Re: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0

From: Peter Korsgaard <peter@korsgaard.com>
To: Adrian Perez de Castro <aperez@igalia.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0
Date: Fri, 11 Sep 2026 15:32:48 +0200	[thread overview]
Message-ID: <87v78bewvz.fsf@dell.be.48ers.dk> (raw)
In-Reply-To: <20260910095223.1597453-1-aperez@igalia.com> (Adrian Perez de Castro's message of "Thu, 10 Sep 2026 11:52:19 +0200")

>>>>> "Adrian" == Adrian Perez de Castro <aperez@igalia.com> writes:

 > Fixes a sandbox escape through symlink traversal tracked in
 > CVE-2026-87766, which affects all previous versions.

 > Using the bwrap binary with the setuid bit set is no longer supported
 > and user namespaces are now always required, so a kernel config fixup
 > is applied.

 > A new build option allows indicating the minimum kernel version that
 > will be used, which removes code used for backwards compatibility with
 > kernels older than 5.6.0 when a newer version is specified. Passing
 > $(LINUX_VERSION_PROBED) seems reasonable here.

 > This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
 > hence the updated hash.

 > Release notes:

 >   https://github.com/containers/bubblewrap/releases/tag/v0.12.0

 > Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
 > ---
 >  package/bubblewrap/bubblewrap.hash |  6 +++---
 >  package/bubblewrap/bubblewrap.mk   | 17 +++++++----------
 >  2 files changed, 10 insertions(+), 13 deletions(-)

 > diff --git a/package/bubblewrap/bubblewrap.hash b/package/bubblewrap/bubblewrap.hash
 > index e87d3c81cb..e150e1495d 100644
 > --- a/package/bubblewrap/bubblewrap.hash
 > +++ b/package/bubblewrap/bubblewrap.hash
 > @@ -1,5 +1,5 @@
 > -# From https://github.com/containers/bubblewrap/releases/download/v0.11.2/bubblewrap-0.11.2.tar.xz.sha256sum
 > -sha256  69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6  bubblewrap-0.11.2.tar.xz
 > +# From https://github.com/containers/bubblewrap/releases/download/v0.12.0/bubblewrap-0.12.0.tar.xz.sha256sum
 > +sha256  9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314  bubblewrap-0.12.0.tar.xz

 >  # Hash for license files:
 > -sha256  b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c  COPYING
 > +sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING
 > diff --git a/package/bubblewrap/bubblewrap.mk b/package/bubblewrap/bubblewrap.mk
 > index 7838ab90b3..40a8148e14 100644
 > --- a/package/bubblewrap/bubblewrap.mk
 > +++ b/package/bubblewrap/bubblewrap.mk
 > @@ -4,21 +4,24 @@
 >  #
 >  ################################################################################

 > -BUBBLEWRAP_VERSION = 0.11.2
 > +BUBBLEWRAP_VERSION = 0.12.0
 >  BUBBLEWRAP_SITE = https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)
 >  BUBBLEWRAP_SOURCE = bubblewrap-$(BUBBLEWRAP_VERSION).tar.xz
 >  BUBBLEWRAP_DEPENDENCIES = host-pkgconf libcap

 > -BUBBLEWRAP_LICENSE = LGPL-2.0+
 > +BUBBLEWRAP_LICENSE = LGPL-2.1+
 >  BUBBLEWRAP_LICENSE_FILES = COPYING
 >  BUBBLEWRAP_CPE_ID_VENDOR = projectatomic

 > +define BUBBLEWRAP_CONFIG_FIXUPS
 > +	$(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS)
 > +endef
 > +
 >  BUBBLEWRAP_CONF_OPTS = \
 > +	-Dassume_kernel=$(LINUX_VERSION_PROBED) \

What happens if the config does not build a Linux kernel (then this
presumably expands to -Dassume_kernel=)?

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot