Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Adrian Perez de Castro <aperez@igalia.com>
To: buildroot@buildroot.org
Cc: Adrian Perez de Castro <aperez@igalia.com>
Subject: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0
Date: Thu, 10 Sep 2026 11:52:19 +0200	[thread overview]
Message-ID: <20260910095223.1597453-1-aperez@igalia.com> (raw)

Fixes a sandbox escape through symlink traversal tracked in
CVE-2026-87766, which affects all previous versions.

Using the bwrap binary with the setuid bit set is no longer supported
and user namespaces are now always required, so a kernel config fixup
is applied.

A new build option allows indicating the minimum kernel version that
will be used, which removes code used for backwards compatibility with
kernels older than 5.6.0 when a newer version is specified. Passing
$(LINUX_VERSION_PROBED) seems reasonable here.

This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
hence the updated hash.

Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.12.0

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
---
 package/bubblewrap/bubblewrap.hash |  6 +++---
 package/bubblewrap/bubblewrap.mk   | 17 +++++++----------
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/package/bubblewrap/bubblewrap.hash b/package/bubblewrap/bubblewrap.hash
index e87d3c81cb..e150e1495d 100644
--- a/package/bubblewrap/bubblewrap.hash
+++ b/package/bubblewrap/bubblewrap.hash
@@ -1,5 +1,5 @@
-# From https://github.com/containers/bubblewrap/releases/download/v0.11.2/bubblewrap-0.11.2.tar.xz.sha256sum
-sha256  69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6  bubblewrap-0.11.2.tar.xz
+# From https://github.com/containers/bubblewrap/releases/download/v0.12.0/bubblewrap-0.12.0.tar.xz.sha256sum
+sha256  9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314  bubblewrap-0.12.0.tar.xz
 
 # Hash for license files:
-sha256  b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c  COPYING
+sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING
diff --git a/package/bubblewrap/bubblewrap.mk b/package/bubblewrap/bubblewrap.mk
index 7838ab90b3..40a8148e14 100644
--- a/package/bubblewrap/bubblewrap.mk
+++ b/package/bubblewrap/bubblewrap.mk
@@ -4,21 +4,24 @@
 #
 ################################################################################
 
-BUBBLEWRAP_VERSION = 0.11.2
+BUBBLEWRAP_VERSION = 0.12.0
 BUBBLEWRAP_SITE = https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)
 BUBBLEWRAP_SOURCE = bubblewrap-$(BUBBLEWRAP_VERSION).tar.xz
 BUBBLEWRAP_DEPENDENCIES = host-pkgconf libcap
 
-BUBBLEWRAP_LICENSE = LGPL-2.0+
+BUBBLEWRAP_LICENSE = LGPL-2.1+
 BUBBLEWRAP_LICENSE_FILES = COPYING
 BUBBLEWRAP_CPE_ID_VENDOR = projectatomic
 
+define BUBBLEWRAP_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS)
+endef
+
 BUBBLEWRAP_CONF_OPTS = \
+	-Dassume_kernel=$(LINUX_VERSION_PROBED) \
 	-Dzsh_completion=disabled \
 	-Dman=disabled \
 	-Dpython=$(HOST_DIR)/bin/python \
-	-Drequire_userns=false \
-	-Dsupport_setuid=true \
 	-Dtests=false
 
 ifeq ($(BR2_PACKAGE_BASH_COMPLETION),y)
@@ -36,10 +39,4 @@ else
 BUBBLEWRAP_CONF_OPTS += -Dselinux=disabled
 endif
 
-# We need to mark bwrap as setuid, in case the kernel
-# has user namespaces disabled for non-root users.
-define BUBBLEWRAP_PERMISSIONS
-	/usr/bin/bwrap f 1755 0 0 - - - - -
-endef
-
 $(eval $(meson-package))
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

             reply	other threads:[~2026-09-10  9:52 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-10  9:52 Adrian Perez de Castro [this message]
2026-09-10 20:01 ` [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0 Julien Olivain via buildroot
2026-09-11  0:07   ` Adrian Perez de Castro
2026-09-11 13:32 ` Peter Korsgaard
2026-09-13 21:14   ` Adrian Perez de Castro

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260910095223.1597453-1-aperez@igalia.com \
    --to=aperez@igalia.com \
    --cc=buildroot@buildroot.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox