--bind non-world-x path with --unshare-user
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- c, linux
- Domain
- operating-systems, security
Research direction
Start by tracing where resolve_symlinks_in_ops runs relative to creation of the new UID namespace when handling --bind and --unshare-user. Reproduce the non-world-x bind-source failure as root, then verify that the completed change permits the bind mount without weakening the sandbox’s namespace behavior.
Written by the indexing model from the issue text.
Description
resolve_symlinks_in_ops appears to be called after setting up the new UID namespace, when it no longer has privileges to access the bind source. So even running bwrap as root, I can't bind mount a non-world-x path.
- Dominant language
- C
- Stars
- 9k
- Forks
- 393
- Avg merge
- 1d 32m
- Merged PRs (30d)
- 7
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from containers/bubblewrap
-
README: writable --bind paths are not isolated from hardlinks created outside the sandboxPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#813 · 3 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
containers/bubblewrap#767 · 2 comments ·
Maintainers usually reply within 1 day
-
Related project comparisons in README.md are outdatedMay be free again A pull request for this issue was closed without being merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#743 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
containers/bubblewrap#298 · 4 comments · 5 reactions ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
containers/bubblewrap#811 ·
Maintainers usually reply within 1 day
All issues in containers/bubblewrap
Similar issues
-
UB: (int) cast of a user double outside int range in dispatch / vm_index_is_int / flat_index_atOpenarea:runtime-vm
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
InauguralSystems/EigenScript#1748 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
wasm-micro-runtime/wasm-micro-runtime#5159 ·
Maintainers usually reply within 7 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 Half a day Newbie friendliness 62/100
Maintainers usually reply within 1 day