summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #554 from smcv/disable-userns-tests-rootHEADmainSimon McVittie2023-05-041-3/+12
|\ | | | | Fix test failure since #488 when running as uid 0
| * tests: Try harder to evade --disable-usernsSimon McVittie2023-02-231-0/+9
| | | | | | | | | | | | | | | | The worst-case scenario in terms of enforcing --disable-userns is that we're retaining all capabilities, so test that too, to make sure that the option is genuinely restricting even a privileged user. Signed-off-by: Simon McVittie <smcv@collabora.com>
| * tests: Explicitly unshare userns when testing --disable-usernsSimon McVittie2023-02-231-3/+3
| | | | | | | | | | | | | | | | | | If we're running the tests as uid 0 with capabilities, then bwrap will not create a new user namespace by default, which means the limit won't be exceeded and the test will fail. Make sure we always try to create the new user namespace. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | Merge pull request #559 from cgzones/compilerSimon McVittie2023-05-046-55/+50
|\ \ | | | | | | Fix various compiler warnings
| * | Declare file local variables staticChristian Göttsche2023-02-281-29/+29
| | | | | | | | | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
| * | Use mode_t as parameter type in mkdir_with_parentsChristian Göttsche2023-02-282-2/+2
| | | | | | | | | | | | | | | | | | | | | The parameter mode only usage is it being passed to ensure_dir(), which takes it as mode_t. Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
| * | Drop unnecessary cast to same typeChristian Göttsche2023-02-281-1/+1
| | | | | | | | | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
| * | Avoid implicit conversionsChristian Göttsche2023-02-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by running under pedantic UBSAN: ../bubblewrap.c:968:21: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'uid_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned) ../bubblewrap.c:1210:28: runtime error: implicit conversion from type 'int' of value -41 (32-bit, signed) to type 'unsigned int' changed the value to 4294967255 (32-bit, unsigned) ../bubblewrap.c:1215:28: runtime error: implicit conversion from type 'int' of value -41 (32-bit, signed) to type 'unsigned int' changed the value to 4294967255 (32-bit, unsigned) Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
| * | Enable and resolve sign comparisson warningsChristian Göttsche2023-02-285-20/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Comparisson of different signedness can result in unexpected results due to implicit conversions. ../network.c:81:34: warning: comparison of integer expressions of different signedness: ‘__u32’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare] 81 | if (rheader->nlmsg_seq != seq_nr) | ^~ ../network.c:83:34: warning: comparison of integer expressions of different signedness: ‘__u32’ {aka ‘unsigned int’} and ‘__pid_t’ {aka ‘int’} [-Wsign-compare] 83 | if (rheader->nlmsg_pid != getpid ()) | ^~ ../bind-mount.c:268:17: warning: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Wsign-compare] 268 | assert (i < n_lines); | ^ ../bind-mount.c:309:13: warning: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Wsign-compare] 309 | assert (i == n_lines); | ^~ ../bind-mount.c:318:17: warning: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Wsign-compare] 318 | for (i = 0; i < n_lines; i++) | ^ ../bind-mount.c:321:17: warning: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Wsign-compare] 321 | for (i = 0; i < n_lines; i++) | ^ ../utils.c:818:19: warning: comparison of integer expressions of different signedness: ‘size_t’ {aka ‘long unsigned int’} and ‘ssize_t’ {aka ‘long int’} [-Wsign-compare] 818 | while (size - 2 < n); | ^ ../bubblewrap.c:489:13: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare] 489 | assert (j < sizeof(dont_close)/sizeof(*dont_close)); | ^ ../bubblewrap.c:994:25: warning: comparison of integer expressions of different signedness: ‘int’ and ‘uid_t’ {aka ‘unsigned int’} [-Wsign-compare] 994 | if (setfsuid (-1) != real_uid) | ^~ ../bubblewrap.c:1042:61: warning: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Wsign-compare] 1042 | if (write (privileged_op_socket, buffer, buffer_size) != buffer_size) | ^~ ../bubblewrap.c:1232:25: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare] 1232 | for (i = 0; i < N_ELEMENTS (cover_proc_dirs); i++) | ^ ../bubblewrap.c:1260:25: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare] 1260 | for (i = 0; i < N_ELEMENTS (devnodes); i++) | ^ ../bubblewrap.c:1272:25: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare] 1272 | for (i = 0; i < N_ELEMENTS (stdionodes); i++) | ^ ../bubblewrap.c: In function ‘read_priv_sec_op’: ../bubblewrap.c:1556:15: warning: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘long unsigned int’ [-Wsign-compare] 1556 | if (rec_len < sizeof (PrivSepOp)) | ^ ../bubblewrap.c:1626:28: warning: comparison of integer expressions of different signedness: ‘int’ and ‘uint32_t’ {aka ‘unsigned int’} [-Wsign-compare] 1626 | if (*total_parsed_argc_p > MAX_ARGS) | ^ ../bubblewrap.c:1681:40: warning: comparison of integer expressions of different signedness: ‘int’ and ‘uint32_t’ {aka ‘unsigned int’} [-Wsign-compare] 1681 | if (*total_parsed_argc_p > MAX_ARGS) | ^ ../bubblewrap.c:2265:31: warning: comparison of integer expressions of different signedness: ‘uid_t’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare] 2265 | if (opt_sandbox_uid != -1) | ^~ ../bubblewrap.c:2285:31: warning: comparison of integer expressions of different signedness: ‘gid_t’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare] 2285 | if (opt_sandbox_gid != -1) | ^~ ../bubblewrap.c:2678:23: warning: comparison of integer expressions of different signedness: ‘uid_t’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare] 2678 | if (opt_sandbox_uid == -1) | ^~ ../bubblewrap.c:2680:23: warning: comparison of integer expressions of different signedness: ‘gid_t’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare] 2680 | if (opt_sandbox_gid == -1) | ^~ Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
* | | bwrap.xml: Get umbrella project back in syncSebastian Pipping2023-04-031-1/+1
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | bwrap.xml: Mention CVE-2017-5226 with --new-sessionSebastian Pipping2023-04-031-1/+3
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | bwrap.xml: Get product intro back in syncSebastian Pipping2023-04-031-1/+2
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | README.md: Mention --new-session in section "Sandboxing"Sebastian Pipping2023-04-031-0/+5
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | README.md: Add --new-session to usage exampleSebastian Pipping2023-04-031-0/+1
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | README.md: Improve readability of usage exampleSebastian Pipping2023-04-031-1/+7
| | | | | | | | | | | | Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
* | | README, SECURITY: Clarify that bubblewrap does not define a security modelSimon McVittie2023-03-302-2/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bubblewrap can provide a robust security boundary that severely limits functionality, or it can provide full functionality without any attempt at being a security boundary, or anything in between those extremes. If a caller of bubblewrap chooses inappropriate command-line arguments for their desired security model, then bubblewrap will not provide the security model they are aiming for, but this is not a bubblewrap vulnerability. Apparently this isn't clear to everyone, so try to clarify. The one place where bubblewrap *does* define some sort of security policy for itself is when it's setuid root, in which case it's responsible for preventing users from carrying out privilege escalation attacks like CVE-2020-5291. Resolves: https://github.com/containers/bubblewrap/issues/555 Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | Merge pull request #558 from cgzones/closeSimon McVittie2023-03-021-7/+1
|\ \ \ | | | | | | | | load_file_data: do not close fd on error to avoid double-close
| * | | load_file_data: do not close fd on error to avoid double-closeChristian Göttsche2023-03-011-7/+1
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | load_file_data() closes the passed file descriptor in case of an read(2) failure. The file descriptor is however owned by the caller and should not be closed to avoid a double-close. Since in this error branch NULL is always returned the only affected caller is load_file_data(), as all other callers immediately abort via die_with_error(). As bubblewrap is single-threaded the second close(2) in load_file_data() will be well-defined and fail with EBADF, leading to no unrelated file descriptor to be closed Found by GCC analyzer: ./utils.c: In function ‘load_file_at’: ./utils.c:630:3: warning: double ‘close’ of file descriptor ‘fd’ [CWE-1341] [-Wanalyzer-fd-double-close] 630 | close (fd); | ^~~~~~~~~~ ... | 596 | close (fd); | | ~~~~~~~~~~ | | | | | (15) first ‘close’ here ... | 630 | close (fd); | | ~~~~~~~~~~ | | | | | (20) second ‘close’ here; first ‘close’ was at (15) Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
* | | Merge pull request #562 from cgzones/cap_exampleSimon McVittie2023-03-021-1/+2
|\ \ \ | |/ / |/| | bwrap.1: mention example format of capability
| * | bwrap.1: mention example format of capabilityChristian Göttsche2023-03-021-1/+2
|/ / | | | | | | | | | | | | Mention how to format capabilities for --add-cap, e.g. CAP_DAC_READ_SEARCH instead of DAC_READ_SEARCH. Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
* | Prepare v0.8.0v0.8.0Simon McVittie2023-02-272-2/+2
|/ | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Merge pull request #550 from smcv/seccomp-einval-hintSimon McVittie2023-02-171-1/+9
|\ | | | | Attempt to clarify error message for missing CONFIG_SECCOMP_FILTER
| * Attempt to clarify error message for missing CONFIG_SECCOMP_FILTERSimon McVittie2023-01-231-1/+9
|/ | | | | | | | | | | | | | | | General-purpose desktop distributions are compiled with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER, but vendor kernels for phones and other assorted embedded devices don't necessarily enable these options. These kernels are unsuitable for running Flatpak, or anything else that relies on `bwrap --seccomp` or `bwrap --add-seccomp-fd`. Missing CONFIG_SECCOMP or CONFIG_SECCOMP_FILTER is not the *only* reason why we could get EINVAL here: I think we'd also get EINVAL if the seccomp program is syntatically invalid. However, it's a relatively likely reason, so it seems worth providing a hint. Helps: flatpak/flatpak#3069 Signed-off-by: Simon McVittie <smcv@collabora.com>
* test-run: Filter out no-new-privs in capsh outputSimon McVittie2023-01-041-2/+3
| | | | | | | | | | Older versions of capsh would only show the capabilities, which we expect not to change when we don't drop capabilities; but newer versions also display whether the NO_NEW_PRIVS bit is set, and we *do* expect to change that. Resolves: https://github.com/containers/bubblewrap/issues/544 Signed-off-by: Simon McVittie <smcv@collabora.com>
* Add --assert-userns-disabled optionSimon McVittie2023-01-035-9/+30
| | | | | | | | | | We can't combine --disable-userns with entering an existing user namespace via --userns if the existing user namespace was created with --disable-userns, because its ability to create nested user namespaces has already been disabled. However, the next best thing is to verify that we are already in the desired state. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Add an option to disable nested user namespaces by setting limit to 1Simon McVittie2023-01-035-7/+73
| | | | | | | | | | | | | | | | | | | Some use-cases of bubblewrap want to ensure that the subprocess can't further re-arrange the filesystem namespace, or do other more complex namespace modification. For example, Flatpak wants to prevent sandboxed processes from altering their /proc/$pid/root/.flatpak-info, so that /.flatpak-info can safely be used as an indicator that a process is part of a Flatpak app. This approach was suggested by lukts30 on containers/bubblewrap#452. The sysctl-controlled maximum numbers of namespaces are themselves namespaced, so we can disable nested user namespaces by setting the limit to 1 and then entering a new, nested user namespace. The resulting process loses its privileges in the namespace where the limit was set to 1, so it is unable to move the limit back up. Co-authored-by: Alexander Larsson <alexl@redhat.com> Signed-off-by: Simon McVittie <smcv@collabora.com>
* Merge pull request #539 from smcv/test-sizeSimon McVittie2022-11-211-21/+33
|\ | | | | Fix test failures in 0.7.0 on unusual platforms
| * test-run: Don't rely on df supporting the --output=size optionSimon McVittie2022-11-071-1/+6
| | | | | | | | | | | | | | | | | | | | | | df --output was new in coreutils 8.21 (2013), and non-GNU implementations like busybox df don't have it. This avoids a test failure in Steam Runtime 1 'scout', which is based on Ubuntu 12.04 (2012). It'll also be helpful for anyone maintaining an OS with non-GNU shell utilities. Signed-off-by: Simon McVittie <smcv@collabora.com>
| * test-run: If bubblewrap is setuid, assert that --size is not allowedSimon McVittie2022-11-071-21/+28
|/ | | | | | Previously, this test would have failed for a setuid bubblewrap. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare v0.7.0v0.7.0Simon McVittie2022-11-072-2/+2
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Fix copy/paste error in help for --pidnsSimon McVittie2022-10-271-1/+1
| | | | | | | | --pidns acts on a pid namespace, not a user namespace. Resolves: https://github.com/containers/bubblewrap/issues/531 Thanks: hadess Signed-off-by: Simon McVittie <smcv@collabora.com>
* Merge pull request #441 from smcv/as-ifSimon McVittie2022-10-271-16/+14
|\ | | | | build: Consistently use AS_IF instead of if/then/fi
| * build: Consistently use AS_IF instead of if/then/fiSimon McVittie2022-01-311-16/+14
| | | | | | | | | | | | | | | | | | | | | | AS_IF is best-practice for Autoconf, because it resolves conditional dependencies correctly; for example, if the first use of PKG_CHECK_MODULES is inside an if/then/fi block, then PKG_CHECK_PKG_CONFIG will also be conditional, but if the first use of PKG_CHECK_MODULES is inside AS_IF, then PKG_CHECK_PKG_CONFIG will be done unconditionally. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | Merge pull request #509 from tomsmeding/tmpfs-sizeSimon McVittie2022-10-265-41/+207
|\ \ | | | | | | Add --size option to control size of a --tmpfs
| * | --size: Update completions and documentationTom Smeding2022-10-263-2/+46
| | | | | | | | | | | | Signed-off-by: Tom Smeding <tom@tomsmeding.com>
| * | Tests for --size and --permsTom Smeding2022-10-261-1/+58
| | | | | | | | | | | | Signed-off-by: Tom Smeding <tom@tomsmeding.com>
| * | Add --size option to control size of a --tmpfsTom Smeding2022-10-261-18/+93
| | | | | | | | | | | | Signed-off-by: Tom Smeding <tom@tomsmeding.com>
| * | Prepare for multiple different modifier optionsTom Smeding2022-05-141-21/+11
| | | | | | | | | | | | Signed-off-by: Tom Smeding <tom@tomsmeding.com>
* | | Merge pull request #487 from smcv/better-enospc-messageSimon McVittie2022-10-031-0/+3
|\ \ \ | | | | | | | | Improve error message when clone() fails with ENOSPC
| * | | Improve error message when clone() fails with ENOSPCSimon McVittie2022-03-221-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | In particular, this would have given #371 a clearer error message. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | | Merge pull request #527 from a1346054/fixesSimon McVittie2022-09-131-1/+1
|\ \ \ \ | | | | | | | | | | test-run: replace nonstandard `which`
| * | | | test-run: replace nonstandard `which`a13460542022-09-121-1/+1
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | `command -v` is the standardized replacement for `which` and never writes to stderr Signed-off-by: a1346054 <36859588+a1346054@users.noreply.github.com>
* | | | bind-mount: Include failing path in error messageSimon McVittie2022-08-163-26/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prompted by flatpak/flatpak#4731, in which a misconfigured SMB automount was failing to be remounted with ENODEV. This would have been easier to debug if we knew which path could not be remounted. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | | Merge pull request #510 from smcv/etc-shadowSimon McVittie2022-07-261-1/+8
|\ \ \ \ | | | | | | | | | | Adjust tests related to /etc/shadow
| * | | | test-run: Add another assertion that we cannot read /etc/shadowSimon McVittie2022-05-111-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The goal of this assertion was to demonstrate that a setuid bwrap does not give us access to otherwise unreadable files, but if we want to check that, we should probably be looking at the bind-mount destination instead of the source file. Leave the old assertion in too, just in case *that* fails. Signed-off-by: Simon McVittie <smcv@collabora.com>
| * | | | test-run: Skip a test if we can read /etc/shadowSimon McVittie2022-05-111-1/+2
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ordinarily, we would not be able to read /etc/shadow if we're not uid 0; but when building in a sysroot owned by the current user (for example by setting it up using bwrap, as steam-runtime-tools does), we might actually be able to read it. Skip the assertion that we cannot read it in this case. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | | meson: Add options to set a RPATH/RUNPATH on the bwrap executableSimon McVittie2022-05-165-0/+40
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful when building a self-contained, relocatable tree containing a build of bubblewrap and all of its non-glibc dependencies (in practice this means libcap and maybe libselinux), as is done in the Steam container runtime. A RPATH/RUNPATH pointing to ${ORIGIN}/../lib allows bwrap to find an adjacent, bundled copy of libcap. Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | Release v0.6.2v0.6.2Simon McVittie2022-05-112-2/+2
| | | | | | | | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* | | Merge pull request #486 from smcv/unusedSimon McVittie2022-05-112-5/+5
|\ \ \ | | | | | | | | Annotate some variables as sometimes-unused
| * | | utils: Silence -Wunused-parameter with clang, Meson, and SELinux disabledSimon McVittie2022-04-051-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | These parameters are unused if SELinux happens to be disabled. Signed-off-by: Simon McVittie <smcv@collabora.com>
View Lorry Controller Status