debdiff *.dsc | filterdiff -p1 -i 'debian/*' >| bubblewrap_0.12.0-1~deb13u1_debianonly.diff diff -Nru bubblewrap-0.11.0/debian/changelog bubblewrap-0.12.0/debian/changelog --- bubblewrap-0.11.0/debian/changelog 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/changelog 2026-08-26 12:04:21.000000000 +0100 @@ -1,3 +1,70 @@ +bubblewrap (0.12.0-1~deb13u1) trixie-security; urgency=high + + * Merge new upstream release from unstable + - Prevent sandbox escape via symlink traversal. + If an app framework such as Flatpak mounts subdirectories into a + directory controlled by the sandboxed app, a malicious or compromised + sandboxed app could create symlinks in that directory to arrange for + files/directories to be created on the host system. + (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655) + - bubblewrap no longer supports running when setuid, matching the + upstream default. This ensures that vulnerabilities similar to + CVE-2026-41163 can't happen in future. + * Debian 13 backport changes: + - d/control, d/gbp.conf: Branch for Debian 13 stable updates + - Revert packaging changes that are not appropriate for a stable release + * Packaging changes since 0.11.0-2+deb13u1: + - d/rules: Stop passing -Dsupport_setuid=false. + The option no longer exists, and the new version of bubblewrap always + behaves as though its value was false. + - d/rules: Don't compile fallback code paths for kernel older than 5.10. + This ensures that we're using the safest available mechanisms, + using the openat2() syscall rather than emulating it in user-space. + As a result, this version will not work on kernels older than the + one found in Debian 11. + - d/rules: Install NEWS.md as the upstream changelog + - d/p/CVE-2026-41163/: + Drop patches, no longer needed/applicable with the new upstream release + - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch: + Adjust patch to apply to the new upstream release + - d/README.Debian: Rewrite to reflect that setuid is no longer supported + - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream + + -- Simon McVittie Wed, 26 Aug 2026 12:04:21 +0100 + +bubblewrap (0.12.0-1) unstable; urgency=high + + * New upstream release + - Prevent sandbox escape via symlink traversal. + If an app framework such as Flatpak mounts subdirectories into a + directory controlled by the sandboxed app, a malicious or compromised + sandboxed app could create symlinks in that directory to arrange for + files/directories to be created on the host system. + (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655) + - d/rules: Stop passing -Dsupport_setuid=false. + The option no longer exists, and the new version of bubblewrap always + behaves as though its value was false. + - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream + - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch: + Adjust patch to apply to the new upstream release + * d/rules: Don't compile fallback code paths for kernel older than 5.10. + This ensures that we're using the safest available mechanisms, + using the openat2() syscall rather than emulating it in user-space. + As a result, this version will not work on kernels older than the + one found in Debian 11. + + -- Simon McVittie Wed, 26 Aug 2026 11:32:16 +0100 + +bubblewrap (0.11.2-2) unstable; urgency=medium + + * d/rules: Stop allowing bubblewrap to run when setuid, matching + the upstream default. This ensures that vulnerabilities similar to + CVE-2026-41163 can't happen in future. + * d/control, d/NEWS, d/README.Debian: Update documentation accordingly + * Standards-Version: 4.7.4 (no changes required) + + -- Simon McVittie Tue, 12 May 2026 18:57:32 +0100 + bubblewrap (0.11.0-2+deb13u1) trixie; urgency=medium * d/control, d/gbp.conf: Branch for Debian 13 stable updates @@ -14,6 +81,51 @@ -- Simon McVittie Sun, 26 Apr 2026 14:05:43 +0100 +bubblewrap (0.11.2-1) unstable; urgency=medium + + * New upstream release + - Fixes a root privilege escalation vulnerability if bwrap has been + made setuid root locally (CVE-2026-41163, Closes: #1134704). + Most Debian systems have a non-setuid bubblewrap and therefore + are unaffected by this. + * d/rules: Temporarily allow bubblewrap to be setuid root. + This configuration is a security risk and rarely necessary, so the + option is deprecated, and a future upstream version will + unconditionally refuse to run if it detects that it has been run + setuid root. + * d/README.Debian: Update to reflect deprecation of setuid-root bwrap + * d/NEWS: Mention deprecation of setuid-root mode + + -- Simon McVittie Thu, 23 Apr 2026 12:25:34 +0100 + +bubblewrap (0.11.1-1) unstable; urgency=medium + + * New upstream release + * Stop overriding kernel.unprivileged_userns_clone sysctl. + The setting we use has been the default for several years. + * d/control: Remove Recommends on procps. + This was only needed as a way to force the required value of + kernel.unprivileged_userns_clone during the transition from Debian 10 + to 11, and even then, only on non-systemd systems. + * d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch: + Refresh patch to apply after a grammatical fix upstream + * d/control: Replace transitional libselinux1-dev with libselinux-dev + * d/control: Bump Standards-Version to 4.7.3. + Remove Priority: optional, no longer required with current dpkg-dev. + * d/copyright: Stop quoting the FSF's former postal address + * d/rules: Stop overriding build system. + This was only necessary while bubblewrap supported both Meson and + Autotools builds, which it hasn't since 0.11.0. + * d/clean: Remove another Autotools remnant + * d/rules: Install NEWS.md as the upstream changelog + * Stop using debhelper's historical special case for a single binary + package. Explicitly list what we intend to install, instead. + * d/watch: Update to v5 format + * d/README.Debian: Mention glycin as a prominent use of bubblewrap + * d/README.Debian: Reduce focus on pre-Debian-10 kernels + + -- Simon McVittie Sat, 21 Mar 2026 18:52:56 +0000 + bubblewrap (0.11.0-2) unstable; urgency=medium [ Helmut Grohne ] diff -Nru bubblewrap-0.11.0/debian/control bubblewrap-0.12.0/debian/control --- bubblewrap-0.11.0/debian/control 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/control 2026-08-26 12:04:21.000000000 +0100 @@ -41,9 +41,5 @@ or to run programs in a different library stack such as a Flatpak runtime or a different Debian release. . - By default, this package relies on a kernel with user namespaces enabled. + This package relies on a kernel with user namespaces enabled. Official Debian and Ubuntu kernels are suitable. - . - On kernels without user namespaces, system administrators can make the - bwrap executable setuid root, allowing it to create unprivileged - containers even though ordinary user processes cannot. diff -Nru bubblewrap-0.11.0/debian/copyright bubblewrap-0.12.0/debian/copyright --- bubblewrap-0.11.0/debian/copyright 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/copyright 2026-08-26 12:04:21.000000000 +0100 @@ -7,7 +7,7 @@ 2016 Alexander Larsson 2021 Simon McVittie 2022 Collabora Ltd. -License: LGPL-2+ +License: LGPL-2.1+ Files: bubblewrap.jpg Copyright: none @@ -19,7 +19,7 @@ 2016 Laszlo Boszormenyi (GCS) 2016-2024 Simon McVittie 2016-2024 Collabora Ltd. -License: LGPL-2+ +License: LGPL-2+ and LGPL-2.1+ License: LGPL-2+ This library is free software; you can redistribute it and/or @@ -32,10 +32,19 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public License for more details. . - You should have received a copy of the GNU Library General Public - License along with this library; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 - USA. - . On Debian systems, the full text of the GNU Library General Public License version 2 can be found in the file `/usr/share/common-licenses/LGPL-2'. + +License: LGPL-2.1+ + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + . + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + . + On Debian systems, the full text of the GNU Lesser General Public License + version 2.1 can be found in the file `/usr/share/common-licenses/LGPL-2.1'. diff -Nru bubblewrap-0.11.0/debian/NEWS bubblewrap-0.12.0/debian/NEWS --- bubblewrap-0.11.0/debian/NEWS 1970-01-01 01:00:00.000000000 +0100 +++ bubblewrap-0.12.0/debian/NEWS 2026-08-26 12:04:21.000000000 +0100 @@ -0,0 +1,15 @@ +bubblewrap (0.11.2-2) unstable; urgency=medium + + Historically, bubblewrap was sometimes installed setuid root. + This is unnecessary on Debian kernels since Debian 11, and no longer + supported by upstream. + + As a safety mechanism against possible root privilege escalation + vulnerabilities, this version of bubblewrap will no longer run if it + is detected to be setuid root. + + If bubblewrap has been made setuid root via dpkg-statoverride, please remove + that setting, and instead leave it unprivileged. + See file:///usr/share/doc/bubblewrap/README.Debian.gz for more details. + + -- Simon McVittie Tue, 12 May 2026 18:57:32 +0100 diff -Nru bubblewrap-0.11.0/debian/patches/CVE-2026-41163/Don-t-run-the-privilege-separated-code-dumpable.patch bubblewrap-0.12.0/debian/patches/CVE-2026-41163/Don-t-run-the-privilege-separated-code-dumpable.patch --- bubblewrap-0.11.0/debian/patches/CVE-2026-41163/Don-t-run-the-privilege-separated-code-dumpable.patch 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/patches/CVE-2026-41163/Don-t-run-the-privilege-separated-code-dumpable.patch 1970-01-01 01:00:00.000000000 +0100 @@ -1,89 +0,0 @@ -From: Alexander Larsson -Date: Tue, 14 Apr 2026 11:46:12 +0200 -Subject: Don't run the privilege separated code dumpable -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 8bit - -If the unprivileged code is dumpable, then it can be attached to with -ptrace and execute arbitrary requests to the privileged part of the -setup. In some cases this allows privilege escalation, such as using -overlay mounts which would otherwise not be allowed in setuid mode. - -Note: We still make the monitor process and the main child process -dumpable, because otherwise the owner of /proc/self is root which -makes these processed not able to use features that are needed for -e.g. detarmining portal access. - -Initially reported by François Diakhate - -Signed-off-by: Alexander Larsson -Origin: upstream, 0.11.2, commit:10ed62f34a4565188887b06df1438ef8002c3c80 -Bug: https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp -Bug-CVE: CVE-2026-41163 -Bug-Debian: https://bugs.debian.org/1134704 ---- - bubblewrap.c | 22 ++++++++++++++-------- - 1 file changed, 14 insertions(+), 8 deletions(-) - -diff --git a/bubblewrap.c b/bubblewrap.c -index f8728c7..0d8d54d 100644 ---- a/bubblewrap.c -+++ b/bubblewrap.c -@@ -937,7 +937,8 @@ switch_to_user_with_privs (void) - /* Call setuid() and use capset() to adjust capabilities */ - static void - drop_privs (bool keep_requested_caps, -- bool already_changed_uid) -+ bool already_changed_uid, -+ bool set_dumpable) - { - assert (!keep_requested_caps || !is_privileged); - /* Drop root uid */ -@@ -947,9 +948,12 @@ drop_privs (bool keep_requested_caps, - - drop_all_caps (keep_requested_caps); - -- /* We don't have any privs now, so mark us dumpable which makes /proc/self be owned by the user instead of root */ -- if (prctl (PR_SET_DUMPABLE, 1, 0, 0, 0) != 0) -- die_with_error ("can't set dumpable"); -+ if (set_dumpable) -+ { -+ /* We don't have any privs now, so mark us dumpable which makes /proc/self be owned by the user instead of root */ -+ if (prctl (PR_SET_DUMPABLE, 1, 0, 0, 0) != 0) -+ die_with_error ("can't set dumpable"); -+ } - } - - static void -@@ -3175,7 +3179,7 @@ main (int argc, - die_with_error ("Setting userns2 failed"); - - /* We don't need any privileges in the launcher, drop them immediately. */ -- drop_privs (false, false); -+ drop_privs (false, false, true); - - /* Optionally bind our lifecycle to that of the parent */ - handle_die_with_parent (); -@@ -3362,8 +3366,10 @@ main (int argc, - - if (child == 0) - { -- /* Unprivileged setup process */ -- drop_privs (false, true); -+ /* Unprivileged setup process. -+ * Note: Don't set dumpable, because we can still perform privileged -+ * operations via privileged_op(). */ -+ drop_privs (false, true, false); - close (privsep_sockets[0]); - setup_newroot (opt_unshare_pid, privsep_sockets[1]); - exit (0); -@@ -3492,7 +3498,7 @@ main (int argc, - } - - /* All privileged ops are done now, so drop caps we don't need */ -- drop_privs (!is_privileged, true); -+ drop_privs (!is_privileged, true, true); - - if (opt_block_fd != -1) - { diff -Nru bubblewrap-0.11.0/debian/patches/CVE-2026-41163/fix-harden-privsep-parent-against-unexpected-operations.patch bubblewrap-0.12.0/debian/patches/CVE-2026-41163/fix-harden-privsep-parent-against-unexpected-operations.patch --- bubblewrap-0.11.0/debian/patches/CVE-2026-41163/fix-harden-privsep-parent-against-unexpected-operations.patch 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/patches/CVE-2026-41163/fix-harden-privsep-parent-against-unexpected-operations.patch 1970-01-01 01:00:00.000000000 +0100 @@ -1,36 +0,0 @@ -From: =?utf-8?q?Fran=C3=A7ois_Diakhat=C3=A9?= -Date: Thu, 9 Apr 2026 18:17:33 +0000 -Subject: fix: harden privsep parent against unexpected operations - -Origin: upstream, 0.11.2, commit:9e16c35582af7704958dd2b2ec3cba524c9605b6 -Bug: https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp -Bug-CVE: CVE-2026-41163 -Bug-Debian: https://bugs.debian.org/1134704 ---- - bubblewrap.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/bubblewrap.c b/bubblewrap.c -index 0d8d54d..42efe2a 100644 ---- a/bubblewrap.c -+++ b/bubblewrap.c -@@ -1158,7 +1158,9 @@ privileged_op (int privileged_op_socket, - break; - - case PRIV_SEP_OP_OVERLAY_MOUNT: -- if (mount ("overlay", arg2, "overlay", MS_MGC_VAL, arg1) != 0) -+ if (is_privileged) -+ die ("Overlay mounts are not supported in setuid mode"); -+ if (mount ("overlay", arg2, "overlay", MS_MGC_VAL | MS_NOSUID | MS_NODEV, arg1) != 0) - { - /* The standard message for ELOOP, "Too many levels of symbolic - * links", is not helpful here. */ -@@ -1176,6 +1178,8 @@ privileged_op (int privileged_op_socket, - something manages to send hacked priv-sep operation requests. */ - if (!opt_unshare_uts) - die ("Refusing to set hostname in original namespace"); -+ if (arg1 == NULL) -+ die ("Hostname argument is NULL"); - if (sethostname (arg1, strlen(arg1)) != 0) - die_with_error ("Can't set hostname to %s", arg1); - break; diff -Nru bubblewrap-0.11.0/debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch bubblewrap-0.12.0/debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch --- bubblewrap-0.11.0/debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch 2026-08-26 12:04:21.000000000 +0100 @@ -8,15 +8,15 @@ 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bubblewrap.c b/bubblewrap.c -index 42efe2a..3e48d26 100644 +index 9192550..d3f17af 100644 --- a/bubblewrap.c +++ b/bubblewrap.c -@@ -3136,7 +3136,7 @@ main (int argc, +@@ -3080,7 +3080,7 @@ main (int argc, if (errno == EINVAL) - die ("Creating new namespace failed, likely because the kernel does not support user namespaces. bwrap must be installed setuid on such systems."); - else if (errno == EPERM && !is_privileged) -- die ("No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'."); -+ die ("No permissions to create new namespace, likely because the kernel does not allow non-privileged user namespaces. See or ."); + die ("Creating new namespace failed, likely because the kernel does not support user namespaces."); + else if (errno == EPERM) +- die ("No permissions to create a new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'."); ++ die ("No permissions to create a new namespace, likely because the kernel does not allow non-privileged user namespaces. See or ."); } if (errno == ENOSPC) diff -Nru bubblewrap-0.11.0/debian/patches/series bubblewrap-0.12.0/debian/patches/series --- bubblewrap-0.11.0/debian/patches/series 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/patches/series 2026-08-26 12:04:21.000000000 +0100 @@ -1,3 +1 @@ -CVE-2026-41163/Don-t-run-the-privilege-separated-code-dumpable.patch -CVE-2026-41163/fix-harden-privsep-parent-against-unexpected-operations.patch debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch diff -Nru bubblewrap-0.11.0/debian/README.Debian bubblewrap-0.12.0/debian/README.Debian --- bubblewrap-0.11.0/debian/README.Debian 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/README.Debian 2026-08-26 12:04:21.000000000 +0100 @@ -8,7 +8,7 @@ - Flatpak uses bubblewrap to run partially-trusted, user-installable apps in a sandboxed environment. -- libgnome-desktop uses bubblewrap to run thumbnailers in a sandboxed +- The glycin library uses bubblewrap to run image loaders in a sandboxed environment, so that if there are security flaws in an image decoder used by a thumbnailer, the process of generating thumbnails for a maliciously crafted image cannot be used to attack the rest of the @@ -24,47 +24,14 @@ - Steam uses bubblewrap to run some games with a predictable library stack that does not match the rest of the system. -The necessary capabilities to do this can be obtained in one of two -ways: - -- On kernels where unprivileged users can create new user namespaces, - bubblewrap's bwrap executable can be an ordinary unprivileged program. - -- On kernels where this is not possible, bubblewrap will not work unless - the /usr/bin/bwrap executable is setuid root. Some bubblewrap and Flatpak - features will not work in this configuration for security reasons. - -Newer Debian kernels (Linux 5.10 and newer; Debian 11 and newer) ----------------------------------------------------------------- - -Debian kernels since 5.10 allow unprivileged users to create new user -namespaces. The bwrap executable can be made non-setuid on these kernels. - -By default, the bubblewrap package in Debian no longer installs a setuid -root /usr/bin/bwrap executable. - -Ubuntu kernels (Ubuntu 18.04 and newer) ---------------------------------------- - -Ubuntu kernels also allow unprivileged users to create new user -namespaces. The bwrap executable can be made non-setuid on these kernels, -and the Ubuntu bubblewrap package does not install a setuid executable. - -Older Debian kernels (Linux 5.9 and older; Debian 10 and older) ---------------------------------------------------------------- - -Debian kernels older than 5.10 have support for user namespaces, but -that feature is disabled by default to reduce the kernel's attack -surface. - -The bubblewrap package contains configuration in -/usr/lib/sysctl.d/50-bubblewrap.conf to enable user namespaces -(see "Enabling kernel.unprivileged_userns_clone", below). - -If this is not desired, system administrators can copy that file -to /etc/sysctl.d/50-bubblewrap.conf and modify it to disable unprivileged -creation of user namespaces, then make bubblewrap setuid root so that it -still works as intended (see "Making bubblewrap setuid root", below). +To achieve this, the kernel must support user namespaces, and allow +ordinary unprivileged processes to create a new user namespace. +This is the case by default on all modern versions of Debian and Ubuntu. + +Historically, the bubblewrap executable was sometimes setuid root, +which allowed it to create user namespaces even if unprivileged processes +are not able to do so. This was deprecated because it is a security risk, +and is no longer possible. Custom and third-party kernels ------------------------------ @@ -82,35 +49,30 @@ This Debian-specific sysctl parameter controls whether unprivileged users are allowed to create new user namespaces. +The default is 1 for all modern Debian and Ubuntu kernels. + If it is set to 0, some attacks against the kernel are made more difficult, -which can increase security. However, some user-space software will not -be able to create a sandboxed environment or will have to rely on a -setuid version of bubblewrap to create a sandboxed environment, which -reduces security. The value of this sysctl parameter is a trade-off -between different security risks. - -If this parameter is set to 0, bubblewrap and Flatpak will not work unless -bwrap is made setuid root (see "Making bubblewrap setuid root" below). - -The default is 1 for Debian kernels that are version 5.10 or newer, -1 for Ubuntu kernels, or 0 for older Debian kernels. The bubblewrap -package contains configuration in /usr/lib/sysctl.d/50-bubblewrap.conf -to set this parameter to 1 during system startup. - -If this is not desired, system administrators can copy -/usr/lib/sysctl.d/50-bubblewrap.conf to /etc/sysctl.d/50-bubblewrap.conf -and modify it to disable unprivileged creation of user namespaces, then -make bubblewrap setuid root so that it still works as intended (see -"Making bubblewrap setuid root", below). +which can increase security. However, user-space software like bubblewrap +and web browsers will not be able to create a sandboxed environment. +The value of this sysctl parameter is a trade-off between different +security risks. + +If this parameter is set to 0, bubblewrap and Flatpak will not work. You can view the current setting with: cat /proc/sys/kernel/unprivileged_userns_clone -and temporarily set it to 1 (until the next reboot) with: +and temporarily set it to 0 or 1 (until the next reboot) with a command +like: sudo sysctl -w kernel.unprivileged_userns_clone=1 +It can be set permanently by using a file /etc/sysctl.d/*.conf: +this requires either systemd as pid 1, or the procps package. +For details please see sysctl.d(5) on systemd systems, or sysctl.conf(5) +on systems using a non-default init. + Configuring the maximum number of namespaces per user ----------------------------------------------------- @@ -118,9 +80,8 @@ depends on the amount of RAM available. Setting this limit to 0 is the recommended way to disable user namespace -creation if this is required as a security hardening measure. bubblewrap -will not work with this limit set to 0, unless it is setuid root (see -"Configuring whether bubblewrap is setuid root" below). +creation if this is required as a security hardening measure. However, +bubblewrap will not work with this limit set to 0. The limit is given by the user.max_user_namespaces sysctl parameter. @@ -141,32 +102,22 @@ Configuring whether bubblewrap is setuid root --------------------------------------------- -To use bubblewrap with kernel.unprivileged_userns_clone set to 0 -or user.max_user_namespaces set to 0, it is necessary to make the bwrap -executable setuid root. This gives it the necessary capabilities to set -up containers even when run by an otherwise unprivileged user, and is the -configuration normally used in Debian 10. - -This can be a security risk: if there are bugs in bubblewrap, it might be -possible for an unprivileged user to get root privileges by running a -setuid version of the bwrap executable. CVE-2020-5291 and CVE-2016-8659 -are examples of bugs that had this effect in the past. However, it allows -the kernel to be configured to disallow creation of user namespaces by -unprivileged users, which prevents attacks like CVE-2016-3135 from being -carried out against the kernel. This is a trade-off between different -security risks. +To use bubblewrap with kernel.unprivileged_userns_clone set to 0 or +user.max_user_namespaces set to 0, historically some systems made the bwrap +executable setuid root. This led to a risk of root privilege escalation +security vulnerabilities such as CVE-2026-41163, CVE-2020-5291 +and CVE-2016-8659, and as a result this configuration has been disabled. + +If it is setuid root, bubblewrap will now fail with this error message: -To avoid other attacks, some Flatpak and bubblewrap features are not -available when bwrap is setuid root, and the absence of those features -is known to break some Flatpak apps. For example, the Flatpak app for -the Chromium web browser will not work with a setuid bwrap executable. + bwrap: setuid use of bubblewrap is not supported To check whether the bwrap executable will be made setuid root after the next upgrade, use this command: dpkg-statoverride --list /usr/bin/bwrap -To force the bwrap executable to be setuid root, use these commands: +and to remove any permissions overrides that it might have: sudo dpkg-statoverride --quiet --remove /usr/bin/bwrap - sudo dpkg-statoverride --update --add root root 4755 /usr/bin/bwrap + sudo chmod 0755 /usr/bin/bwrap diff -Nru bubblewrap-0.11.0/debian/rules bubblewrap-0.12.0/debian/rules --- bubblewrap-0.11.0/debian/rules 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/rules 2026-08-26 12:04:21.000000000 +0100 @@ -14,6 +14,7 @@ override_dh_auto_configure: dh_auto_configure \ -- \ + -Dassume_kernel=5.10.0 \ -Dzsh_completion_dir=/usr/share/zsh/vendor-completions \ ${NULL} .PHONY: override_dh_auto_configure @@ -25,3 +26,6 @@ env -u LD_PRELOAD dh_auto_test .PHONY: override_dh_auto_test + +override_dh_installchangelogs: + dh_installchangelogs NEWS.md diff -Nru bubblewrap-0.11.0/debian/salsa-ci.yml bubblewrap-0.12.0/debian/salsa-ci.yml --- bubblewrap-0.11.0/debian/salsa-ci.yml 2026-04-26 14:05:43.000000000 +0100 +++ bubblewrap-0.12.0/debian/salsa-ci.yml 2026-08-26 12:04:21.000000000 +0100 @@ -1,5 +1,12 @@ +--- include: - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml variables: + # This package is Architecture: linux-any so the default build job is enough + SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 1 + SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 1 + + SALSA_CI_DISABLE_CROSSBUILD_ARM64: 0 + SALSA_CI_IGNORED_BRANCHES: '/^(ppa|ubuntu)\//'