On Wed, 26 Aug 2026 at 11:22:35 +0100, Simon McVittie wrote:
As previously discussed with the security team, fixing this in versions
older than 0.12.0 does not look feasible, so I'm going to prepare a
backport of 0.12.0 to stable.
Proposed package for trixie-security:
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/>
(debdiffs included, bubblewrap_0.12.0-1~deb13u1_debianonly.diff is
filtered to debian/ only)
A functionally equivalent test-build (differing only in the changelog)
is in
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/rc/>.
For the upstream changes, the easiest thing to review is likely to be:
git log -p --reverse --stat --ignore-space-change v0.11.0..v0.12.0
Some notes:
* commit ea185f6fb135782cabab342e33432e8482a2f5c9 "Inline the privileged
ops" is rather noisy, unfortunately, but we've been using a version with
that commit for a while in the Steam Runtime with no regressions
reported.
* In commit 67d4be103b18706b5b4e3f495daa35e89e47b163 "Import safe_openat()
from crun", as a result of -Dassume_kernel=5.10.0 we don't ever call
chroot_realpath(), and looking for "%s%s%s" in strings(1) output confirms
that it doesn't even get linked. This is good, because the
implementation of chroot_realpath() scares me (far too much strcat()).
We can confirm this with:
$ bwrap --dev-bind / / true
(exit 0, no output)
$ bwrap --debug-opt=force-openat-fallback --dev-bind / / true
bwrap: Can't open source /: Function not implemented
(--debug-opt=force-openat-fallback emulates a pre-5.6 kernel where
openat2() failed.)
If the security team is happy with this, there is a signed .changes in
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/bubblewrap_0.12.0-1~deb13u1_source.tar.gz.gpg>
(encrypted to the security team's key) which should be suitable for
upload to security-master, to save a round-trip from security team
approval to me uploading; or I can upload it myself if the team would
prefer that. I have also pushed the changes to
<https://salsa.debian.org/debian/bubblewrap/-/tree/debian/trixie-proposed?ref_type=heads>
and will copy that to the debian/trixie branch if accepted.
Thanks,
smcv
