commit 9789bce

bubblewrap: import from oasis

1@@ -303,3 +303,7 @@
2 [submodule "pkg/squashfs-tools-ng/src"]
3 	path = pkg/squashfs-tools-ng/src
4 	url = https://github.com/AgentD/squashfs-tools-ng
5+[submodule "pkg/bubblewrap/src"]
6+	path = pkg/bubblewrap/src
7+	url = https://github.com/containers/bubblewrap
8+	ignore = all

1@@ -0,0 +1 @@
2+/bwrap.1.gz

  1@@ -0,0 +1,529 @@
  2+'\" t
  3+.\"     Title: bwrap
  4+.\"    Author: Alexander Larsson
  5+.\" Generator: DocBook XSL Stylesheets v1.79.2 <http://docbook.sf.net/>
  6+.\"      Date: 07/04/2023
  7+.\"    Manual: User Commands
  8+.\"    Source: Project Atomic
  9+.\"  Language: English
 10+.\"
 11+.TH "BWRAP" "1" "" "Project Atomic" "User Commands"
 12+.\" -----------------------------------------------------------------
 13+.\" * Define some portability stuff
 14+.\" -----------------------------------------------------------------
 15+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 16+.\" http://bugs.debian.org/507673
 17+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
 18+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 19+.ie \n(.g .ds Aq \(aq
 20+.el       .ds Aq '
 21+.\" -----------------------------------------------------------------
 22+.\" * set default formatting
 23+.\" -----------------------------------------------------------------
 24+.\" disable hyphenation
 25+.nh
 26+.\" disable justification (adjust text to left margin only)
 27+.ad l
 28+.\" -----------------------------------------------------------------
 29+.\" * MAIN CONTENT STARTS HERE *
 30+.\" -----------------------------------------------------------------
 31+.SH "NAME"
 32+bwrap \- container setup utility
 33+.SH "SYNOPSIS"
 34+.HP \w'\fBbwrap\fR\ 'u
 35+\fBbwrap\fR [\fIOPTION\fR...] [\fICOMMAND\fR]
 36+.SH "DESCRIPTION"
 37+.PP
 38+\fBbwrap\fR
 39+is a privileged helper for container setup\&. You are unlikely to use it directly from the commandline, although that is possible\&.
 40+.PP
 41+It works by creating a new, completely empty, filesystem namespace where the root is on a tmpfs that is invisible from the host, and which will be automatically cleaned up when the last process exits\&. You can then use commandline options to construct the root filesystem and process environment for the command to run in the namespace\&.
 42+.PP
 43+By default,
 44+\fBbwrap\fR
 45+creates a new mount namespace for the sandbox\&. Optionally it also sets up new user, ipc, pid, network and uts namespaces (but note the user namespace is required if bwrap is not installed setuid root)\&. The application in the sandbox can be made to run with a different UID and GID\&.
 46+.PP
 47+If needed (e\&.g\&. when using a PID namespace)
 48+\fBbwrap\fR
 49+is running a minimal pid 1 process in the sandbox that is responsible for reaping zombies\&. It also detects when the initial application process (pid 2) dies and reports its exit status back to the original spawner\&. The pid 1 process exits to clean up the sandbox when there are no other processes in the sandbox left\&.
 50+.SH "OPTIONS"
 51+.PP
 52+When options are used multiple times, the last option wins, unless otherwise specified\&.
 53+.PP
 54+General options:
 55+.PP
 56+\fB\-\-help\fR
 57+.RS 4
 58+Print help and exit
 59+.RE
 60+.PP
 61+\fB\-\-version\fR
 62+.RS 4
 63+Print version
 64+.RE
 65+.PP
 66+\fB\-\-args \fR\fBFD\fR
 67+.RS 4
 68+Parse nul\-separated arguments from the given file descriptor\&. This option can be used multiple times to parse options from multiple sources\&.
 69+.RE
 70+.PP
 71+Options related to kernel namespaces:
 72+.PP
 73+\fB\-\-unshare\-user\fR
 74+.RS 4
 75+Create a new user namespace
 76+.RE
 77+.PP
 78+\fB\-\-unshare\-user\-try\fR
 79+.RS 4
 80+Create a new user namespace if possible else skip it
 81+.RE
 82+.PP
 83+\fB\-\-unshare\-ipc\fR
 84+.RS 4
 85+Create a new ipc namespace
 86+.RE
 87+.PP
 88+\fB\-\-unshare\-pid\fR
 89+.RS 4
 90+Create a new pid namespace
 91+.RE
 92+.PP
 93+\fB\-\-unshare\-net\fR
 94+.RS 4
 95+Create a new network namespace
 96+.RE
 97+.PP
 98+\fB\-\-unshare\-uts\fR
 99+.RS 4
100+Create a new uts namespace
101+.RE
102+.PP
103+\fB\-\-unshare\-cgroup\fR
104+.RS 4
105+Create a new cgroup namespace
106+.RE
107+.PP
108+\fB\-\-unshare\-cgroup\-try\fR
109+.RS 4
110+Create a new cgroup namespace if possible else skip it
111+.RE
112+.PP
113+\fB\-\-unshare\-all\fR
114+.RS 4
115+Unshare all possible namespaces\&. Currently equivalent with:
116+\fB\-\-unshare\-user\-try\fR
117+\fB\-\-unshare\-ipc\fR
118+\fB\-\-unshare\-pid\fR
119+\fB\-\-unshare\-net\fR
120+\fB\-\-unshare\-uts\fR
121+\fB\-\-unshare\-cgroup\-try\fR
122+.RE
123+.PP
124+\fB\-\-share\-net\fR
125+.RS 4
126+Retain the network namespace, overriding an earlier
127+\fB\-\-unshare\-all\fR
128+or
129+\fB\-\-unshare\-net\fR
130+.RE
131+.PP
132+\fB\-\-userns \fR\fBFD\fR
133+.RS 4
134+Use an existing user namespace instead of creating a new one\&. The namespace must fulfil the permission requirements for setns(), which generally means that it must be a descendant of the currently active user namespace, owned by the same user\&.
135+.sp
136+This is incompatible with \-\-unshare\-user, and doesn\*(Aqt work in the setuid version of bubblewrap\&.
137+.RE
138+.PP
139+\fB\-\-userns2 \fR\fBFD\fR
140+.RS 4
141+After setting up the new namespace, switch into the specified namespace\&. For this to work the specified namespace must be a descendant of the user namespace used for the setup, so this is only useful in combination with \-\-userns\&.
142+.sp
143+This is useful because sometimes bubblewrap itself creates nested user namespaces (to work around some kernel issues) and \-\-userns2 can be used to enter these\&.
144+.RE
145+.PP
146+\fB\-\-disable\-userns\fR
147+.RS 4
148+Prevent the process in the sandbox from creating further user namespaces, so that it cannot rearrange the filesystem namespace or do other more complex namespace modification\&. This is currently implemented by setting the
149+user\&.max_user_namespaces
150+sysctl to 1, and then entering a nested user namespace which is unable to raise that limit in the outer namespace\&. This option requires
151+\fB\-\-unshare\-user\fR, and doesn\*(Aqt work in the setuid version of bubblewrap\&.
152+.RE
153+.PP
154+\fB\-\-assert\-userns\-disabled\fR
155+.RS 4
156+Confirm that the process in the sandbox has been prevented from creating further user namespaces, but without taking any particular action to prevent that\&. For example, this can be combined with
157+\fB\-\-userns\fR
158+to check that the given user namespace has already been set up to prevent the creation of further user namespaces\&.
159+.RE
160+.PP
161+\fB\-\-pidns \fR\fBFD\fR
162+.RS 4
163+Use an existing pid namespace instead of creating one\&. This is often used with \-\-userns, because the pid namespace must be owned by the same user namespace that bwrap uses\&.
164+.sp
165+Note that this can be combined with \-\-unshare\-pid, and in that case it means that the sandbox will be in its own pid namespace, which is a child of the passed in one\&.
166+.RE
167+.PP
168+\fB\-\-uid \fR\fBUID\fR
169+.RS 4
170+Use a custom user id in the sandbox (requires
171+\fB\-\-unshare\-user\fR)
172+.RE
173+.PP
174+\fB\-\-gid \fR\fBGID\fR
175+.RS 4
176+Use a custom group id in the sandbox (requires
177+\fB\-\-unshare\-user\fR)
178+.RE
179+.PP
180+\fB\-\-hostname \fR\fBHOSTNAME\fR
181+.RS 4
182+Use a custom hostname in the sandbox (requires
183+\fB\-\-unshare\-uts\fR)
184+.RE
185+.PP
186+Options about environment setup:
187+.PP
188+\fB\-\-chdir \fR\fBDIR\fR
189+.RS 4
190+Change directory to
191+DIR
192+.RE
193+.PP
194+\fB\-\-setenv \fR\fBVAR\fR\fB \fR\fBVALUE\fR
195+.RS 4
196+Set an environment variable
197+.RE
198+.PP
199+\fB\-\-unsetenv \fR\fBVAR\fR
200+.RS 4
201+Unset an environment variable
202+.RE
203+.PP
204+\fB\-\-clearenv\fR
205+.RS 4
206+Unset all environment variables, except for
207+\fBPWD\fR
208+and any that are subsequently set by
209+\fB\-\-setenv\fR
210+.RE
211+.PP
212+Options for monitoring the sandbox from the outside:
213+.PP
214+\fB\-\-lock\-file \fR\fBDEST\fR
215+.RS 4
216+Take a lock on
217+DEST
218+while the sandbox is running\&. This option can be used multiple times to take locks on multiple files\&.
219+.RE
220+.PP
221+\fB\-\-sync\-fd \fR\fBFD\fR
222+.RS 4
223+Keep this file descriptor open while the sandbox is running
224+.RE
225+.PP
226+Filesystem related options\&. These are all operations that modify the filesystem directly, or mounts stuff in the filesystem\&. These are applied in the order they are given as arguments\&.
227+.PP
228+Any missing parent directories that are required to create a specified destination are automatically created as needed\&. Their permissions are normally set to 0755 (rwxr\-xr\-x)\&. However, if a
229+\fB\-\-perms\fR
230+option is in effect, and it sets the permissions for group or other to zero, then newly\-created parent directories will also have their corresponding permission set to zero\&.
231+\fB\-\-size\fR
232+modifies the size of the created mount when preceding a
233+\fB\-\-tmpfs\fR
234+action;
235+\fB\-\-perms\fR
236+and
237+\fB\-\-size\fR
238+can be combined\&.
239+.PP
240+\fB\-\-perms \fR\fBOCTAL\fR
241+.RS 4
242+This option does nothing on its own, and must be followed by one of the options that it affects\&. It sets the permissions for the next operation to
243+OCTAL\&. Subsequent operations are not affected: for example,
244+\-\-perms 0700 \-\-tmpfs /a \-\-tmpfs /b
245+will mount
246+/a
247+with permissions 0700, then return to the default permissions for
248+/b\&. Note that
249+\fB\-\-perms\fR
250+and
251+\fB\-\-size\fR
252+can be combined:
253+\-\-perms 0700 \-\-size 10485760 \-\-tmpfs /s
254+will apply permissions as well as a maximum size to the created tmpfs\&.
255+.RE
256+.PP
257+\fB\-\-size \fR\fBBYTES\fR
258+.RS 4
259+This option does nothing on its own, and must be followed by
260+\-\-tmpfs\&. It sets the size in bytes for the next tmpfs\&. For example,
261+\-\-size 10485760 \-\-tmpfs /tmp
262+will create a tmpfs at
263+/tmp
264+of size 10MiB\&. Subsequent operations are not affected: for example,
265+\-\-size 10485760 \-\-tmpfs /a \-\-tmpfs /b
266+will mount
267+/a
268+with size 10MiB, then return to the default size for
269+/b\&. Note that
270+\fB\-\-perms\fR
271+and
272+\fB\-\-size\fR
273+can be combined:
274+\-\-size 10485760 \-\-perms 0700 \-\-tmpfs /s
275+will apply permissions as well as a maximum size to the created tmpfs\&.
276+.RE
277+.PP
278+\fB\-\-bind \fR\fBSRC\fR\fB \fR\fBDEST\fR
279+.RS 4
280+Bind mount the host path
281+SRC
282+on
283+DEST
284+.RE
285+.PP
286+\fB\-\-bind\-try \fR\fBSRC\fR\fB \fR\fBDEST\fR
287+.RS 4
288+Equal to
289+\fB\-\-bind\fR
290+but ignores non\-existent
291+SRC
292+.RE
293+.PP
294+\fB\-\-dev\-bind \fR\fBSRC\fR\fB \fR\fBDEST\fR
295+.RS 4
296+Bind mount the host path
297+SRC
298+on
299+DEST, allowing device access
300+.RE
301+.PP
302+\fB\-\-dev\-bind\-try \fR\fBSRC\fR\fB \fR\fBDEST\fR
303+.RS 4
304+Equal to
305+\fB\-\-dev\-bind\fR
306+but ignores non\-existent
307+SRC
308+.RE
309+.PP
310+\fB\-\-ro\-bind \fR\fBSRC\fR\fB \fR\fBDEST\fR
311+.RS 4
312+Bind mount the host path
313+SRC
314+readonly on
315+DEST
316+.RE
317+.PP
318+\fB\-\-ro\-bind\-try \fR\fBSRC\fR\fB \fR\fBDEST\fR
319+.RS 4
320+Equal to
321+\fB\-\-ro\-bind\fR
322+but ignores non\-existent
323+SRC
324+.RE
325+.PP
326+\fB\-\-remount\-ro \fR\fBDEST\fR
327+.RS 4
328+Remount the path
329+DEST
330+as readonly\&. It works only on the specified mount point, without changing any other mount point under the specified path
331+.RE
332+.PP
333+\fB\-\-proc \fR\fBDEST\fR
334+.RS 4
335+Mount procfs on
336+DEST
337+.RE
338+.PP
339+\fB\-\-dev \fR\fBDEST\fR
340+.RS 4
341+Mount new devtmpfs on
342+DEST
343+.RE
344+.PP
345+\fB\-\-tmpfs \fR\fBDEST\fR
346+.RS 4
347+Mount new tmpfs on
348+DEST\&. If the previous option was
349+\fB\-\-perms\fR, it sets the mode of the tmpfs\&. Otherwise, the tmpfs has mode 0755\&. If the previous option was
350+\fB\-\-size\fR, it sets the size in bytes of the tmpfs\&. Otherwise, the tmpfs has the default size\&.
351+.RE
352+.PP
353+\fB\-\-mqueue \fR\fBDEST\fR
354+.RS 4
355+Mount new mqueue on
356+DEST
357+.RE
358+.PP
359+\fB\-\-dir \fR\fBDEST\fR
360+.RS 4
361+Create a directory at
362+DEST\&. If the directory already exists, its permissions are unmodified, ignoring
363+\fB\-\-perms\fR
364+(use
365+\fB\-\-chmod\fR
366+if the permissions of an existing directory need to be changed)\&. If the directory is newly created and the previous option was
367+\fB\-\-perms\fR, it sets the mode of the directory\&. Otherwise, newly\-created directories have mode 0755\&.
368+.RE
369+.PP
370+\fB\-\-file \fR\fBFD\fR\fB \fR\fBDEST\fR
371+.RS 4
372+Copy from the file descriptor
373+FD
374+to
375+DEST\&. If the previous option was
376+\fB\-\-perms\fR, it sets the mode of the new file\&. Otherwise, the file has mode 0666 (note that this is not the same as
377+\fB\-\-bind\-data\fR)\&.
378+.RE
379+.PP
380+\fB\-\-bind\-data \fR\fBFD\fR\fB \fR\fBDEST\fR
381+.RS 4
382+Copy from the file descriptor
383+FD
384+to a file which is bind\-mounted on
385+DEST\&. If the previous option was
386+\fB\-\-perms\fR, it sets the mode of the new file\&. Otherwise, the file has mode 0600 (note that this is not the same as
387+\fB\-\-file\fR)\&.
388+.RE
389+.PP
390+\fB\-\-ro\-bind\-data \fR\fBFD\fR\fB \fR\fBDEST\fR
391+.RS 4
392+Copy from the file descriptor
393+FD
394+to a file which is bind\-mounted read\-only on
395+DEST\&. If the previous option was
396+\fB\-\-perms\fR, it sets the mode of the new file\&. Otherwise, the file has mode 0600 (note that this is not the same as
397+\fB\-\-file\fR)\&.
398+.RE
399+.PP
400+\fB\-\-symlink \fR\fBSRC\fR\fB \fR\fBDEST\fR
401+.RS 4
402+Create a symlink at
403+DEST
404+with target
405+SRC
406+.RE
407+.PP
408+\fB\-\-chmod \fR\fBOCTAL\fR\fB \fR\fBPATH\fR
409+.RS 4
410+Set the permissions of
411+PATH, which must already exist, to
412+OCTAL\&.
413+.RE
414+.PP
415+Lockdown options:
416+.PP
417+\fB\-\-seccomp \fR\fBFD\fR
418+.RS 4
419+Load and use seccomp rules from
420+FD\&. The rules need to be in the form of a compiled cBPF program, as generated by seccomp_export_bpf\&. If this option is given more than once, only the last one is used\&. Use
421+\fB\-\-add\-seccomp\-fd\fR
422+if multiple seccomp programs are needed\&.
423+.RE
424+.PP
425+\fB\-\-add\-seccomp\-fd \fR\fBFD\fR
426+.RS 4
427+Load and use seccomp rules from
428+FD\&. The rules need to be in the form of a compiled cBPF program, as generated by seccomp_export_bpf\&. This option can be repeated, in which case all the seccomp programs will be loaded in the order given (note that the kernel will evaluate them in reverse order, so the last program on the bwrap command\-line is evaluated first)\&. All of them, except possibly the last, must allow use of the PR_SET_SECCOMP prctl\&. This option cannot be combined with
429+\fB\-\-seccomp\fR\&.
430+.RE
431+.PP
432+\fB\-\-exec\-label \fR\fBLABEL\fR
433+.RS 4
434+Exec Label from the sandbox\&. On an SELinux system you can specify the SELinux context for the sandbox process(s)\&.
435+.RE
436+.PP
437+\fB\-\-file\-label \fR\fBLABEL\fR
438+.RS 4
439+File label for temporary sandbox content\&. On an SELinux system you can specify the SELinux context for the sandbox content\&.
440+.RE
441+.PP
442+\fB\-\-block\-fd \fR\fBFD\fR
443+.RS 4
444+Block the sandbox on reading from FD until some data is available\&.
445+.RE
446+.PP
447+\fB\-\-userns\-block\-fd \fR\fBFD\fR
448+.RS 4
449+Do not initialize the user namespace but wait on FD until it is ready\&. This allow external processes (like newuidmap/newgidmap) to setup the user namespace before it is used by the sandbox process\&.
450+.RE
451+.PP
452+\fB\-\-info\-fd \fR\fBFD\fR
453+.RS 4
454+Write information in JSON format about the sandbox to FD\&.
455+.RE
456+.PP
457+\fB\-\-json\-status\-fd \fR\fBFD\fR
458+.RS 4
459+Multiple JSON documents are written to
460+FD, one per line (\m[blue]\fB"JSON lines" format\fR\m[]\&\s-2\u[1]\d\s+2)\&. Each line is a single JSON object\&. After
461+\fBbwrap\fR
462+has started the child process inside the sandbox, it writes an object with a
463+child\-pid
464+member to the
465+\fB\-\-json\-status\-fd\fR
466+(this duplicates the older
467+\fB\-\-info\-fd\fR)\&. The corresponding value is the process ID of the child process in the pid namespace from which
468+\fBbwrap\fR
469+was run\&. If available, the namespace IDs are also included in the object with the
470+child\-pid; again, this duplicates the older
471+\fB\-\-info\-fd\fR\&. When the child process inside the sandbox exits,
472+\fBbwrap\fR
473+writes an object with an exit\-code member, and then closes the
474+\fB\-\-json\-status\-fd\fR\&. The value corresponding to
475+exit\-code
476+is the exit status of the child, in the usual shell encoding (n if it exited normally with status n, or 128+n if it was killed by signal n)\&. Other members may be added to those objects in future versions of
477+\fBbwrap\fR, and other JSON objects may be added before or after the current objects, so readers must ignore members and objects that they do not understand\&.
478+.RE
479+.PP
480+\fB\-\-new\-session\fR
481+.RS 4
482+Create a new terminal session for the sandbox (calls setsid())\&. This disconnects the sandbox from the controlling terminal which means the sandbox can\*(Aqt for instance inject input into the terminal\&.
483+.sp
484+Note: In a general sandbox, if you don\*(Aqt use \-\-new\-session, it is recommended to use seccomp to disallow the TIOCSTI ioctl, otherwise the application can feed keyboard input to the terminal\&.
485+.RE
486+.PP
487+\fB\-\-die\-with\-parent\fR
488+.RS 4
489+Ensures child process (COMMAND) dies when bwrap\*(Aqs parent dies\&. Kills (SIGKILL) all bwrap sandbox processes in sequence from parent to child including COMMAND process when bwrap or bwrap\*(Aqs parent dies\&. See prctl, PR_SET_PDEATHSIG\&.
490+.RE
491+.PP
492+\fB\-\-as\-pid\-1\fR
493+.RS 4
494+Do not create a process with PID=1 in the sandbox to reap child processes\&.
495+.RE
496+.PP
497+\fB\-\-cap\-add \fR\fBCAP\fR
498+.RS 4
499+Add the specified capability when running as privileged user\&. It accepts the special value ALL to add all the permitted caps\&.
500+.RE
501+.PP
502+\fB\-\-cap\-drop \fR\fBCAP\fR
503+.RS 4
504+Drop the specified capability when running as privileged user\&. It accepts the special value ALL to drop all the caps\&. By default no caps are left in the sandboxed process\&. The
505+\fB\-\-cap\-add\fR
506+and
507+\fB\-\-cap\-drop\fR
508+options are processed in the order they are specified on the command line\&. Please be careful to the order they are specified\&.
509+.RE
510+.SH "ENVIRONMENT"
511+.PP
512+\fBHOME\fR
513+.RS 4
514+Used as the cwd in the sandbox if
515+\fB\-\-chdir\fR
516+has not been explicitly specified and the current cwd is not present inside the sandbox\&. The
517+\fB\-\-setenv\fR
518+option can be used to override the value that is used here\&.
519+.RE
520+.SH "EXIT STATUS"
521+.PP
522+The
523+\fBbwrap\fR
524+command returns the exit status of the initial application process (pid 2 in the sandbox)\&.
525+.SH "NOTES"
526+.IP " 1." 4
527+"JSON lines" format
528+.RS 4
529+\%https://jsonlines.org/
530+.RE

 1@@ -0,0 +1,9 @@
 2+BEGIN {
 3+	print "static const char *const cap_names[] = {"
 4+}
 5+/^#define CAP_[^[:space:]]+[[:space:]]+[0-9]+[[:space:]]*$/ {
 6+	printf "\t[%d] = \"%s\",\n", $3, tolower($2)
 7+}
 8+END {
 9+	print "};"
10+}

 1@@ -0,0 +1,17 @@
 2+#include <assert.h>
 3+#include <limits.h>
 4+#include <string.h>
 5+#include "caps.h"
 6+
 7+int
 8+cap_from_name(const char *name)
 9+{
10+	int i;
11+
12+	static_assert(sizeof cap_names / sizeof *cap_names <= INT_MAX);
13+	for (i = 0; i < sizeof cap_names / sizeof *cap_names; ++i) {
14+		if (cap_names[i] && strcmp(cap_names[i], name) == 0)
15+			return i;
16+	}
17+	return -1;
18+}

1@@ -0,0 +1 @@
2+#define PACKAGE_STRING "bubblewrap 0.8.0"

 1@@ -0,0 +1,25 @@
 2+cflags{
 3+	'-std=c99',
 4+	'-Wall', '-Wpedantic', '-Wvla',
 5+	'-D _GNU_SOURCE',
 6+	'-I $dir',
 7+}
 8+
 9+build('awk', '$outdir/caps.h', {
10+	'$builddir/pkg/linux-headers/include/linux/capability.h',
11+	'|', '$dir/caps.awk',
12+}, {expr='-f $dir/caps.awk'})
13+
14+build('cc', '$outdir/caps.c.o', {'$dir/caps.c', '|', '$outdir/caps.h'}, {cflags='-I $outdir'})
15+
16+exe('bwrap', {
17+	'bubblewrap.c',
18+	'bind-mount.c',
19+	'network.c',
20+	'utils.c',
21+	'caps.c.o',
22+})
23+file('bin/bwrap', '755', '$outdir/bwrap')
24+man{'$dir/bwrap.1'}
25+
26+fetch 'git'

 1@@ -0,0 +1,51 @@
 2+From f399ecdc5cc4a3d6563b9ea3c8984c3832d655ea Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Tue, 4 Jul 2023 10:44:15 -0700
 5+Subject: [PATCH] utils: Avoid unnecessary VLAs
 6+
 7+---
 8+ utils.c | 10 ++++------
 9+ 1 file changed, 4 insertions(+), 6 deletions(-)
10+
11+diff --git a/utils.c b/utils.c
12+index 693273b..6845283 100644
13+--- a/utils.c
14++++ b/utils.c
15+@@ -727,15 +727,14 @@ send_pid_on_socket (int socket)
16+   char buf[1] = { 0 };
17+   struct msghdr msg = {};
18+   struct iovec iov = { buf, sizeof (buf) };
19+-  const ssize_t control_len_snd = CMSG_SPACE(sizeof(struct ucred));
20+-  char control_buf_snd[control_len_snd];
21++  char control_buf_snd[CMSG_SPACE(sizeof(struct ucred))];
22+   struct cmsghdr *cmsg;
23+   struct ucred *cred;
24+ 
25+   msg.msg_iov = &iov;
26+   msg.msg_iovlen = 1;
27+   msg.msg_control = control_buf_snd;
28+-  msg.msg_controllen = control_len_snd;
29++  msg.msg_controllen = sizeof (control_buf_snd);
30+ 
31+   cmsg = CMSG_FIRSTHDR(&msg);
32+   cmsg->cmsg_level = SOL_SOCKET;
33+@@ -769,14 +768,13 @@ read_pid_from_socket (int socket)
34+   char recv_buf[1] = { 0 };
35+   struct msghdr msg = {};
36+   struct iovec iov = { recv_buf, sizeof (recv_buf) };
37+-  const ssize_t control_len_rcv = CMSG_SPACE(sizeof(struct ucred));
38+-  char control_buf_rcv[control_len_rcv];
39++  char control_buf_rcv[CMSG_SPACE(sizeof(struct ucred))];
40+   struct cmsghdr* cmsg;
41+ 
42+   msg.msg_iov = &iov;
43+   msg.msg_iovlen = 1;
44+   msg.msg_control = control_buf_rcv;
45+-  msg.msg_controllen = control_len_rcv;
46++  msg.msg_controllen = sizeof (control_buf_rcv);
47+ 
48+   if (recvmsg (socket, &msg, 0) < 0)
49+     die_with_error ("Can't read pid from socket");
50+-- 
51+2.37.3
52+

 1@@ -0,0 +1,25 @@
 2+From 21b0b65179640a795394a9664862d797aaca9120 Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Tue, 4 Jul 2023 18:57:02 -0700
 5+Subject: [PATCH] Break up long string literal
 6+
 7+---
 8+ bubblewrap.c | 2 ++
 9+ 1 file changed, 2 insertions(+)
10+
11+diff --git a/bubblewrap.c b/bubblewrap.c
12+index 8322ea0..ceb4beb 100644
13+--- a/bubblewrap.c
14++++ b/bubblewrap.c
15+@@ -339,6 +339,8 @@ usage (int ecode, FILE *out)
16+            "    --dev-bind-try SRC DEST      Equal to --dev-bind but ignores non-existent SRC\n"
17+            "    --ro-bind SRC DEST           Bind mount the host path SRC readonly on DEST\n"
18+            "    --ro-bind-try SRC DEST       Equal to --ro-bind but ignores non-existent SRC\n"
19++           );
20++  fprintf (out,
21+            "    --remount-ro DEST            Remount DEST as readonly; does not recursively remount\n"
22+            "    --exec-label LABEL           Exec label for the sandbox\n"
23+            "    --file-label LABEL           File label for temporary sandbox content\n"
24+-- 
25+2.37.3
26+

 1@@ -0,0 +1,63 @@
 2+From 095786df5a2eb12f7996a183a16912cbb8368105 Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Tue, 4 Jul 2023 19:04:48 -0700
 5+Subject: [PATCH] Avoid statement expressions for TEMP_FAILURE_RETRY
 6+
 7+---
 8+ bubblewrap.c | 19 ++++++++-----------
 9+ 1 file changed, 8 insertions(+), 11 deletions(-)
10+
11+diff --git a/bubblewrap.c b/bubblewrap.c
12+index ceb4beb..608009d 100644
13+--- a/bubblewrap.c
14++++ b/bubblewrap.c
15+@@ -44,14 +44,6 @@
16+ #define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */
17+ #endif
18+ 
19+-#ifndef TEMP_FAILURE_RETRY
20+-#define TEMP_FAILURE_RETRY(expression) \
21+-  (__extension__                                                              \
22+-    ({ long int __result;                                                     \
23+-       do __result = (long int) (expression);                                 \
24+-       while (__result == -1L && errno == EINTR);                             \
25+-       __result; }))
26+-#endif
27+ 
28+ /* We limit the size of a tmpfs to half the architecture's address space,
29+  * to avoid hitting arbitrary limits in the kernel.
30+@@ -467,7 +459,8 @@ report_child_exit_status (int exitc, int setup_finished_fd)
31+   if (opt_json_status_fd == -1 || setup_finished_fd == -1)
32+     return;
33+ 
34+-  s = TEMP_FAILURE_RETRY (read (setup_finished_fd, data, sizeof data));
35++  do s = read (setup_finished_fd, data, sizeof data);
36++  while (s == -1 && errno == EINTR);
37+   if (s == -1 && errno != EAGAIN)
38+     die_with_error ("read eventfd");
39+   if (s != 1) // Is 0 if pipe closed before exec, is 2 if closed after exec.
40+@@ -2953,7 +2946,9 @@ main (int    argc,
41+       if (opt_userns_block_fd != -1)
42+         {
43+           char b[1];
44+-          (void) TEMP_FAILURE_RETRY (read (opt_userns_block_fd, b, 1));
45++          ssize_t s;
46++          do s = read (opt_userns_block_fd, b, 1);
47++          while (s == -1 && errno == EINTR);
48+           close (opt_userns_block_fd);
49+         }
50+ 
51+@@ -3238,7 +3233,9 @@ main (int    argc,
52+   if (opt_block_fd != -1)
53+     {
54+       char b[1];
55+-      (void) TEMP_FAILURE_RETRY (read (opt_block_fd, b, 1));
56++      ssize_t s;
57++      do s = read (opt_block_fd, b, 1);
58++      while (s == -1 && errno == EINTR);
59+       close (opt_block_fd);
60+     }
61+ 
62+-- 
63+2.37.3
64+

 1@@ -0,0 +1,74 @@
 2+From 1939348d3a1e8238464cd4c52743b04fa52ebed1 Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Tue, 4 Jul 2023 19:20:51 -0700
 5+Subject: [PATCH] Use external string-to-cap function
 6+
 7+---
 8+ bubblewrap.c | 15 ++++++++++-----
 9+ 1 file changed, 10 insertions(+), 5 deletions(-)
10+
11+diff --git a/bubblewrap.c b/bubblewrap.c
12+index 608009d..71c8bd0 100644
13+--- a/bubblewrap.c
14++++ b/bubblewrap.c
15+@@ -30,8 +30,8 @@
16+ #include <sys/eventfd.h>
17+ #include <sys/fsuid.h>
18+ #include <sys/signalfd.h>
19+-#include <sys/capability.h>
20+ #include <sys/prctl.h>
21++#include <linux/capability.h>
22+ #include <linux/sched.h>
23+ #include <linux/seccomp.h>
24+ #include <linux/filter.h>
25+@@ -44,6 +44,9 @@
26+ #define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */
27+ #endif
28+ 
29++int capset(void *, void *);
30++int capget(void *, void *);
31++int cap_from_name(const char *);
32+ 
33+ /* We limit the size of a tmpfs to half the architecture's address space,
34+  * to avoid hitting arbitrary limits in the kernel.
35+@@ -2358,7 +2361,7 @@ parse_args_recurse (int          *argcp,
36+         }
37+       else if (strcmp (arg, "--cap-add") == 0)
38+         {
39+-          cap_value_t cap;
40++          int cap;
41+           if (argc < 2)
42+             die ("--cap-add takes an argument");
43+ 
44+@@ -2370,7 +2373,8 @@ parse_args_recurse (int          *argcp,
45+             }
46+           else
47+             {
48+-              if (cap_from_name (argv[1], &cap) < 0)
49++              cap = cap_from_name (argv[1]);
50++              if (cap < 0)
51+                 die ("unknown cap: %s", argv[1]);
52+ 
53+               if (cap < 32)
54+@@ -2384,7 +2388,7 @@ parse_args_recurse (int          *argcp,
55+         }
56+       else if (strcmp (arg, "--cap-drop") == 0)
57+         {
58+-          cap_value_t cap;
59++          int cap;
60+           if (argc < 2)
61+             die ("--cap-drop takes an argument");
62+ 
63+@@ -2396,7 +2400,8 @@ parse_args_recurse (int          *argcp,
64+             }
65+           else
66+             {
67+-              if (cap_from_name (argv[1], &cap) < 0)
68++              cap = cap_from_name (argv[1]);
69++              if (cap < 0)
70+                 die ("unknown cap: %s", argv[1]);
71+ 
72+               if (cap < 32)
73+-- 
74+2.37.3
75+

1@@ -0,0 +1 @@
2+Subproject commit 4ab175fe6d3a4053444b04d805a6d686f53455b9

1@@ -0,0 +1 @@
2+0.8.0 r0

1@@ -5,6 +5,7 @@ subgen 'b3sum'
2 subgen 'bc'
3 subgen 'bearssl'
4 subgen 'binutils'
5+subgen 'bubblewrap'
6 subgen 'byacc'
7 subgen 'bzip2'
8 subgen 'cacert'