I just wanted to point out that after dropping setuid bit the package
description is now wrong.
"setuid wrapper for unprivileged chroot and namespace manipulation"
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
** Changed in: bubblewrap (Ubuntu)
Status: Triaged => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
[MIR] bubblewrap
To manage notifications about this bug go
I promoted it but then noticed that the bug status was not "fix
commited", security & MIR team seemed fine though so I guess it's only
an admin change for the bug at this point?
Override component to main
bubblewrap 0.3.1-1ubuntu2 in cosmic: universe/misc -> main
bubblewrap 0.3.1-1ubuntu2 in
setuid has been dropped now:
https://launchpad.net/ubuntu/+source/bubblewrap/0.3.1-1ubuntu1
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
[MIR] bubblewrap
To manage notifications
Ah ok thanks - sorry I somehow missed those details in comment 4 -
cheers.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
[MIR] bubblewrap
To manage notifications about this bug go
On Fri, Sep 14, 2018 at 01:46:05PM -, Jeremy Bicha wrote:
> Alex, the tests aren't run during the build because we can't test this
> kind of functionality in that environment. Please see comment 4.
>
> The tests are run as autopkgtests with the isolation-machine
> configuration.
Yes, that
Alex, the tests aren't run during the build because we can't test this
kind of functionality in that environment. Please see comment 4.
The tests are run as autopkgtests with the isolation-machine
configuration.
--
You received this bug notification because you are a member of Ubuntu
Bugs,
- 1 closed CVE in our CVE database CVE-2017-5226 (LP #1657357)
- Fixed in a timely fashion but by updating to a version which is not ideal
- Provides ability to launch other applications within a sandbox via (user)
namespaces and bind mounts etc.
- Build-Depends: libcap-dev, libselinux1-dev
-
** Changed in: bubblewrap (Ubuntu)
Assignee: Seth Arnold (seth-arnold) => Alex Murray (alexmurray)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
[MIR] bubblewrap
To manage
Ubuntu does enable unprivileged userns by default (at least on desktop
installs?), but there's at least one exception to watch out for: the
lightdm "guest session" option applies an AppArmor policy that allows
CLONE_NEWUSER but denies any use of the resulting capabilities; see also
To clarify I'm one of the upstream bubblewrap maintainers, if you have
any concerns don't hesitate to file an issue upstream, but we can chat
here too.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
> bubblewrap is setuid
Doesn't Ubuntu have unprivileged userns available, just like e.g.
Fedora? If so, then bwrap isn't setuid, and offers no more attack
surface than the kernel does to every process (that doesn't have access
to CLONE_NEWUSER denied via e.g. seccomp, as e.g. Docker does by
FYI, while this is currently assigned to Seth, I do want to note that
bubblewrap is setuid so it is going to require extra scrutiny
(incidentally this was not called out in this bug's description).
Regardless of the outcome of the bubblewrap review, the sandboxing
feature is highly desirable so
I'm coming up to speed on this issue now and have discussed this with
Jamie Bennett, the security team and various stakeholders to unblock
this MIR. The security team will prioritize this MIR for 18.10. Assuming
it passing review, I would encourage the Ubuntu Desktop team to SRU this
back to at
Nautilus 3.30 now requires bubblewrap for its thumbnail feature. I mean
we could disable it if we had to, but that doesn't seem like a great
idea.
Ubuntu 18.10 will still use Nautilus 3.26, but we intend to update
Nautilus for Ubuntu 19.04.
--
You received this bug notification because you are
(cleaning up ~ubuntu-release bugs)
I've seen other MIR bugs assigned to ~ubuntu-security instead of
~canonical-security - reassigning in case this helps move this MIR
forward. Please review.
Otherwise, at this point there's nothing for the release team to review.
If the MIR is approved with time
> I woudl split them in a separate package as they don't need to be
installed by default, but it's up to you.
Sorry, I am not willing to put this package through the Debian NEW queue
just to split out a few KB of examples into a separate binary package,
and I suspect the ftp team would take a dim
ok, my deb-src were still on artful for some reason… I woudl split them in a
separate package as they don't need to be installed by default, but it's up to
you.
Thanks for filing the bpf big and explaining the changes that happened in
bionic!
--
You received this bug notification because you
Please try to review the bionic version instead of the artful version ;)
Those files were moved to a patch and the patch should be able to be dropped in
the next upstream release:
The package looks good to me. I have some questions though:
There are some demos content in debian/dists.
Those are not shipped by any package and not used in autopkgtests (no reference
found in debian/tests). So why those are shipped? I'm not very found of finding
a binary as well in this one:
The current state on the corresponding Trello card
(https://trello.com/c/ZMkHCrQY/20-bubblewrap-mir) was that didrocks was
going to do an initial security review in November. But then Didier took
some time off (until end of year?) thus probably didn't have time to do
the review yet.
--
You
** Description changed:
Availability
Built for all supported architectures.
In sync with Debian.
Rationale
=
The gnome-desktop3 library 3.25.90+ requires bubblewrap. bubblewrap is most
commonly used as part of Flatpak's security isolation feature. Here
** Summary changed:
- FFe: [MIR] bubblewrap
+ [MIR] bubblewrap
** Description changed:
Availability
Built for all supported architectures.
In sync with Debian.
Rationale
=
- The gnome-desktop3 library 3.25.90 requires bubblewrap. bubblewrap is most
I am still feeling uncomfortable shipping some crucial GNOME components
like Nautilus more insecure than upstream.
An it is not just a matter of having bubblewrap in main or not. Not a
matter of the default and anybody who wishes the default upstream
security level could rectify this by “sudo apt
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: bubblewrap (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
An additional sandbox is probably rather a security win than a security
risk. It would be great if that could be MIRed before feature freeze.
GDK-pixbuf, Evince and other "thumbnailer users" seem to depend on that:
http://www.hadess.net/2017/07/security-for-security-gods-sandboxing.html
To quote
26 matches
Mail list logo
