A new version of the toolkit for organizing isolated environments, Bubblewrap 0.12, has been published. Bubblewrap is utilized to restrict individual applications of unprivileged users and is commonly employed by the Flatpak project to isolate applications launched from packages. The technology leverages traditional Linux container virtualization tools, including cgroups, namespaces, Seccomp, and SELinux. The project is coded in C and licensed under LGPLv2.1+.
File system isolation is accomplished by default through the creation of a new mount namespace where an empty root partition is generated using tmpfs. Additional FS partitions can be attached in the “mount –bind” mode as needed. Network access is limited to the loopback interface with network stack isolation through CLONE_NEWNET and CLONE_NEWUTS flags.
To exclude unnecessary user and process identifiers from the isolated environment, CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be employed, along with the PR_SET_NO_NEW_PRIVS mode. The “user namespace” is used to acquire required privileges.
In the latest release of Bubblewrap:
- The code license has been updated from LGPL 2.0+ to LGPL 2.1+.
- Support for building an executable file that gains additional privileges using the suid root flag has been discontinued. The presence of “user namespace” support in the system is now mandatory due to easier maintenance against the prevalence of “user namespace” support in distribution kits.
- The “–not-a-security-boundary” option has been added to prevent abnormal terminations in case of failures during setup of an isolated sandbox environment, such as remounting a subkey.
- The “assume_kernel” assembly option has been introduced to disable reverse compatibility with Linux kernels older than the specified version. For example, specifying versions 5.6.0+ will exclude alternative implementation of the functionality “openat2(RESOLVE_IN_ROOT)”.