bubblewrap

bubblewrap copied to clipboard

i actually started recently to mess with renpy to create minigame, and i do wand to sandbox it, i'm using the settings after : There is two problem first it's...

BirdInFire

Add an option to disable nested user namespaces by setting limit to 1

11

Some use-cases of bubblewrap want to ensure that the subprocess can't further re-arrange the filesystem namespace, or do other more complex namespace modification. For example, Flatpak wants to prevent sandboxed...

smcv

using loop device from wrapped app - can this work?

4

I am trying to wrap a app that needs to setup its own loop device, roughly it does: 1. create a file.img 2. `mknod /dev/loopN ...` (cause `/dev` is either...

x3nb63

[Question] bwrap in LXC

23

Hello, Is bwrap suitable for sandboxing apps/users in LXC environment? If yes - any special flag for it? ``` # su - test -s /usr/bin/bwshell Last login: Mon Mar 30...

smtalk

Add an option to use private (instead of slave) propagation for bind mounts.

3

Hello everyone! I propose using a private propagation instead of slave one for bind mounts (this is optional and done by --private option). It can theoretically enhance sandbox security as...

ChrysoliteAzalea

I propose adding Landlock support to Bubblewrap

5

Hello everyone! I propose adding Landlock support to Bubblewrap. Landlock is a Linux security module officially introduced in Linux 5.13 kernel version that allows unprivileged processes to impose filesystem self-restrictions....

ChrysoliteAzalea

Can't listen on privileged ports with `--dev /dev`

10

When I run bwrap with `--dev /dev`, I can't listen on a privileged port like 80. Here's an example, with an strace to show that the `bind` system call is...

jvns

Running bwrap as root with custom user namespace with more than 1 uid in uid_map fails

1

Hello, for my use case I need to run `bwrap` as root user with a user namespace that has more than 1 uid in uid_map. I've tried to create a...

ygg-drop

Can't mount more filesystems within a read-only mount

10

Simple example: ```bash $ bwrap --ro-bind / / --bind . /here true bwrap: Can't mkdir /here: Read-only file system ``` This can be worked around by creating the target directory...

pxeger

O(N^2) performance in the number of "--bind" flags

13

When bwrap is called with thousands of "--bind" arguments on the command line, it slows down considerably. It looks like /proc/self/mountinfo is parsed for every single "--bind" flag. Must that...

brown