Re: Recent bubblewrap security upgrade causing a build failure

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Fri, 2026-08-28 at 17:53 +0200, Florian Bezdeka wrote:
> On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users
> wrote:
> > On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
> > wrote:
> > > Hi,
> > > 
> > > I just hit a build failure like:
> > > 
> > > ...
> > > > DEBUG: Executing shell function rootfs_install_pkgs_download
> > > > bwrap: Can't mount on symlink destination /bin
> > > > WARNING: exit code 1 from a shell command.
> > > > DEBUG: Executing shell function rootfs_do_umounts
> > > ...
> > > 
> > > That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> > > which at least Debian has active right now. To get my build going again,
> > > downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> > > long run, but it saved my friday afternoon....
> 
> I came along the following lines while updating my Debian machine today:
> 
> bubblewrap (0.11.2-2) unstable; urgency=medium
> 
>   Historically, bubblewrap was sometimes installed setuid root.
>   This is unnecessary on Debian kernels since Debian 11, and no longer
>   supported by upstream.
> 
>   As a safety mechanism against possible root privilege escalation
>   vulnerabilities, this version of bubblewrap will no longer run if it
>   is detected to be setuid root.
> 
>   If bubblewrap has been made setuid root via dpkg-statoverride, please
> remove
>   that setting, and instead leave it unprivileged.
>   See file:///usr/share/doc/bubblewrap/README.Debian.gz for more
> details.
> 
>  -- Simon McVittie <smcv@debian.org>  Tue, 12 May 2026 18:57:32 +0100

At least in kas the bubblewrap is already installed without suid.
However, the latest release brings more hardenings like prohibiting to
over-mount a symlink - which bites us here as we over-mount /bin.

Working on a fix...

Felix

> 
> > 
> > Thanks for reporting and the root cause analysis. Luckily the just
> > released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
> > affected.
> > 
> > But fixing this is probably not easy :/ Maybe Cedric can have a look,
> > as he wrote the corresponding logic.
> > 
> > Best regards,
> > Felix
> > 
> > > 
> > > HTH,
> > > Uli
> > > -- 
> > > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > > To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.
> > 
> > --
> > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/cd912f140fafe190fd7b3a2fc4e59e5ac6cc63f4.camel%40siemens.com.