mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-01 06:21:56 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/bubblewrap: security bump to version 0.12.0

Browse Source 
Fixes a sandbox escape through symlink traversal tracked in
CVE-2026-87766, which affects all previous versions.

Using the bwrap binary with the setuid bit set is no longer supported
and user namespaces are now always required, so a kernel config fixup
is applied.

A new build option allows indicating the minimum kernel version that
will be used, which removes code used for backwards compatibility with
kernels older than 5.6.0 when a newer version is specified. Passing
$(LINUX_VERSION_PROBED) seems reasonable here.

This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
hence the updated hash.

Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.12.0

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[Julien: fix _LINUX_CONFIG_FIXUPS by adding the missing "_LINUX"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4cb6193d2e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Adrian Perez de Castro
2026-09-10 11:52:19 +02:00
committed by Thomas Perale
parent d578727aae
commit bc4357219a
2 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/bubblewrap/bubblewrap.hash
View File

@@ -1,5 +1,5 @@
# From https://github.com/containers/bubblewrap/releases/download/v0.11.2/bubblewrap-0.11.2.tar.xz.sha256sum
sha256 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6 bubblewrap-0.11.2.tar.xz
# From https://github.com/containers/bubblewrap/releases/download/v0.12.0/bubblewrap-0.12.0.tar.xz.sha256sum
sha256 9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314 bubblewrap-0.12.0.tar.xz
# Hash for license files:
sha256 b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c COPYING
sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING

17
package/bubblewrap/bubblewrap.mk
View File

@@ -4,21 +4,24 @@
#
################################################################################
BUBBLEWRAP_VERSION = 0.11.2
BUBBLEWRAP_VERSION = 0.12.0
BUBBLEWRAP_SITE = https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)
BUBBLEWRAP_SOURCE = bubblewrap-$(BUBBLEWRAP_VERSION).tar.xz
BUBBLEWRAP_DEPENDENCIES = host-pkgconf libcap
BUBBLEWRAP_LICENSE = LGPL-2.0+
BUBBLEWRAP_LICENSE = LGPL-2.1+
BUBBLEWRAP_LICENSE_FILES = COPYING
BUBBLEWRAP_CPE_ID_VENDOR = projectatomic
define BUBBLEWRAP_LINUX_CONFIG_FIXUPS
$(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS)
endef
BUBBLEWRAP_CONF_OPTS = \
-Dassume_kernel=$(LINUX_VERSION_PROBED) \
-Dzsh_completion=disabled \
-Dman=disabled \
-Dpython=$(HOST_DIR)/bin/python \
-Drequire_userns=false \
-Dsupport_setuid=true \
-Dtests=false
ifeq ($(BR2_PACKAGE_BASH_COMPLETION),y)
@@ -36,10 +39,4 @@ else
BUBBLEWRAP_CONF_OPTS += -Dselinux=disabled
endif
# We need to mark bwrap as setuid, in case the kernel
# has user namespaces disabled for non-root users.
define BUBBLEWRAP_PERMISSIONS
/usr/bin/bwrap f 1755 0 0 - - - - -
endef
$(eval $(meson-package))