Import Debian changes 0.9.0-ok1
bubblewrap (0.9.0-ok1) nile; urgency=medium * Build for openKylin.
This commit is contained in:
Luoyaoming
luoyaoming
parent
015eefdf88
commit
20b859454d
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Enable unprivileged creation of new user namespaces in older Debian
|
||||||
|
# kernels.
|
||||||
|
#
|
||||||
|
# If this is not desired, copy this file to
|
||||||
|
# /etc/sysctl.d/50-bubblewrap.conf and change the value of this parameter
|
||||||
|
# to 0, then use dpkg-statoverride to make /usr/bin/bwrap setuid root.
|
||||||
|
#
|
||||||
|
# For more details see https://deb.li/bubblewrap or
|
||||||
|
# /usr/share/doc/bubblewrap/README.Debian
|
||||||
|
kernel.unprivileged_userns_clone=1
|
||||||
|
|
@ -0,0 +1,172 @@
|
||||||
|
bubblewrap kernel requirements
|
||||||
|
==============================
|
||||||
|
|
||||||
|
bubblewrap can be used by various parts of the system to run
|
||||||
|
partially-trusted programs in a sandboxed environment where their impact
|
||||||
|
on system security is reduced. For example:
|
||||||
|
|
||||||
|
- Flatpak uses bubblewrap to run partially-trusted, user-installable
|
||||||
|
apps in a sandboxed environment.
|
||||||
|
|
||||||
|
- libgnome-desktop uses bubblewrap to run thumbnailers in a sandboxed
|
||||||
|
environment, so that if there are security flaws in an image decoder
|
||||||
|
used by a thumbnailer, the process of generating thumbnails for a
|
||||||
|
maliciously crafted image cannot be used to attack the rest of the
|
||||||
|
system.
|
||||||
|
|
||||||
|
bubblewrap can also be used to run trusted programs in a different
|
||||||
|
environment, for example with different shared libraries available:
|
||||||
|
|
||||||
|
- Flatpak uses bubblewrap to run apps with a predictable library stack
|
||||||
|
that does not match the rest of the system, even if those apps are
|
||||||
|
trusted and so do not need to be sandboxed for security.
|
||||||
|
|
||||||
|
- Steam uses bubblewrap to run some games with a predictable library
|
||||||
|
stack that does not match the rest of the system.
|
||||||
|
|
||||||
|
The necessary capabilities to do this can be obtained in one of two
|
||||||
|
ways:
|
||||||
|
|
||||||
|
- On kernels where unprivileged users can create new user namespaces,
|
||||||
|
bubblewrap's bwrap executable can be an ordinary unprivileged program.
|
||||||
|
|
||||||
|
- On kernels where this is not possible, bubblewrap will not work unless
|
||||||
|
the /usr/bin/bwrap executable is setuid root. Some bubblewrap and Flatpak
|
||||||
|
features will not work in this configuration for security reasons.
|
||||||
|
|
||||||
|
Newer Debian kernels (Linux 5.10 and newer; Debian 11 and newer)
|
||||||
|
----------------------------------------------------------------
|
||||||
|
|
||||||
|
Debian kernels since 5.10 allow unprivileged users to create new user
|
||||||
|
namespaces. The bwrap executable can be made non-setuid on these kernels.
|
||||||
|
|
||||||
|
By default, the bubblewrap package in Debian no longer installs a setuid
|
||||||
|
root /usr/bin/bwrap executable.
|
||||||
|
|
||||||
|
Ubuntu kernels (Ubuntu 18.04 and newer)
|
||||||
|
---------------------------------------
|
||||||
|
|
||||||
|
Ubuntu kernels also allow unprivileged users to create new user
|
||||||
|
namespaces. The bwrap executable can be made non-setuid on these kernels,
|
||||||
|
and the Ubuntu bubblewrap package does not install a setuid executable.
|
||||||
|
|
||||||
|
Older Debian kernels (Linux 5.9 and older; Debian 10 and older)
|
||||||
|
---------------------------------------------------------------
|
||||||
|
|
||||||
|
Debian kernels older than 5.10 have support for user namespaces, but
|
||||||
|
that feature is disabled by default to reduce the kernel's attack
|
||||||
|
surface.
|
||||||
|
|
||||||
|
The bubblewrap package contains configuration in
|
||||||
|
/usr/lib/sysctl.d/50-bubblewrap.conf to enable user namespaces
|
||||||
|
(see "Enabling kernel.unprivileged_userns_clone", below).
|
||||||
|
|
||||||
|
If this is not desired, system administrators can copy that file
|
||||||
|
to /etc/sysctl.d/50-bubblewrap.conf and modify it to disable unprivileged
|
||||||
|
creation of user namespaces, then make bubblewrap setuid root so that it
|
||||||
|
still works as intended (see "Making bubblewrap setuid root", below).
|
||||||
|
|
||||||
|
Custom and third-party kernels
|
||||||
|
------------------------------
|
||||||
|
|
||||||
|
If you compile your own kernel, you will need at least
|
||||||
|
CONFIG_NAMESPACES=y and preferably CONFIG_USER_NS=y.
|
||||||
|
|
||||||
|
If you do not have CONFIG_UTS_NS=y, CONFIG_IPC_NS=y, CONFIG_USER_NS=y,
|
||||||
|
CONFIG_PID_NS=y and CONFIG_NET_NS=y, then the corresponding bubblewrap
|
||||||
|
features will not work.
|
||||||
|
|
||||||
|
Configuring kernel.unprivileged_userns_clone
|
||||||
|
--------------------------------------------
|
||||||
|
|
||||||
|
This Debian-specific sysctl parameter controls whether unprivileged
|
||||||
|
users are allowed to create new user namespaces.
|
||||||
|
|
||||||
|
If it is set to 0, some attacks against the kernel are made more difficult,
|
||||||
|
which can increase security. However, some user-space software will not
|
||||||
|
be able to create a sandboxed environment or will have to rely on a
|
||||||
|
setuid version of bubblewrap to create a sandboxed environment, which
|
||||||
|
reduces security. The value of this sysctl parameter is a trade-off
|
||||||
|
between different security risks.
|
||||||
|
|
||||||
|
If this parameter is set to 0, bubblewrap and Flatpak will not work unless
|
||||||
|
bwrap is made setuid root (see "Making bubblewrap setuid root" below).
|
||||||
|
|
||||||
|
The default is 1 for Debian kernels that are version 5.10 or newer,
|
||||||
|
1 for Ubuntu kernels, or 0 for older Debian kernels. The bubblewrap
|
||||||
|
package contains configuration in /usr/lib/sysctl.d/50-bubblewrap.conf
|
||||||
|
to set this parameter to 1 during system startup.
|
||||||
|
|
||||||
|
If this is not desired, system administrators can copy
|
||||||
|
/usr/lib/sysctl.d/50-bubblewrap.conf to /etc/sysctl.d/50-bubblewrap.conf
|
||||||
|
and modify it to disable unprivileged creation of user namespaces, then
|
||||||
|
make bubblewrap setuid root so that it still works as intended (see
|
||||||
|
"Making bubblewrap setuid root", below).
|
||||||
|
|
||||||
|
You can view the current setting with:
|
||||||
|
|
||||||
|
cat /proc/sys/kernel/unprivileged_userns_clone
|
||||||
|
|
||||||
|
and temporarily set it to 1 (until the next reboot) with:
|
||||||
|
|
||||||
|
sudo sysctl -w kernel.unprivileged_userns_clone=1
|
||||||
|
|
||||||
|
Configuring the maximum number of namespaces per user
|
||||||
|
-----------------------------------------------------
|
||||||
|
|
||||||
|
The number of user namespaces per user is limited. The default limit
|
||||||
|
depends on the amount of RAM available.
|
||||||
|
|
||||||
|
Setting this limit to 0 is the recommended way to disable user namespace
|
||||||
|
creation if this is required as a security hardening measure. bubblewrap
|
||||||
|
will not work with this limit set to 0, unless it is setuid root (see
|
||||||
|
"Configuring whether bubblewrap is setuid root" below).
|
||||||
|
|
||||||
|
The limit is given by the user.max_user_namespaces sysctl parameter.
|
||||||
|
|
||||||
|
You can view the current setting with:
|
||||||
|
|
||||||
|
cat /proc/sys/user/max_user_namespaces
|
||||||
|
|
||||||
|
and temporarily set it to a value (until the next reboot) with a
|
||||||
|
command like:
|
||||||
|
|
||||||
|
sudo sysctl -w user.max_user_namespaces=1000
|
||||||
|
|
||||||
|
To set it to a value during system startup, create a file in /etc/sysctl.d
|
||||||
|
containing a line like this:
|
||||||
|
|
||||||
|
user.max_user_namespaces=1000
|
||||||
|
|
||||||
|
Configuring whether bubblewrap is setuid root
|
||||||
|
---------------------------------------------
|
||||||
|
|
||||||
|
To use bubblewrap with kernel.unprivileged_userns_clone set to 0
|
||||||
|
or user.max_user_namespaces set to 0, it is necessary to make the bwrap
|
||||||
|
executable setuid root. This gives it the necessary capabilities to set
|
||||||
|
up containers even when run by an otherwise unprivileged user, and is the
|
||||||
|
configuration normally used in Debian 10.
|
||||||
|
|
||||||
|
This can be a security risk: if there are bugs in bubblewrap, it might be
|
||||||
|
possible for an unprivileged user to get root privileges by running a
|
||||||
|
setuid version of the bwrap executable. CVE-2020-5291 and CVE-2016-8659
|
||||||
|
are examples of bugs that had this effect in the past. However, it allows
|
||||||
|
the kernel to be configured to disallow creation of user namespaces by
|
||||||
|
unprivileged users, which prevents attacks like CVE-2016-3135 from being
|
||||||
|
carried out against the kernel. This is a trade-off between different
|
||||||
|
security risks.
|
||||||
|
|
||||||
|
To avoid other attacks, some Flatpak and bubblewrap features are not
|
||||||
|
available when bwrap is setuid root, and the absence of those features
|
||||||
|
is known to break some Flatpak apps. For example, the Flatpak app for
|
||||||
|
the Chromium web browser will not work with a setuid bwrap executable.
|
||||||
|
|
||||||
|
To check whether the bwrap executable will be made setuid root after
|
||||||
|
the next upgrade, use this command:
|
||||||
|
|
||||||
|
dpkg-statoverride --list /usr/bin/bwrap
|
||||||
|
|
||||||
|
To force the bwrap executable to be setuid root, use these commands:
|
||||||
|
|
||||||
|
sudo dpkg-statoverride --quiet --remove /usr/bin/bwrap
|
||||||
|
sudo dpkg-statoverride --update --add root root 4755 /usr/bin/bwrap
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
exec >&3 2>&3
|
||||||
|
|
||||||
|
echo "Permissions of /usr/bin/bwrap:"
|
||||||
|
ls -l /usr/bin/bwrap || :
|
||||||
|
|
||||||
|
for f in \
|
||||||
|
/etc/sysctl.d/*-bubblewrap.conf \
|
||||||
|
/usr/lib/sysctl.d/*-bubblewrap.conf \
|
||||||
|
/proc/sys/kernel/unprivileged_userns_clone \
|
||||||
|
/proc/sys/user/max_*_namespaces \
|
||||||
|
; do
|
||||||
|
echo "$f:"
|
||||||
|
cat "$f" || :
|
||||||
|
done
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
demos/*
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
debian/50-bubblewrap.conf usr/lib/sysctl.d
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
#DEBHELPER#
|
||||||
|
|
||||||
|
# Apply sysctl configuration after upgrade
|
||||||
|
if command -v sysctl > /dev/null; then
|
||||||
|
sysctl --quiet --pattern '^kernel\.unprivileged_userns_clone$' --system || :
|
||||||
|
fi
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
bubblewrap (0.9.0-ok1) nile; urgency=medium
|
||||||
|
|
||||||
|
* Build for openKylin.
|
||||||
|
|
||||||
|
-- Luoyaoming <Luoyaoming@kylinos.cn> Wed, 24 Apr 2024 09:11:58 +0800
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
config.log
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
Source: bubblewrap
|
||||||
|
Section: admin
|
||||||
|
Priority: optional
|
||||||
|
Maintainer: openKylin Developers <packaging@lists.openkylin.top>
|
||||||
|
XSBC-Original-Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
|
||||||
|
Uploaders:
|
||||||
|
Laszlo Boszormenyi (GCS) <gcs@debian.org>,
|
||||||
|
Simon McVittie <smcv@debian.org>,
|
||||||
|
Build-Depends:
|
||||||
|
bash-completion,
|
||||||
|
debhelper-compat (= 13),
|
||||||
|
docbook-xml,
|
||||||
|
docbook-xsl,
|
||||||
|
iproute2 <!nocheck>,
|
||||||
|
libcap-dev,
|
||||||
|
libcap2-bin <!nocheck>,
|
||||||
|
libipc-run-perl <!nocheck>,
|
||||||
|
libselinux1-dev,
|
||||||
|
meson,
|
||||||
|
perl:any <!nocheck>,
|
||||||
|
pkgconf,
|
||||||
|
python3:any <!nocheck>,
|
||||||
|
xsltproc,
|
||||||
|
Standards-Version: 4.6.2
|
||||||
|
Homepage: https://github.com/containers/bubblewrap
|
||||||
|
Vcs-Git: https://salsa.debian.org/debian/bubblewrap.git
|
||||||
|
Vcs-Browser: https://salsa.debian.org/debian/bubblewrap
|
||||||
|
Rules-Requires-Root: no
|
||||||
|
|
||||||
|
Package: bubblewrap
|
||||||
|
Architecture: linux-any
|
||||||
|
Multi-Arch: foreign
|
||||||
|
Depends:
|
||||||
|
${misc:Depends},
|
||||||
|
${shlibs:Depends},
|
||||||
|
Recommends:
|
||||||
|
procps,
|
||||||
|
Description: utility for unprivileged chroot and namespace manipulation
|
||||||
|
bubblewrap uses Linux namespaces to launch unprivileged containers.
|
||||||
|
These containers can be used to sandbox semi-trusted applications such
|
||||||
|
as Flatpak apps, image/video thumbnailers and web browser components,
|
||||||
|
or to run programs in a different library stack such as a Flatpak runtime
|
||||||
|
or a different Debian release.
|
||||||
|
.
|
||||||
|
By default, this package relies on a kernel with user namespaces enabled.
|
||||||
|
Official Debian and Ubuntu kernels are suitable.
|
||||||
|
.
|
||||||
|
On kernels without user namespaces, system administrators can make the
|
||||||
|
bwrap executable setuid root, allowing it to create unprivileged
|
||||||
|
containers even though ordinary user processes cannot.
|
||||||
|
|
@ -0,0 +1,89 @@
|
||||||
|
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||||
|
Upstream-Name: bubblewrap
|
||||||
|
Source: https://github.com/containers/bubblewrap/
|
||||||
|
|
||||||
|
Files: *
|
||||||
|
Copyright:
|
||||||
|
2016 Alexander Larsson
|
||||||
|
2021 Simon McVittie
|
||||||
|
2022 Collabora Ltd.
|
||||||
|
License: LGPL-2+
|
||||||
|
|
||||||
|
Files: bubblewrap.jpg
|
||||||
|
Copyright: none
|
||||||
|
License: pd-bubblewrap.jpg
|
||||||
|
Placed in the public domain by the photographer "dancing_stupidity".
|
||||||
|
|
||||||
|
Files: debian/*
|
||||||
|
Copyright:
|
||||||
|
2016 Laszlo Boszormenyi (GCS) <gcs@debian.org>
|
||||||
|
2016-2024 Simon McVittie
|
||||||
|
2016-2024 Collabora Ltd.
|
||||||
|
License: LGPL-2+
|
||||||
|
|
||||||
|
Files:
|
||||||
|
git.mk
|
||||||
|
Copyright:
|
||||||
|
2009, Red Hat, Inc.
|
||||||
|
2010-2013 Behdad Esfahbod
|
||||||
|
License: permissive-git.mk
|
||||||
|
Copying and distribution of this file, with or without modification,
|
||||||
|
is permitted in any medium without royalty provided the copyright
|
||||||
|
notice and this notice are preserved.
|
||||||
|
|
||||||
|
Files: m4/attributes.m4
|
||||||
|
Copyright:
|
||||||
|
2006-2008 Diego Pettenò <flameeyes@gmail.com>
|
||||||
|
2006-2008 xine project
|
||||||
|
2012 Lucas De Marchi <lucas.de.marchi@gmail.com>
|
||||||
|
License: GPL-2+ with Autoconf exception
|
||||||
|
|
||||||
|
License: LGPL-2+
|
||||||
|
This library is free software; you can redistribute it and/or
|
||||||
|
modify it under the terms of the GNU Library General Public
|
||||||
|
License as published by the Free Software Foundation; either
|
||||||
|
version 2 of the License, or (at your option) any later version.
|
||||||
|
.
|
||||||
|
This library is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
Library General Public License for more details.
|
||||||
|
.
|
||||||
|
You should have received a copy of the GNU Library General Public
|
||||||
|
License along with this library; if not, write to the Free Software
|
||||||
|
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
|
||||||
|
USA.
|
||||||
|
.
|
||||||
|
On Debian systems, the full text of the GNU Library General Public License
|
||||||
|
version 2 can be found in the file `/usr/share/common-licenses/LGPL-2'.
|
||||||
|
|
||||||
|
License: GPL-2+ with Autoconf exception
|
||||||
|
This program is free software; you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation; either version 2, or (at your option)
|
||||||
|
any later version.
|
||||||
|
.
|
||||||
|
This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
.
|
||||||
|
You should have received a copy of the GNU General Public License
|
||||||
|
along with this program; if not, write to the Free Software
|
||||||
|
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
02110-1301, USA.
|
||||||
|
.
|
||||||
|
As a special exception, the copyright owners of the
|
||||||
|
macro gives unlimited permission to copy, distribute and modify the
|
||||||
|
configure scripts that are the output of Autoconf when processing the
|
||||||
|
Macro. You need not follow the terms of the GNU General Public
|
||||||
|
License when using or distributing such scripts, even though portions
|
||||||
|
of the text of the Macro appear in them. The GNU General Public
|
||||||
|
License (GPL) does govern all other use of the material that
|
||||||
|
constitutes the Autoconf Macro.
|
||||||
|
.
|
||||||
|
This special exception to the GPL applies to versions of the
|
||||||
|
Autoconf Macro released by this project. When you make and
|
||||||
|
distribute a modified version of the Autoconf Macro, you may extend
|
||||||
|
this special exception to the GPL to apply to your modified version as
|
||||||
|
well.
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
README.md
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
[DEFAULT]
|
||||||
|
pristine-tar = True
|
||||||
|
debian-branch = debian/latest
|
||||||
|
upstream-branch = upstream/latest
|
||||||
|
patch-numbers = False
|
||||||
|
upstream-vcs-tag = v%(version)s
|
||||||
22
debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch
vendored
Normal file
22
debian/patches/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
From: Simon McVittie <smcv@debian.org>
|
||||||
|
Date: Fri, 1 Jan 2021 15:03:27 +0000
|
||||||
|
Subject: Change EPERM error message to show Debian-specific information
|
||||||
|
|
||||||
|
Forwarded: not-needed
|
||||||
|
---
|
||||||
|
bubblewrap.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/bubblewrap.c b/bubblewrap.c
|
||||||
|
index 9b78a9a..1ea16c9 100644
|
||||||
|
--- a/bubblewrap.c
|
||||||
|
+++ b/bubblewrap.c
|
||||||
|
@@ -2905,7 +2905,7 @@ main (int argc,
|
||||||
|
if (errno == EINVAL)
|
||||||
|
die ("Creating new namespace failed, likely because the kernel does not support user namespaces. bwrap must be installed setuid on such systems.");
|
||||||
|
else if (errno == EPERM && !is_privileged)
|
||||||
|
- die ("No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.");
|
||||||
|
+ die ("No permissions to create new namespace, likely because the kernel does not allow non-privileged user namespaces. See <https://deb.li/bubblewrap> or <file:///usr/share/doc/bubblewrap/README.Debian.gz>.");
|
||||||
|
}
|
||||||
|
|
||||||
|
if (errno == ENOSPC)
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
#!/usr/bin/make -f
|
||||||
|
# -*- makefile -*-
|
||||||
|
|
||||||
|
export DEB_BUILD_MAINT_OPTIONS = hardening=+pie,+bindnow
|
||||||
|
|
||||||
|
# Uncomment this to turn on verbose mode.
|
||||||
|
#export DH_VERBOSE=1
|
||||||
|
|
||||||
|
PKGDIR=$(CURDIR)/debian/bubblewrap
|
||||||
|
|
||||||
|
%:
|
||||||
|
dh $@ --buildsystem=meson+ninja --without=autoreconf
|
||||||
|
|
||||||
|
override_dh_auto_configure:
|
||||||
|
dh_auto_configure \
|
||||||
|
-- \
|
||||||
|
-Dzsh_completion_dir=/usr/share/zsh/vendor-completions \
|
||||||
|
${NULL}
|
||||||
|
.PHONY: override_dh_auto_configure
|
||||||
|
|
||||||
|
override_dh_auto_test:
|
||||||
|
# Remove LD_PRELOAD so we don't run with faketime. It uses
|
||||||
|
# sem_open(), but bubblewrap runs in an environment where that
|
||||||
|
# can't work.
|
||||||
|
env -u LD_PRELOAD dh_auto_test
|
||||||
|
|
||||||
|
.PHONY: override_dh_auto_test
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
include:
|
||||||
|
- https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
|
||||||
|
- https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
3.0 (quilt)
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
# vim:set sw=4 sts=4 et ft=perl:
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
use Test::More;
|
||||||
|
use IPC::Run qw(run);
|
||||||
|
|
||||||
|
sub run_ok {
|
||||||
|
my $argv = shift;
|
||||||
|
my $debug = join(' ', @$argv);
|
||||||
|
ok(run($argv, @_), qq{"$debug" should succeed});
|
||||||
|
}
|
||||||
|
|
||||||
|
my $out;
|
||||||
|
run_ok([qw(bwrap --ro-bind / / /usr/bin/id -u)], '<', \undef, '>', \$out);
|
||||||
|
is($out, `id -u`);
|
||||||
|
run_ok([qw(bwrap --ro-bind / / /usr/bin/id -g)], '<', \undef, '>', \$out);
|
||||||
|
is($out, `id -g`);
|
||||||
|
|
||||||
|
done_testing;
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
Tests:
|
||||||
|
basic
|
||||||
|
dev
|
||||||
|
net
|
||||||
|
upstream
|
||||||
|
userns
|
||||||
|
Restrictions: allow-stderr, isolation-machine
|
||||||
|
Depends:
|
||||||
|
bubblewrap,
|
||||||
|
iproute2:native,
|
||||||
|
libcap2-bin:native,
|
||||||
|
libipc-run-perl:native,
|
||||||
|
perl:native,
|
||||||
|
python3:native,
|
||||||
|
|
||||||
|
Tests: upstream-usrmerge
|
||||||
|
Restrictions: allow-stderr, isolation-machine, breaks-testbed
|
||||||
|
Depends:
|
||||||
|
bubblewrap,
|
||||||
|
iproute2:native,
|
||||||
|
libcap2-bin:native,
|
||||||
|
libipc-run-perl:native,
|
||||||
|
perl:native,
|
||||||
|
python3:native,
|
||||||
|
usrmerge
|
||||||
|
|
||||||
|
Tests:
|
||||||
|
upstream-as-root
|
||||||
|
Restrictions: allow-stderr, isolation-machine, needs-root
|
||||||
|
Depends:
|
||||||
|
bubblewrap,
|
||||||
|
iproute2:native,
|
||||||
|
libcap2-bin:native,
|
||||||
|
libipc-run-perl:native,
|
||||||
|
perl:native,
|
||||||
|
python3:native,
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
# vim:set sw=4 sts=4 et ft=perl:
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
use Test::More;
|
||||||
|
use IPC::Run qw(run);
|
||||||
|
|
||||||
|
sub run_ok {
|
||||||
|
my $argv = shift;
|
||||||
|
my $debug = join(' ', @$argv);
|
||||||
|
ok(run($argv, @_), qq{"$debug" should succeed});
|
||||||
|
}
|
||||||
|
|
||||||
|
my $out;
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --dev /dev //bin/sh -c), "echo /dev/*"],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
like($out, qr{(^| )/dev/full( |$)});
|
||||||
|
like($out, qr{(^| )/dev/null( |$)});
|
||||||
|
like($out, qr{(^| )/dev/pts( |$)});
|
||||||
|
like($out, qr{(^| )/dev/random( |$)});
|
||||||
|
like($out, qr{(^| )/dev/shm( |$)});
|
||||||
|
like($out, qr{(^| )/dev/stderr( |$)});
|
||||||
|
like($out, qr{(^| )/dev/stdin( |$)});
|
||||||
|
like($out, qr{(^| )/dev/stdout( |$)});
|
||||||
|
like($out, qr{(^| )/dev/tty( |$)});
|
||||||
|
like($out, qr{(^| )/dev/urandom( |$)});
|
||||||
|
like($out, qr{(^| )/dev/zero( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/hda( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/dsp( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/fuse( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/kmsg( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/loop0( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/mem( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/sda( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/snd( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/tty1( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/vda( |$)});
|
||||||
|
|
||||||
|
done_testing;
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
# vim:set sw=4 sts=4 et ft=perl:
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
use Test::More;
|
||||||
|
use IPC::Run qw(run);
|
||||||
|
|
||||||
|
sub run_ok {
|
||||||
|
my $argv = shift;
|
||||||
|
my $debug = join(' ', @$argv);
|
||||||
|
ok(run($argv, @_), qq{"$debug" should succeed});
|
||||||
|
}
|
||||||
|
|
||||||
|
my $out;
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-net /bin/sh -c), "ip link ls"],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
|
||||||
|
like($out, qr{^[0-9]+: lo:});
|
||||||
|
unlike($out, qr{^[0-9]+: en[^:]*:});
|
||||||
|
unlike($out, qr{^[0-9]+: eth[^:]*:});
|
||||||
|
unlike($out, qr{^[0-9]+: wlan[^:]*:});
|
||||||
|
|
||||||
|
done_testing;
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
exec tests/test-run.sh
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
exec tests/test-run.sh
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
upstream
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
# vim:set sw=4 sts=4 et ft=perl:
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
use Test::More;
|
||||||
|
use IPC::Run qw(run);
|
||||||
|
|
||||||
|
sub run_ok {
|
||||||
|
my $argv = shift;
|
||||||
|
my $debug = join(' ', @$argv);
|
||||||
|
ok(run($argv, @_), qq{"$debug" should succeed});
|
||||||
|
}
|
||||||
|
|
||||||
|
my $out;
|
||||||
|
|
||||||
|
diag("Unshare user ID");
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 /usr/bin/id -u)],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
is($out, "2\n");
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 /usr/bin/id -g)],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
is($out, "3\n");
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 /bin/sh -c),
|
||||||
|
'ls -l /etc/passwd'],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
like($out, qr{ nobody nogroup });
|
||||||
|
|
||||||
|
diag("Combine new /dev with new user namespace (#71)");
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 --dev /dev /bin/sh -c),
|
||||||
|
'echo /dev/*'],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
like($out, qr{(^| )/dev/full( |$)});
|
||||||
|
unlike($out, qr{(^| )/dev/tty1( |$)});
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 --dev /dev /usr/bin/id -u)],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
is($out, "2\n");
|
||||||
|
run_ok([qw(bwrap --ro-bind / / --unshare-user --uid 2 --gid 3 --dev /dev /usr/bin/id -g)],
|
||||||
|
'<', \undef, '>', \$out);
|
||||||
|
is($out, "3\n");
|
||||||
|
|
||||||
|
done_testing;
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
Repository: https://github.com/containers/bubblewrap.git
|
||||||
|
Repository-Browse: https://github.com/containers/bubblewrap
|
||||||
|
Bug-Database: https://github.com/containers/bubblewrap/issues
|
||||||
|
Bug-Submit: https://github.com/containers/bubblewrap/issues/new
|
||||||
|
...
|
||||||
|
# vim:set ft=yaml:
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
version=4
|
||||||
|
# Upstream releases official Autotools 'make dist' tarballs, so we use
|
||||||
|
# those in preference to git tags
|
||||||
|
opts="\
|
||||||
|
compression=xz, \
|
||||||
|
dversionmangle=s/\+(?:git)?[0-9]*(?:\+g[0-9a-f]*)//, \
|
||||||
|
downloadurlmangle=s#/tag/#/download/#;s#(v?@ANY_VERSION@)$#$1/@PACKAGE@-$2.tar.xz#, \
|
||||||
|
filenamemangle=s#v?@ANY_VERSION@#@PACKAGE@-$1.tar.xz#" \
|
||||||
|
https://github.com/containers/@PACKAGE@/tags .*/releases/tag/v?@ANY_VERSION@
|
||||||
Loading…
Reference in New Issue