[Pkg-utopia-maintainers] Bug#1145655: bubblewrap: GHSA-pxhw-h44j-8pfx: sandbox escape via symlink traversal during setup

[Simon McVittie]

On Wed, 26 Aug 2026 at 11:22:35 +0100, Simon McVittie wrote:
>As previously discussed with the security team, fixing this in versions
>older than 0.12.0 does not look feasible, so I'm going to prepare a
>backport of 0.12.0 to stable.

Proposed package for trixie-security: 
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/> 
(debdiffs included, bubblewrap_0.12.0-1~deb13u1_debianonly.diff is 
filtered to debian/ only)

A functionally equivalent test-build (differing only in the changelog) 
is in 
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/rc/>.

For the upstream changes, the easiest thing to review is likely to be:

git log -p --reverse --stat --ignore-space-change v0.11.0..v0.12.0

Some notes:

* commit ea185f6fb135782cabab342e33432e8482a2f5c9 "Inline the privileged
   ops" is rather noisy, unfortunately, but we've been using a version with
   that commit for a while in the Steam Runtime with no regressions
   reported.

* In commit 67d4be103b18706b5b4e3f495daa35e89e47b163 "Import safe_openat()
   from crun", as a result of -Dassume_kernel=5.10.0 we don't ever call
   chroot_realpath(), and looking for "%s%s%s" in strings(1) output confirms
   that it doesn't even get linked. This is good, because the
   implementation of chroot_realpath() scares me (far too much strcat()).
   We can confirm this with:

   $ bwrap --dev-bind / / true
   (exit 0, no output)
   $ bwrap --debug-opt=force-openat-fallback --dev-bind / / true
   bwrap: Can't open source /: Function not implemented

   (--debug-opt=force-openat-fallback emulates a pre-5.6 kernel where
   openat2() failed.)

If the security team is happy with this, there is a signed .changes in 
<https://people.debian.org/~smcv/temp/2026/bubblewrap-bug1145655/bubblewrap_0.12.0-1~deb13u1_source.tar.gz.gpg> 
(encrypted to the security team's key) which should be suitable for 
upload to security-master, to save a round-trip from security team 
approval to me uploading; or I can upload it myself if the team would 
prefer that. I have also pushed the changes to 
<https://salsa.debian.org/debian/bubblewrap/-/tree/debian/trixie-proposed?ref_type=heads> 
and will copy that to the debian/trixie branch if accepted.

Thanks,
     smcv