Recent bubblewrap security upgrade causing a build failure

[Ulrich Teichert]

Hi,

I just hit a build failure like:

...

| DEBUG: Executing shell function rootfs_install_pkgs_download

| bwrap: Can't mount on symlink destination /bin

| WARNING: exit code 1 from a shell command.

| DEBUG: Executing shell function rootfs_do_umounts

...

That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,

which at least Debian has active right now. To get my build going again,

downgrading to 0.11.0 was enough. Of course, that doesn't help in the

long run, but it saved my friday afternoon....

HTH,

Uli

[MOESSBAUER, Felix]

On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
wrote:

Thanks for reporting and the root cause analysis. Luckily the just
released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
affected.

But fixing this is probably not easy :/ Maybe Cedric can have a look,
as he wrote the corresponding logic.

Best regards,
Felix

>
> HTH,
> Uli
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.

[Florian Bezdeka]

On Fri, 2026-08-28 at 13:07 +0000, 'MOESSBAUER, Felix' via isar-users
wrote:

> On Fri, 2026-08-28 at 05:23 -0700, 'Ulrich Teichert' via isar-users
> wrote:
> > Hi,
> >
> > I just hit a build failure like:
> >
> > ...
> > > DEBUG: Executing shell function rootfs_install_pkgs_download
> > > bwrap: Can't mount on symlink destination /bin
> > > WARNING: exit code 1 from a shell command.
> > > DEBUG: Executing shell function rootfs_do_umounts
> > ...
> >
> > That's caused by the security upgrade from bubblewrap 0.11.0 to 0.12.0,
> > which at least Debian has active right now. To get my build going again,
> > downgrading to 0.11.0 was enough. Of course, that doesn't help in the
> > long run, but it saved my friday afternoon....

I came along the following lines while updating my Debian machine today:

bubblewrap (0.11.2-2) unstable; urgency=medium

Historically, bubblewrap was sometimes installed setuid root.
This is unnecessary on Debian kernels since Debian 11, and no longer
supported by upstream.

As a safety mechanism against possible root privilege escalation
vulnerabilities, this version of bubblewrap will no longer run if it
is detected to be setuid root.

If bubblewrap has been made setuid root via dpkg-statoverride, please
remove
that setting, and instead leave it unprivileged.
See file:///usr/share/doc/bubblewrap/README.Debian.gz for more
details.

-- Simon McVittie <sm...@debian.org> Tue, 12 May 2026 18:57:32 +0100

>
> Thanks for reporting and the root cause analysis. Luckily the just
> released kas 5.5 has bubblewrap 0.11.0-2+deb13u1, hence is not
> affected.
>
> But fixing this is probably not easy :/ Maybe Cedric can have a look,
> as he wrote the corresponding logic.
>
> Best regards,
> Felix
>
> >
> > HTH,
> > Uli
> > --
> > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> > To view this discussion visit https://groups.google.com/d/msgid/isar-users/7f7d4378-0c04-4b57-8af9-428725213c53n%40googlegroups.com.
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.

> To view this discussion visit https://groups.google.com/d/msgid/isar-users/64b5d7ff601632bff533f1407e3e2aa13b010208.camel%40siemens.com.

[MOESSBAUER, Felix]

At least in kas the bubblewrap is already installed without suid.
However, the latest release brings more hardenings like prohibiting to
over-mount a symlink - which bites us here as we over-mount /bin.

Working on a fix...

Felix