From bc4357219a4974dd82987abae1dede95adf3e986 Mon Sep 17 00:00:00 2001 From: Adrian Perez de Castro Date: Thu, 10 Sep 2026 11:52:19 +0200 Subject: [PATCH] package/bubblewrap: security bump to version 0.12.0 Fixes a sandbox escape through symlink traversal tracked in CVE-2026-87766, which affects all previous versions. Using the bwrap binary with the setuid bit set is no longer supported and user namespaces are now always required, so a kernel config fixup is applied. A new build option allows indicating the minimum kernel version that will be used, which removes code used for backwards compatibility with kernels older than 5.6.0 when a newer version is specified. Passing $(LINUX_VERSION_PROBED) seems reasonable here. This version also changed the license from LGPL-2.0+ to LGPL-2.1+, hence the updated hash. Release notes: https://github.com/containers/bubblewrap/releases/tag/v0.12.0 Signed-off-by: Adrian Perez de Castro [Julien: fix _LINUX_CONFIG_FIXUPS by adding the missing "_LINUX"] Signed-off-by: Julien Olivain (cherry picked from commit 4cb6193d2eca39b1bd79ff4867c842f507f692b8) Signed-off-by: Thomas Perale --- package/bubblewrap/bubblewrap.hash | 6 +++--- package/bubblewrap/bubblewrap.mk | 17 +++++++---------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/package/bubblewrap/bubblewrap.hash b/package/bubblewrap/bubblewrap.hash index e87d3c81cb..e150e1495d 100644 --- a/package/bubblewrap/bubblewrap.hash +++ b/package/bubblewrap/bubblewrap.hash @@ -1,5 +1,5 @@ -# From https://github.com/containers/bubblewrap/releases/download/v0.11.2/bubblewrap-0.11.2.tar.xz.sha256sum -sha256 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6 bubblewrap-0.11.2.tar.xz +# From https://github.com/containers/bubblewrap/releases/download/v0.12.0/bubblewrap-0.12.0.tar.xz.sha256sum +sha256 9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314 bubblewrap-0.12.0.tar.xz # Hash for license files: -sha256 b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c COPYING +sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING diff --git a/package/bubblewrap/bubblewrap.mk b/package/bubblewrap/bubblewrap.mk index 7838ab90b3..cb31406c8f 100644 --- a/package/bubblewrap/bubblewrap.mk +++ b/package/bubblewrap/bubblewrap.mk @@ -4,21 +4,24 @@ # ################################################################################ -BUBBLEWRAP_VERSION = 0.11.2 +BUBBLEWRAP_VERSION = 0.12.0 BUBBLEWRAP_SITE = https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION) BUBBLEWRAP_SOURCE = bubblewrap-$(BUBBLEWRAP_VERSION).tar.xz BUBBLEWRAP_DEPENDENCIES = host-pkgconf libcap -BUBBLEWRAP_LICENSE = LGPL-2.0+ +BUBBLEWRAP_LICENSE = LGPL-2.1+ BUBBLEWRAP_LICENSE_FILES = COPYING BUBBLEWRAP_CPE_ID_VENDOR = projectatomic +define BUBBLEWRAP_LINUX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS) +endef + BUBBLEWRAP_CONF_OPTS = \ + -Dassume_kernel=$(LINUX_VERSION_PROBED) \ -Dzsh_completion=disabled \ -Dman=disabled \ -Dpython=$(HOST_DIR)/bin/python \ - -Drequire_userns=false \ - -Dsupport_setuid=true \ -Dtests=false ifeq ($(BR2_PACKAGE_BASH_COMPLETION),y) @@ -36,10 +39,4 @@ else BUBBLEWRAP_CONF_OPTS += -Dselinux=disabled endif -# We need to mark bwrap as setuid, in case the kernel -# has user namespaces disabled for non-root users. -define BUBBLEWRAP_PERMISSIONS - /usr/bin/bwrap f 1755 0 0 - - - - - -endef - $(eval $(meson-package))