Sync from SUSE:SLFO:Main bubblewrap revision fff141c75f115004a887951a8465cf33
This commit is contained in:
commit
7f8d3bcb83
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
BIN
bubblewrap-0.8.0.tar.xz
(Stored with Git LFS)
Normal file
BIN
bubblewrap-0.8.0.tar.xz
(Stored with Git LFS)
Normal file
Binary file not shown.
417
bubblewrap.changes
Normal file
417
bubblewrap.changes
Normal file
@ -0,0 +1,417 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Mar 27 16:39:05 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>
|
||||
|
||||
- update to v0.8.0:
|
||||
* Add --disable-userns option to prevent the sandbox from
|
||||
creating its own nested user namespace
|
||||
* Add --assert-userns-disabled option to check that an existing
|
||||
userns was created with --disable-userns
|
||||
* Give a clearer error message if the kernel doesn't have
|
||||
CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Dec 7 21:50:27 UTC 2022 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
- update to v0.7.0:
|
||||
* --size option controls the size of a subsequent --tmpfs (#509)
|
||||
* Better error messages if a mount operation fails (#472)
|
||||
* Better error message if creating the new user namespace fails with
|
||||
ENOSPC (#487)
|
||||
* When building as a Meson subproject, a RUNPATH can be set on the
|
||||
executable to make it easier to bundle its libcap dependency
|
||||
* Fix test failures when running as uid 0 but with limited capabilities
|
||||
(#510)
|
||||
* Use POSIX command -v in preference to non-standard which (#527)
|
||||
* Fix a copy/paste error in --help (#531)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 18 12:43:26 UTC 2022 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
|
||||
- Update to version 0.6.2:
|
||||
+ New features in Meson build:
|
||||
- Auto-detect whether the man page can be generated.
|
||||
- -Dbwrapdir=... changes the installation directory (useful
|
||||
when being used as a subproject).
|
||||
- -Dtests=false disables unit tests.
|
||||
+ Bug fixes:
|
||||
- Add --add-seccomp-fd to shell completions
|
||||
- Document --add-seccomp-fd, --json-status-fd and --share-net
|
||||
in the man page
|
||||
- Add attributes to silence various compiler warnings
|
||||
- Allow compilation of tests with musl on mips architectures
|
||||
- Allow compilation with older glibc
|
||||
- Disable sanitizers for a test helper whose seccomp profile
|
||||
breaks the instrumentation
|
||||
- Disable AddressSanitizer leak detection where it interferes
|
||||
with unit testing
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Mar 4 18:13:15 UTC 2022 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||
|
||||
- Update to 0.6.1:
|
||||
- Add a release checklist
|
||||
- completions: Make zsh completion non-executable
|
||||
The Autotools build system installed it with 0644 permissions because
|
||||
it's listed as DATA, but the Meson build system installs executable
|
||||
files as executable by default.
|
||||
zsh completions don't need to be executable to work, and this one doesn't
|
||||
have the `#!` marker that should start an executable script.
|
||||
- update to 0.6.0:
|
||||
- meson: Improve compatibility with Meson 0.49
|
||||
That version doesn't allow more than two arguments for define_variable.
|
||||
- Disable test-specifying-pidns.sh under 'meson dist' while I investigate
|
||||
This test is hanging when run under 'meson dist' for some reason, but
|
||||
not when run under 'meson test', and not locally, only in the Github
|
||||
Workflow-based CI. Disable it for now.
|
||||
- meson: Actually build and run the tests
|
||||
- tests: Fix compiler warnings for unused arguments
|
||||
- meson: Run test scripts from $srcdir
|
||||
- meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
|
||||
- meson: Run the Python test script with Python, not bash
|
||||
The python build option can be used to swap to a different interpreter,
|
||||
for environments like the Steam Runtime where the python3 executable in
|
||||
the PATH is extremely old but there is a better interpreter available.
|
||||
This is treated as non-optional, because Meson is written in Python,
|
||||
so the situation where there is no Python interpreter at build-time
|
||||
shouldn't arise.
|
||||
- meson: Build the try-syscall helper
|
||||
- meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
|
||||
- meson.build: Remove unnecessary check for sh
|
||||
- Add a Meson build system
|
||||
This allows bwrap to be built as a subproject in larger Meson projects.
|
||||
When built as a subproject, we install into the --libexecdir and
|
||||
require a program prefix to be specified: for example, Flatpak would use
|
||||
program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
|
||||
be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
|
||||
Loosely based on previous work by Jussi Pakkanen (see #133).
|
||||
Differences between the Autotools and Meson builds:
|
||||
The Meson build requires a version of libcap that has pkg-config
|
||||
metadata (introduced in libcap 2.23, in 2013).
|
||||
The Meson build has no equivalent of --with-priv-mode=setuid. On
|
||||
distributions like Debian <= 10 and RHEL <= 7 that require a setuid bwrap
|
||||
executable, the sysadmin or distribution packaging will need to set the
|
||||
correct permissions on the bwrap executable; Debian already did this via
|
||||
packaging rather than the upstream build system.
|
||||
The Meson build supports being used as a subproject, and there is CI
|
||||
for this. It automatically disables shell completions and man pages,
|
||||
moves the bubblewrap executable to ${libexecdir}, and renames the
|
||||
bubblewrap executable according to a program_prefix option that the
|
||||
caller must specify (for example, Flatpak would use
|
||||
-Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
|
||||
tests/use-as-subproject/ directory for an example.
|
||||
- Use HEAD to refer to other projects' default branches in documentation
|
||||
This makes the URL independent of the name they have chosen for their
|
||||
default branches.
|
||||
- workflows: Update for rename of default branch to main
|
||||
- tests: Exercise seccomp filters
|
||||
- Allow loading more than one seccomp program
|
||||
This will allow Flatpak to combine an allow-list (default-deny) of
|
||||
known system calls with a deny-list (default-allow) of system calls
|
||||
that are undesired.
|
||||
Resolves: https://github.com/containers/bubblewrap/issues/453
|
||||
- Generalize linked lists of LockFile and SetupOp
|
||||
I'm about to add a third linked list, for seccomp programs, which would
|
||||
seem like too much duplication.
|
||||
- Handle argc == 0 better
|
||||
Unfortunately it's possible for argc to be 0, so error out pretty early
|
||||
on in that case. I don't think this is a security issue in this case.
|
||||
- Fix typo
|
||||
- Remove trailing whitespace
|
||||
- Fix spelling
|
||||
- bash: Fix shellcheck warnings
|
||||
- bash: Invoke bash using /usr/bin/env
|
||||
- bubblewrap: Avoid a -Wjump-misses-init false-positive
|
||||
When building with -Wjump-misses-init as part of a larger project, gcc
|
||||
reports that we jump past initialization of cover_proc_dirs. This is
|
||||
technically true, but we only use this variable in the case where it's
|
||||
initialized, so that's harmless.
|
||||
However, we can avoid this altogether by making the array static and
|
||||
constant, which allows it to be moved from initialized data to read-only
|
||||
data.
|
||||
- bind-mount: Be more const-correct
|
||||
When compiled with -Wwrite-strings as part of a larger project, gcc and
|
||||
clang both warn that we're assigning a string constant to a mutable
|
||||
struct member. There's actually no reason why it should be mutable, so
|
||||
make it const.
|
||||
- die_with_error: Save errno sooner
|
||||
We need to save errno immediately, otherwise it could be overwritten
|
||||
by a failing library call somewhere in the implementation of fprintf.
|
||||
- main: Warn when non-repeatable options are repeated
|
||||
A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
|
||||
would load seccomp programs from both fds 3 and 4, but in fact it only
|
||||
loads the program from fd 4.
|
||||
Helps: https://github.com/containers/bubblewrap/issues/453
|
||||
Resolves: https://github.com/containers/bubblewrap/issues/454
|
||||
- utils: Add warn()
|
||||
- Add SPDX-License-Identifier for files that already specify license
|
||||
This is a step towards REUSE compliance. Third-party files that we do
|
||||
not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
|
||||
- tests: Use preferred spelling for SPDX license identifiers
|
||||
- Remove obsolete .travis.yml
|
||||
We no longer use Travis-CI.
|
||||
- Remove obsolete papr CI
|
||||
We no longer use this.
|
||||
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 20 18:52:20 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||
|
||||
- Update to version 0.5.0:
|
||||
+ New features:
|
||||
- --chmod changes permissions
|
||||
- --clearenv unsets every environment variable (except PWD)
|
||||
- --perms sets permissions for one subsequent --bind-data,
|
||||
--dir, --file, --ro-bind-data or --tmpfs
|
||||
+ Other enhancements:
|
||||
- Better diagnostics when a --bind or other bind-mount fails
|
||||
- zsh tab-completion
|
||||
- Better test coverage
|
||||
+ Bug fixes:
|
||||
- Use Python 3 for tests and examples
|
||||
- Mount points for non-directories are created with permissions
|
||||
-r--r--r-- instead of -rw-rw-rw-
|
||||
- Don't remount items in /proc read-only if already EROFS,
|
||||
required to run under Docker
|
||||
- Allow mounting an non-directory over an existing
|
||||
non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
|
||||
/dev/log
|
||||
- Silence kernel messages for our bind-mounts
|
||||
- Make sure pkg-config is checked for, regardless of build
|
||||
options
|
||||
- Improve ability to bind-mount directories on case-insensitive
|
||||
filesystems
|
||||
- Fix -Wshadow warnings
|
||||
- Fix deprecation warnings with newer SELinux
|
||||
- Add new subpackage bubblewrap-zsh-completion
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Apr 1 10:03:39 UTC 2020 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||
|
||||
- Update to version 0.4.1:
|
||||
* retcode: fix return code with syncfd and no event_fd
|
||||
* Ensure we're always clearing the cap bounding set
|
||||
* tests: Update output patterns for libcap >= 2.29
|
||||
* Don't rely on geteuid() to know when to switch back from setuid root
|
||||
* Don't support --userns2 in setuid mode
|
||||
* fixes CVE-2020-5291
|
||||
* fixes bsc#1168291
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Dec 20 22:59:52 UTC 2019 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||
|
||||
- Update to version 0.4.0:
|
||||
+ The biggest feature in this release is the support for joining
|
||||
existing user and pid namespaces. This doesn't work in the
|
||||
setuid mode (at the moment).
|
||||
+ Other changes:
|
||||
- Stores namespace info in status json.
|
||||
- In setuid mode pid 1 is now marked dumpable.
|
||||
- Now builds with musl libc.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 7 14:38:21 UTC 2019 - Antonio Larrosa <alarrosa@suse.com>
|
||||
|
||||
- Use /bin/bash instead of /usr/bin/bash in SLE12
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat Jun 1 15:08:49 UTC 2019 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||
|
||||
- Update to version 0.3.3:
|
||||
- This release is the same as 0.3.2 but the version number in configure.ac
|
||||
was accidentally still set to 0.3.1
|
||||
- Update to version 0.3.2:
|
||||
- fixes boo#1136958 / CVE-2019-12439
|
||||
This release fixes a mostly theoretical security issue in unusual/broken
|
||||
setups where `$XDG_RUNTIME_DIR` is unset.
|
||||
There are some other smaller fixes, as well as an addition to the JSON
|
||||
API that allows reading the inner process exit code, separately from
|
||||
the `bwrap` exit code.
|
||||
- Print "Out of memory" on stderr, not stdout
|
||||
- bwrap: add option json-status-fd to show child exit code
|
||||
- bwrap: Report COMMAND exit code in json-status-fd
|
||||
- man page: Describe --chdir, not nonexistent --cwd
|
||||
- Don't create our own temporary mount point for pivot_root
|
||||
- Make lockdata long enough on 32-bit with 64-bit file pointers.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Oct 11 16:41:12 UTC 2018 - Antonio Larrosa <alarrosa@suse.com> - 0.3.1
|
||||
|
||||
- update to version 0.3.1:
|
||||
* New feature in this release is --bind-try (as well as --dev-bind-try
|
||||
and --ro-bind-try) which works like the regular versions if the source
|
||||
exists, but does nothing if it doesn't exist.
|
||||
|
||||
* The mount type for the root tmpfs was also changed to "tmpfs" instead
|
||||
of being empty, as the later could cause problems with some programs
|
||||
when parsing the mountinfo files in /proc.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat Jul 14 20:06:50 UTC 2018 - sebix+novell.com@sebix.at
|
||||
|
||||
- update to version 0.3.0:
|
||||
* The biggest feature from this release is that bwrap
|
||||
now supports being invoked recursively (from other container
|
||||
runtimes such as Docker/podman/runc as well as bwrap itself)
|
||||
when user namespaces are enabled, and the outer container manager
|
||||
allows it (Docker's default seccomp policy doesn't).
|
||||
|
||||
* This is useful for testing scenarios; for example a project
|
||||
uses Kubernetes for its CI, but inside build the project wants to run
|
||||
each unit test in their own pid namespace, without going out
|
||||
and creating a new pod for every single unit test.
|
||||
|
||||
* Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
|
||||
and we want to support running rpm-ostree inside a container as well.
|
||||
|
||||
* Another feature is bwrap now supports -- to terminate argument
|
||||
parsing. To detect availablity of this, you could parse bwrap --version.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue May 1 21:02:33 UTC 2018 - sebix+novell.com@sebix.at
|
||||
|
||||
- update to version 0.2.1:
|
||||
* All the demos are included
|
||||
* bugfixes for the demo files
|
||||
* There was an issue with mkdir when running bubblewrap on an NFS
|
||||
filesystem that has been fixed, so flatpak now works on NFS shares.
|
||||
* Some leaks have been fixed, including a file descriptor leak.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Oct 9 17:53:37 UTC 2017 - sebix+novell.com@sebix.at
|
||||
|
||||
- update to version 0.2.0
|
||||
- bwrap now automatically detects the new
|
||||
user namespace restrictions in Red Hat Enterprise Linux 7.4:
|
||||
bubblewrap: check for max_user_namespaces == 0.
|
||||
- The most notable features are new arguments --as-pid1, and
|
||||
--cap-add/--cap-drop. These were added for running systemd (or in general a
|
||||
"full" init system) inside bubblewrap. But the capability options are also
|
||||
useful for unprivileged callers to potentially retain capbilities inside the
|
||||
sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
|
||||
Conversely, privileged callers (uid 0) can conversely drop capabilities (without
|
||||
user namespaces). Contributed by Giuseppe Scrivano.
|
||||
- With --dev, add /dev/fd and /dev/core symlinks
|
||||
which should improve compatibility with older software.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 18 12:39:54 UTC 2017 - sebix+novell.com@sebix.at
|
||||
|
||||
- add group
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 7 09:40:27 UTC 2017 - sebix+novell.com@sebix.at
|
||||
|
||||
- fix build macro with rpm < 4.12 (non-Factory currently)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu May 25 21:15:49 UTC 2017 - sebix+novell.com@sebix.at
|
||||
|
||||
- update to version 0.1.8
|
||||
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
|
||||
- smaller bugfixes
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Mar 2 09:08:58 UTC 2017 - sebix+novell.com@sebix.at
|
||||
|
||||
- upgrade to upstream version 0.1.7
|
||||
- note that this package was *never* affected by CVE-2017-5226
|
||||
as it was introduced in version 0.1.6
|
||||
- upstream changelog of version 0.1.7:
|
||||
This release backs out the change in 0.1.6 which unconditionally
|
||||
called setsid() in order to fix a security issue with TIOCSTI, aka
|
||||
CVE-2017-522. That change caused some behavioural issues that are
|
||||
hard to work with in some cases. For instance, it makes shell job
|
||||
control not work for the bwrap command.
|
||||
Instead there is now a new option --new-session which works like
|
||||
0.1.6. It is recommended that you use this if possible, but if not we
|
||||
recommended that you neutralize this some other way, for instance
|
||||
using SECCOMP, which is what flatpak does:
|
||||
https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
|
||||
In order to make it easy to create maximally safe sandboxes we have
|
||||
also added a new commandline switch called --unshare-all. It unshares
|
||||
all possible namespaces and is currently equivalent with:
|
||||
--unshare-user-try --unshare-ipc --unshare-pid --unshare-net
|
||||
--unshare-uts --unshare-cgroup-try
|
||||
However, the intent is that as new namespaces are added to the kernel they will
|
||||
be added to this list. Additionally, if --share-net is specified the network
|
||||
namespace is not unshared.
|
||||
This release also has some bugfixes:
|
||||
bwrap reaps (unexpected) children that are inherited from the
|
||||
parent, something which can happen if bwrap is part of a shell
|
||||
pipeline.
|
||||
bwrap clears the capability bounding set. The permitted
|
||||
capabilities was already empty, and use of PR_NO_NEW_PRIVS should
|
||||
make it impossible to increase the capabilities, but more
|
||||
layers of protection is better.
|
||||
The seccomp filter is now installed at the very end of bwrap, which
|
||||
means the requirement of the filter is minimal. Any bwrap seccomp
|
||||
filter must at least allow: execve, waitpid and write
|
||||
Alexander Larsson (7):
|
||||
Handle inherited children dying
|
||||
Clear capability bounding set
|
||||
Make the call to setsid() optional, with --new-session
|
||||
demos/bubblewrap-shell.sh: Unshare all namespaces
|
||||
Call setsid() and setexeccon() befor forking the init monitor
|
||||
Install seccomp filter at the very end
|
||||
Bump version to 0.1.7
|
||||
Colin Walters (6):
|
||||
Release 0.1.6
|
||||
man: Correct namespace user -> mount
|
||||
demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
|
||||
Release 0.1.6
|
||||
ci: Combine ASAN and UBSAN
|
||||
Add --unshare-all and --share-net
|
||||
- upstream changelog for 0.1.6:
|
||||
This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
|
||||
far from the only program that has this issue, and I think the best fix is
|
||||
probably in the kernel to support disabling this ioctl.
|
||||
|
||||
Programs can also work around this by calling setsid() on their own in an exec
|
||||
handler before doing an exevp("bwrap").
|
||||
- upstream changelog for 0.1.5:
|
||||
This is a bugfix release, here are the major changes:
|
||||
Running bubblewrap as root now works again
|
||||
Various fixes for the testsuite
|
||||
Use same default compiler warnings as ostree
|
||||
Handle errors resolving symlinks during bind mounts
|
||||
Alexander Larsson (2):
|
||||
bind-mount: Check for errors in realpath()
|
||||
Bump version to 0.1.5
|
||||
Colin Walters (6):
|
||||
Don't call capset() unless we need to
|
||||
Only --unshare-user automatically if we're not root
|
||||
ci: Modernize a bit, add f25-ubsan
|
||||
README.md: Update with better one liner and more information
|
||||
utils: Add __attribute__((printf)) to die()
|
||||
build: Sync default warning -> error set from ostree
|
||||
Simon McVittie (4):
|
||||
test-run: be a bash script
|
||||
test-run: don't assume we are uid 1000
|
||||
Adapt tests so they can be run against installed binaries
|
||||
Fix incorrect nesting of backticks when finding a FUSE mount
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Dec 16 10:14:32 UTC 2016 - sebix+novell.com@sebix.at
|
||||
|
||||
- upgrade to upstream version 0.1.4
|
||||
- Build also for Leap 42.2
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Oct 14 2016 Colin Walters <walters@verbum.org> - 0.1.3-2
|
||||
|
||||
- New upstream version
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 12 2016 Kalev Lember <klember@redhat.com> - 0.1.2-1
|
||||
|
||||
- Update to 0.1.2
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jul 12 2016 Igor Gnatenko <ignatenko@redhat.com> - 0.1.1-2
|
||||
|
||||
- Trivial fixes in packaging
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 08 2016 Colin Walters <walters@verbum.org> - 0.1.1
|
||||
|
||||
- Initial package
|
||||
84
bubblewrap.spec
Normal file
84
bubblewrap.spec
Normal file
@ -0,0 +1,84 @@
|
||||
#
|
||||
# spec file for package bubblewrap
|
||||
#
|
||||
# Copyright (c) 2023 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
# upon. The license for this file, and modifications and additions to the
|
||||
# file, is the same license as for the pristine package itself (unless the
|
||||
# license for the pristine package is not an Open Source License, in which
|
||||
# case the license is the MIT License). An "Open Source License" is a
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
Name: bubblewrap
|
||||
Version: 0.8.0
|
||||
Release: 0
|
||||
Summary: Core execution tool for unprivileged containers
|
||||
License: LGPL-2.0-or-later
|
||||
Group: Productivity/Security
|
||||
URL: https://github.com/containers/bubblewrap
|
||||
Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.xz
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
BuildRequires: docbook-xsl-stylesheets
|
||||
BuildRequires: gcc
|
||||
BuildRequires: git
|
||||
BuildRequires: libcap-devel
|
||||
BuildRequires: libtool
|
||||
BuildRequires: libxslt
|
||||
BuildRequires: pkgconfig
|
||||
BuildRequires: pkgconfig(libselinux)
|
||||
|
||||
%description
|
||||
Bubblewrap (%{_bindir}/bwrap) is a core execution engine for unprivileged
|
||||
containers that works as a setuid binary on kernels without
|
||||
user namespaces.
|
||||
|
||||
%package zsh-completion
|
||||
Summary: Zsh tab-completion for bubblewrap
|
||||
Group: System/Shells
|
||||
Supplements: (%{name} and zsh)
|
||||
|
||||
%description zsh-completion
|
||||
This package provides zsh tab-completion for bubblewrap.
|
||||
|
||||
%prep
|
||||
%autosetup -p1 -n %{name}-%{version}
|
||||
sed -i '1d' completions/bash/bwrap
|
||||
%if 0%{?suse_version} < 1500
|
||||
sed -i '1s,/usr/bin/env bash,/bin/bash,' demos/bubblewrap-shell.sh
|
||||
sed -i '1s/env //' demos/userns-block-fd.py
|
||||
%else
|
||||
sed -i '1s/env //' demos/bubblewrap-shell.sh demos/userns-block-fd.py
|
||||
%endif
|
||||
|
||||
%build
|
||||
env NOCONFIGURE=1 ./autogen.sh
|
||||
%configure --disable-silent-rules --with-priv-mode=none
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
%make_install DESTDIR=%{buildroot} INSTALL="install -p -c"
|
||||
find %{buildroot} -type f -name "*.la" -delete -print
|
||||
|
||||
%files
|
||||
%license COPYING
|
||||
%doc README.md demos
|
||||
%dir %{_datadir}/bash-completion
|
||||
%dir %{_datadir}/bash-completion/completions
|
||||
%{_datadir}/bash-completion/completions/bwrap
|
||||
%{_bindir}/bwrap
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%files zsh-completion
|
||||
%dir %{_datadir}/zsh
|
||||
%dir %{_datadir}/zsh/site-functions
|
||||
%{_datadir}/zsh/site-functions/_bwrap
|
||||
|
||||
%changelog
|
||||
Loading…
Reference in New Issue
Block a user