Re: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0

[Adrian Perez de Castro <aperez@igalia.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1285 bytes --]

Hello Julien,

On Thu, 10 Sep 2026 22:01:38 +0200 Julien Olivain via buildroot <buildroot@buildroot.org> wrote:
> On 10/09/2026 11:52, Adrian Perez de Castro wrote:
> > Fixes a sandbox escape through symlink traversal tracked in
> > CVE-2026-87766, which affects all previous versions.
> > 
> > Using the bwrap binary with the setuid bit set is no longer supported
> > and user namespaces are now always required, so a kernel config fixup
> > is applied.
> > 
> > A new build option allows indicating the minimum kernel version that
> > will be used, which removes code used for backwards compatibility with
> > kernels older than 5.6.0 when a newer version is specified. Passing
> > $(LINUX_VERSION_PROBED) seems reasonable here.
> > 
> > This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
> > hence the updated hash.
> > 
> > Release notes:
> > 
> >   https://github.com/containers/bubblewrap/releases/tag/v0.12.0
> > 
> > Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
> 
> Applied to master, thanks. For info, I fixed the linux config fixup (no
> pun intended). The "_LINUX" was missing and the fixup was not applied. 
> See:
> https://gitlab.com/buildroot.org/buildroot/-/commit/4cb6193d2eca39b1bd79ff4867c842f507f692b8

Good catch, thanks!

—Adrián

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot