From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 28 Aug 2026 17:54:05 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f60.google.com (mail-pj1-f60.google.com [209.85.216.60]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67SFs3Dq002783 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 28 Aug 2026 17:54:04 +0200 Received: by mail-pj1-f60.google.com with SMTP id 98e67ed59e1d1-38e11baa66esf2357071a91.2 for ; Fri, 28 Aug 2026 08:54:04 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1787932437; cv=pass; d=google.com; s=arc-20260327; b=YNkA9HpqAUOLpCLbBGgsftfv67qKXKjhNBHW8KAzOawpiQ1Zv/jMP1vTXnCgm1Tgi1 SOpMUHcq8rmOv+7yyxIzPOsw84kbPC7E2BDaxJ4u4LULSuL1/Ny0RCtA8xv8E/79JTMC plaSAkEtdBr6K0kyQOipzxHUEaW/4RYtQ3yyG/iegyeMiMlQwxY9xQ+mh1W99o8UfMWY 0nWtQd+eqyZByBtCuz98iPkUHIKdxMYEeRnC+1asDzccHyVhvVaRHAY4IaeHEWiNmBCR 05EERMcE4xoTBWZvRzm7/QKJv5i8KvT0AnA5jlSBzyiGe+K0LXxBS3SmCclU8WXIEeqx zGQQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :content-transfer-encoding:references:in-reply-to:date:cc:to:from :subject:message-id:dkim-signature; bh=AbfoSS3rVrSsBoIizAh1/z8mL+DoI9covKm0X22km6I=; fh=bip6xmV9ad/UGFMNyMg+5z1G2F3eSvly1uWuAIK5JB8=; b=AVk8UoMDvSnbxt+UobkB4oXaxluDhuKIiknUTWFqGZlNqCGQTdT0jqhuJe4NN1BeDh RB4mlPAXzUe0EI88Ce9vej7+l0BGi4rxrr8JXnVWr91uJ7wBpUyyFfOWc4eZHjXR3rpR th28AC1f49fs4q9ZUycXZpqGDKnR6d/Bw+0uEwAvRcxJwKaGIPixqVeJY5INV9XfZ5zR RGESItDhEklNo74s9gsQB3ucCL/cfKcnCKh692d2vPJp0+Ne6GVKqTP8cQllOoTju/P+ 9xxlS1rRhd6cBN4RE24tFgVVbl/j+p7914AQHv/v65VBgv3qhceDD5dYCqVvmYZa/Za5 tiFg==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=hIKipjt+; spf=pass (google.com: domain of fm-68982-202608281553531b394d58f600020774-hriyev@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-68982-202608281553531b394d58f600020774-hriyEv@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1787932437; x=1788537237; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:content-transfer-encoding:content-type:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to:content-type; bh=AbfoSS3rVrSsBoIizAh1/z8mL+DoI9covKm0X22km6I=; b=g5JtUO8BDsPF1rVUAgehgrRi9LNk4u4cqBp2quGgkQ51OLfX+xph02LbWv2a3Fv39p jaC0CbtpgHLct5BA2q8O2azGibNEJ8as3zOn3uVAQl2mLUEkWaF1DNuZcqSRXz8s1q2H kKz/NNLu8GlHKJdYNgpemeptZbiXBH7Kexz3U2AAaI8unjqyjHXHGxYuhuCaz41Vlz+l fegz9k73oH2v9NXDKP/7Qmo7rmwBaWPADSr0mCjlIphJnu5SXKq9BL4dtZiliY8+ErzZ ji+jhRfU00o5wLnpAqekXvj8bWH8ChUqbnruoMel1QjnItltYjw6Dy/0z3Kr3bZtMzHn lIFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787932437; x=1788537237; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:content-transfer-encoding:content-type:references :in-reply-to:date:cc:to:from:subject:message-id:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=AbfoSS3rVrSsBoIizAh1/z8mL+DoI9covKm0X22km6I=; b=BpBFPxr41sbVBHRZVyOrpAbc0Tg95KgfkPofP1AALr+LB/F44VxDr3zP2Zlis0/sLH XCqbvZNnM7IANQ1nOqHlSP+4SjgaLebR8lxPFy925IrpfqY9Vj5jlFHomyYX7KfJsws1 ME8zG+vlkqqJ6ecE8odUb0j7cwoQtvBhdyu5zjV4Bi0iW3Q/zg7WGv+MqGDtuEY8TnEl pGdlLCzviE48NWMMSOnI5Vb4q6fUW4jfQS4dLVo2qLs8CWE2P8nPw/6F2lqYhm8W7lGc Y1iftWlCmjdsiXTwjK2Y+ceMm+icpQH/+9bE+GLrDww4YFO+SH4XZp1Mk8ojFsDeOrYm wpeA== X-Forwarded-Encrypted: i=2; AHgh+RpKmKgDM9gPi6V7xXTfDdR946wS4xro9g3fPJf6NFky59gO1F/6U7kzPf99CrX5Qj90eCEB@ilbers.de X-Gm-Message-State: AFuF++ngyuIUgXrL2e527p9hi7ZYZhf074kOJY3PnXdGPbY8tQ4R61dV 97M4xFZLf8pxOcF1WdTPmNaoe5qPG/Um/9T3JZ1OFfl7JhrM6LsA1Ucs X-Received: by 2002:a17:90b:48c5:b0:398:9be9:ab8c with SMTP id 98e67ed59e1d1-3989be9ac97mr1352420a91.17.1787932437275; Fri, 28 Aug 2026 08:53:57 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdeIg1x9E0WrmjYpOOmVyN4Wa9D1so8e1ryTemriuYMdgQ==" Received: by 2002:a17:90b:3149:b0:38e:4f31:8429 with SMTP id 98e67ed59e1d1-396a474d643ls3510721a91.0.-pod-prod-09-us; Fri, 28 Aug 2026 08:53:55 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rrrw9exHuiKnLvj08870zhYq1PVSA+RpuBJBy0q4ltrvTUe4NjS7LDcG9IM6lowbGVkmQq3lZwjJQne@googlegroups.com X-Received: by 2002:a17:90b:1d83:b0:38e:2e86:ed02 with SMTP id 98e67ed59e1d1-396d1023217mr12970728a91.14.1787932435089; Fri, 28 Aug 2026 08:53:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787932435; cv=none; d=google.com; s=arc-20260327; b=CxPnCpvWcZYwkiz1rI7zgcLs91IM+czq2KxTbciEBITmVhSM1NQ59c7G8OGUkhAHz3 scVb6yOHlocjw1tFQ05LVt32y5xob58KAKiSznaHHhdYSNkUtMzKilGGRegiNOF5wAQ+ 5gNaP110jMXqO2jjvgdqrSf5iLl45IavhJVCVUUaGP8qzlBJLOoSJVdtY3WucOGtD/RZ YZyGJ+cl654/HodsIMl+zBSLShF5X20uIQUVHb9CiIhRNBzM9mYc76Q5qEjOCN5vjRlY b67f+3ksnW1aCaJ2ckBi2jQciWDa9MhlDO9MgZDAt/pR7QyHwjD4l2lu8B/wMdPvK84h 5/ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:mime-version:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:dkim-signature; bh=3OA/6i7aOfDLGxQk0xywGgpbaNKRNHYLbe67DXVLf5w=; fh=g10N1MQfqZ/SnauCsWUfOee36qbfmceqQI+klXKN3Qg=; b=Nn3nosLeRGjNQsrthjTImRLQPf8iaR7bumxudsT7lXImfCWQbeQ3hsEXlEPpiRW9Im m2glHHsdK56Zd64DOCf97Les1zWq8ziOJ22UIfWH3tC2V2Vw49QfRS/x49uGRHtvSDdX Rq+Aut/ZIn8kY0Fx6pRlt3Vy4bsklW0XtgagW5c4Khvfo5uJa/y5SuQz7HQdYn4+TaSO gdQbpUZhq5RifPA/NupHHpjcH672hXVMryQiRirix3GgG8luPETP3fexFmGFutKF5Ok4 QIOIRG3f74H8Mzw1zgeWNwqbVtIyG6MjpikkyGBnpWy4f0M76K16JlbprwQ+0Q3QSGlb mCyA==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=hIKipjt+; spf=pass (google.com: domain of fm-68982-202608281553531b394d58f600020774-hriyev@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-68982-202608281553531b394d58f600020774-hriyEv@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net. [185.136.65.225]) by gmr-mx.google.com with ESMTPS id 98e67ed59e1d1-396b1387dd0si162920a91.2.2026.08.28.08.53.54 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Aug 2026 08:53:55 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-68982-202608281553531b394d58f600020774-hriyev@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) client-ip=185.136.65.225; Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202608281553531b394d58f600020774 for ; Fri, 28 Aug 2026 17:53:53 +0200 Message-ID: <535d972c2f5aedf1d2b19afac3f4466f38d3ae7d.camel@siemens.com> Subject: Re: Recent bubblewrap security upgrade causing a build failure From: "'Florian Bezdeka' via isar-users" To: "MOESSBAUER, Felix" , Ulrich Teichert , isar-users , "Hombourger, Cedric" Cc: "Kiszka, Jan" Date: Fri, 28 Aug 2026 17:53:52 +0200 In-Reply-To: <64b5d7ff601632bff533f1407e3e2aa13b010208.camel@siemens.com> References: <7f7d4378-0c04-4b57-8af9-428725213c53n@googlegroups.com> <64b5d7ff601632bff533f1407e3e2aa13b010208.camel@siemens.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-68982:519-21489:flowmailer X-Original-Sender: florian.bezdeka@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=hIKipjt+; spf=pass (google.com: domain of fm-68982-202608281553531b394d58f600020774-hriyev@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-68982-202608281553531b394d58f600020774-hriyEv@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Florian Bezdeka Reply-To: Florian Bezdeka Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: /TNR1u3ej10Y On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users wrote: > On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users > wrote: > > Hi, > >=20 > > I just hit a build failure like: > >=20 > > ... > > > DEBUG: Executing shell function rootfs_install_pkgs_download > > > bwrap: Can't mount on symlink destination /bin > > > WARNING: exit code 1 from a shell command. > > > DEBUG: Executing shell function rootfs_do_umounts > > ... > >=20 > > That's caused by the security upgrade from bubblewrap=C2=A00.11.0 to=C2= =A00.12.0, > > which at least Debian has active right now. To get my build going again= , > > downgrading to 0.11.0 was enough. Of course, that doesn't help in the > > long run, but it saved my friday afternoon.... I came along the following lines while updating my Debian machine today: bubblewrap (0.11.2-2) unstable; urgency=3Dmedium Historically, bubblewrap was sometimes installed setuid root. This is unnecessary on Debian kernels since Debian 11, and no longer supported by upstream. As a safety mechanism against possible root privilege escalation vulnerabilities, this version of bubblewrap will no longer run if it is detected to be setuid root. If bubblewrap has been made setuid root via dpkg-statoverride, please remove that setting, and instead leave it unprivileged. See file:///usr/share/doc/bubblewrap/README.Debian.gz for more details. -- Simon McVittie Tue, 12 May 2026 18:57:32 +0100 >=20 > Thanks for reporting and the root cause analysis. Luckily the just > released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not > affected. >=20 > But fixing this is probably not easy :/ Maybe Cedric can have a look, > as he wrote the corresponding logic. >=20 > Best regards, > Felix >=20 > >=20 > > HTH, > > Uli > > --=20 > > You received this message because you are subscribed to the Google Grou= ps "isar-users" group. > > To unsubscribe from this group and stop receiving emails from it, send = an email to isar-users+unsubscribe@googlegroups.com. > > To view this discussion visit https://groups.google.com/d/msgid/isar-us= ers/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com. >=20 > -- > You received this message because you are subscribed to the Google Groups= "isar-users" group. > To unsubscribe from this group and stop receiving emails from it, send an= email to isar-users+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/isar-user= s/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com. --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= 535d972c2f5aedf1d2b19afac3f4466f38d3ae7d.camel%40siemens.com.