bubblewrap

bubblewrap copied to clipboard

Add --disable-userns switch

5

Some usecases of bubblewrap want to ensure that the subprocess can't further re-arrange the filesystem namespace, or do other more complex namespace modification. This can be limited by --disable-userns, which...

alexlarsson

Support for user and group ID mappings

15

Add options `--uid-map` and `--gid-map` to map multiple users between child and parent namespace: `bwrap --uid-map ' ...' ...` Relying on shadow `newuidmap` utility, or implementing the same whitelisting logic...

dgerber

Bind mounting over symlinks attempts to create their targets and bind mount over them

16

### What I observe: ``` $ touch a_file $ ln -s a_file rel_symlink $ bwrap --bind / / --bind a_file $PWD/rel_symlink /usr/bin/env ls -l $PWD/rel_symlink lrwxrwxrwx 1 robryk users 6...

robryk

how to bind to privileged port?

6

excuse my ignorance, i spent quite some time using search engines and i could not find an answer. is it somehow possible to wrap a program that binds to a...

stef

Found by a static analyzer. ``` bubblewrap-0.4.1/bubblewrap.c:1500: overwrite_var: Overwriting "opt_args_data" in "opt_args_data = load_file_data(the_fd, &data_len)" leaks the storage that "opt_args_data" points to. # 1498| * keep allocated until exit time,...

cgwalters

bwrap: Implement ability to switch AppArmor profiles

2

Bubblewrap is currently hard to use in combination with AppArmor profiles. The root cause of this is that it sets the NO_NEW_PRIVS flag quite early in the process, and if...

pks-t

[bubblewrap] Propagate SIGTERM and SIGINT to child

5

I'm proposing this commit to address https://github.com/containers/bubblewrap/issues/369. Instead of the default termination when receiving SIGINT or SIGTERM, this change propagates SIGINT and SIGTERM from the parent to the child.

earlchew

Prettify demo script

5

Added spaces to make the trailing line-continuation slashes all line up in the same column. Also moved a few command-line flags around to group together flags of same kind. Note...

gurjeet

Only verify MAX_ARG limit when running privileged.

4

I've hit the MAX_ARG limit. There doesn't seem to be any reason for it when bwrap is unprivileged.

brown

Fix O(N^2) behavior of bind mounting.

5

Read /proc/self/mountinfo only once instead reading it for every "--bind" flag on the command line.

brown