Re: Recent bubblewrap security upgrade causing a build failure

["'Florian Bezdeka' via isar-users" <isar-users@googlegroups.com>]

On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users
wrote:
> On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
> wrote:
> > Hi,
> > 
> > I just hit a build failure like:
> > 
> > ...
> > > DEBUG: Executing shell function rootfs_install_pkgs_download
> > > bwrap: Can't mount on symlink destination /bin
> > > WARNING: exit code 1 from a shell command.
> > > DEBUG: Executing shell function rootfs_do_umounts
> > ...
> > 
> > That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> > which at least Debian has active right now. To get my build going again,
> > downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> > long run, but it saved my friday afternoon....

I came along the following lines while updating my Debian machine today:

bubblewrap (0.11.2-2) unstable; urgency=medium

  Historically, bubblewrap was sometimes installed setuid root.
  This is unnecessary on Debian kernels since Debian 11, and no longer
  supported by upstream.

  As a safety mechanism against possible root privilege escalation
  vulnerabilities, this version of bubblewrap will no longer run if it
  is detected to be setuid root.

  If bubblewrap has been made setuid root via dpkg-statoverride, please
remove
  that setting, and instead leave it unprivileged.
  See file:///usr/share/doc/bubblewrap/README.Debian.gz for more
details.

 -- Simon McVittie <smcv@debian.org>  Tue, 12 May 2026 18:57:32 +0100

> 
> Thanks for reporting and the root cause analysis. Luckily the just
> released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
> affected.
> 
> But fixing this is probably not easy :/ Maybe Cedric can have a look,
> as he wrote the corresponding logic.
> 
> Best regards,
> Felix
> 
> > 
> > HTH,
> > Uli
> > -- 
> > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.
> 
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/535d972c2f5aedf1d2b19afac3f4466f38d3ae7d.camel%40siemens.com.