileges (the executable file has the suid flag) and subsequently drops those privileges after container initialization.
Activation of user namespace support in the system, which allows the use of a separate set of identifiers within containers, is not required, as it is generally non-functional in many distributions (Bubblewrap is positioned as a limited suid implementation of a subset of user namespace capabilities — the CLONE_NEWUSER and CLONE_NEWPID modes are used to exclude all user and process identifiers from the environment except for the current one). For additional protection, programs executed under Bubblewrap are run in PR_SET_NO_NEW_PRIVS mode, preventing the gain of new privileges, for instance, when the setuid flag is set.
File system-level isolation is achieved through the default creation of a new mount namespace, where an empty root filesystem is created using tmpfs. External filesystem partitions can be attached to this filesystem as needed using the "mount --bind" option (for example, when using the option "bwrap --ro-bind /usr /usr", the /usr partition is passed from the main system in read-only mode). Network capabilities are limited to access to the loopback interface with isolation of the network stack through the CLONE_NEWNET and CLONE_NEWUTS flags.
The key difference from the similar project Firejail, which also uses a setuid launch model, is that in Bubblewrap, the layer for creating containers includes only the essential minimum capabilities. All the advanced features necessary for running graphical applications, interacting with the desktop, and filtering requests to Pulseaudio are handled by Flatpak after privilege dropping. Firejail, on the other hand, combines all auxiliary functions into a single executable file, complicating its audit and maintaining security at the required level.
In the new release:
- Files generated in Autotools have been removed from the source package. It is now recommended to use the Meson build system. Optional support for Autotools has been retained for now, but it is planned to be removed in future releases.
- An ‘—argv0’ option has been added for setting the zero argument of the command line (argv[0] — the name of the executable file, e.g., ‘—argv0 /usr/bin/test’).
- The ‘—symlink’ option now triggers only when the symbolic link already exists and points to the correct target file.
- The ‘—cap-add’ option has been documented, which is used to set capability flags, such as ‘CAP_DAC_READ_SEARCH’.
- Error messages displayed on mount failure have been made more informative.
- The process of creating unit tests has been simplified.
- Support for older versions of Python has been discontinued in usage examples.
- Memory allocation operations have been improved.
Source: opennet.ru
