Recent bubblewrap security upgrade causing a build failure

Recent bubblewrap security upgrade causing a build failure

['Ulrich Teichert' via isar-users]

[-- Attachment #1.1: Type: text/plain, Size: 885 bytes --]

Hi,

I just hit a build failure like:

...
| DEBUG: Executing shell function rootfs_install_pkgs_download
| bwrap: Can't mount on symlink destination /bin
| WARNING: exit code 1 from a shell command.
| DEBUG: Executing shell function rootfs_do_umounts
...

That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
which at least Debian has active right now. To get my build going again,
downgrading to 0.11.0 was enough. Of course, that doesn't help in the
long run, but it saved my friday afternoon....

HTH,
Uli

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 1355 bytes --]

Re: Recent bubblewrap security upgrade causing a build failure

['MOESSBAUER, Felix' via isar-users]

On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
wrote:
> Hi,
> 
> I just hit a build failure like:
> 
> ...
> | DEBUG: Executing shell function rootfs_install_pkgs_download
> | bwrap: Can't mount on symlink destination /bin
> | WARNING: exit code 1 from a shell command.
> | DEBUG: Executing shell function rootfs_do_umounts
> ...
> 
> That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> which at least Debian has active right now. To get my build going again,
> downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> long run, but it saved my friday afternoon....

Thanks for reporting and the root cause analysis. Luckily the just
released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
affected.

But fixing this is probably not easy :/ Maybe Cedric can have a look,
as he wrote the corresponding logic.

Best regards,
Felix

> 
> HTH,
> Uli
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

Re: Recent bubblewrap security upgrade causing a build failure

['Florian Bezdeka' via isar-users]

On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users
wrote:
> On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
> wrote:
> > Hi,
> > 
> > I just hit a build failure like:
> > 
> > ...
> > > DEBUG: Executing shell function rootfs_install_pkgs_download
> > > bwrap: Can't mount on symlink destination /bin
> > > WARNING: exit code 1 from a shell command.
> > > DEBUG: Executing shell function rootfs_do_umounts
> > ...
> > 
> > That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> > which at least Debian has active right now. To get my build going again,
> > downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> > long run, but it saved my friday afternoon....

I came along the following lines while updating my Debian machine today:

bubblewrap (0.11.2-2) unstable; urgency=medium

  Historically, bubblewrap was sometimes installed setuid root.
  This is unnecessary on Debian kernels since Debian 11, and no longer
  supported by upstream.

  As a safety mechanism against possible root privilege escalation
  vulnerabilities, this version of bubblewrap will no longer run if it
  is detected to be setuid root.

  If bubblewrap has been made setuid root via dpkg-statoverride, please
remove
  that setting, and instead leave it unprivileged.
  See file:///usr/share/doc/bubblewrap/README.Debian.gz for more
details.

 -- Simon McVittie <smcv@debian.org>  Tue, 12 May 2026 18:57:32 +0100

> 
> Thanks for reporting and the root cause analysis. Luckily the just
> released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
> affected.
> 
> But fixing this is probably not easy :/ Maybe Cedric can have a look,
> as he wrote the corresponding logic.
> 
> Best regards,
> Felix
> 
> > 
> > HTH,
> > Uli
> > -- 
> > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.
> 
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/535d972c2f5aedf1d2b19afac3f4466f38d3ae7d.camel%40siemens.com.

Re: Recent bubblewrap security upgrade causing a build failure

['MOESSBAUER, Felix' via isar-users]

On Fri, 2026-08-28 at 17:53 +0200, Florian Bezdeka wrote:
> On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users
> wrote:
> > On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
> > wrote:
> > > Hi,
> > > 
> > > I just hit a build failure like:
> > > 
> > > ...
> > > > DEBUG: Executing shell function rootfs_install_pkgs_download
> > > > bwrap: Can't mount on symlink destination /bin
> > > > WARNING: exit code 1 from a shell command.
> > > > DEBUG: Executing shell function rootfs_do_umounts
> > > ...
> > > 
> > > That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> > > which at least Debian has active right now. To get my build going again,
> > > downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> > > long run, but it saved my friday afternoon....
> 
> I came along the following lines while updating my Debian machine today:
> 
> bubblewrap (0.11.2-2) unstable; urgency=medium
> 
>   Historically, bubblewrap was sometimes installed setuid root.
>   This is unnecessary on Debian kernels since Debian 11, and no longer
>   supported by upstream.
> 
>   As a safety mechanism against possible root privilege escalation
>   vulnerabilities, this version of bubblewrap will no longer run if it
>   is detected to be setuid root.
> 
>   If bubblewrap has been made setuid root via dpkg-statoverride, please
> remove
>   that setting, and instead leave it unprivileged.
>   See file:///usr/share/doc/bubblewrap/README.Debian.gz for more
> details.
> 
>  -- Simon McVittie <smcv@debian.org>  Tue, 12 May 2026 18:57:32 +0100

At least in kas the bubblewrap is already installed without suid.
However, the latest release brings more hardenings like prohibiting to
over-mount a symlink - which bites us here as we over-mount /bin.

Working on a fix...

Felix

> 
> > 
> > Thanks for reporting and the root cause analysis. Luckily the just
> > released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
> > affected.
> > 
> > But fixing this is probably not easy :/ Maybe Cedric can have a look,
> > as he wrote the corresponding logic.
> > 
> > Best regards,
> > Felix
> > 
> > > 
> > > HTH,
> > > Uli
> > > -- 
> > > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > > To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.
> > 
> > --
> > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/cd912f140fafe190fd7b3a2fc4e59e5ac6cc63f4.camel%40siemens.com.