{"id":107033,"date":"2023-03-02T06:48:15","date_gmt":"2023-03-02T04:48:15","guid":{"rendered":"https:\/\/prohoster.info\/?p=107033"},"modified":"2023-03-03T15:16:36","modified_gmt":"2023-03-03T13:16:36","slug":"vypusk-bubblewrap-0-8-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-bubblewrap-0-8-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Release of Bubblewrap 0.8, a layer for creating isolated environments.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The release of the Bubblewrap 0.8 toolkit, typically used to restrict individual applications of unprivileged users, is now available. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. The project's code is written in C and is distributed under the LGPLv2+ license. <\/p>\n

Isolation employs traditional Linux container virtualization technologies, based on the use of cgroups, namespaces, Seccomp, and SELinux. To perform privileged operations for container setup, Bubblewrap runs with root privileges (the executable file has the suid flag) and subsequently drops those privileges after container initialization. <\/p>\n

User namespace activation for user ID management allows containers to utilize their own separate set of identifiers. This feature is not required for operation, as it is disabled by default in many distributions. Bubblewrap is positioned as a limited suid implementation of a subset of user namespace features\u2014modes CLONE_NEWUSER and CLONE_NEWPID are employed to exclude all user and process identifiers from the environment except for the current one. For additional security, programs running under Bubblewrap are executed in PR_SET_NO_NEW_PRIVS mode, which prohibits acquiring new privileges, for instance, when a setuid flag is present. <\/p>\n

Isolation at the filesystem level is achieved by creating a new mount namespace by default, in which an empty root partition is created using tmpfs. If necessary, external filesystem partitions are attached to this partition in 'mount --bind' mode (for example, when starting with the option 'bwrap --ro-bind \/usr \/usr', the \/usr partition is passed from the main system in read-only mode). Network capabilities are restricted to access to the loopback interface with network stack isolation through the CLONE_NEWNET and CLONE_NEWUTS flags. <\/p>\n

The key difference from the similar project Firejail, which also uses a setuid launch model, is that in Bubblewrap, the layer for creating containers includes only the essential minimum capabilities. All the advanced features necessary for running graphical applications, interacting with the desktop, and filtering requests to Pulseaudio are handled by Flatpak after privilege dropping. Firejail, on the other hand, combines all auxiliary functions into a single executable file, complicating its audit and maintaining security at the required level. <\/p>\n

In the new release: <\/p>\n