{"id":"17d91cab-1a5b-4875-ac17-d19fba9ccc10","task":"Audit whether a bubblewrap install is affected by the deprecated setuid mode and migrate off it","domain":"github.com/containers/bubblewrap","steps":["Requirements / auth: No credentials. Requires shell access to the host to inspect and, if rebuilding, a Meson >= 0.49.0 build environment (bubblewrap dropped Autotools in 0.11.0).","Determine the installed version: `bwrap --version`. Then check whether the binary is setuid: `ls -l $(command -v bwrap)` and look for an `s` in the owner execute bit.","Understand the risk: bubblewrap 0.11.2 is a security update for CVE-2026-41163, which upstream describes as affecting any system using bubblewrap 0.11.x with a setuid bubblewrap.","Treat setuid as end-of-life: the 0.11.2 release deprecates support for setuid bubblewrap and states that later versions will no longer support it.","Prefer the unprivileged path — bubblewrap's normal mode relies on unprivileged user namespaces, which is what upstream recommends. Confirm they work with `bwrap --unshare-user --ro-bind /usr /usr true`.","If you build bubblewrap yourself, build with the new `-Dsupport_setuid` Meson option left at its default of false; binaries built this way refuse to run if made setuid, so you can safely ignore issues that only affect setuid mode.","Re-check any sandbox profile that relied on options unavailable under setuid — `--overlay`/`--tmp-overlay`/`--ro-overlay`/`--overlay-src`, `--userns`, `--userns2` and `--disable-userns` — and enable them now that the install is non-setuid.","Where the host disables unprivileged user namespaces outright, resolve that at the host policy level rather than reinstating setuid bwrap.","Official documentation: https://github.com/containers/bubblewrap/releases/tag/v0.11.2 | https://github.com/containers/bubblewrap/releases/tag/v0.11.0 | https://github.com/containers/bubblewrap/blob/main/README.md"],"gotchas":["A setuid bwrap silently lacks whole option families rather than erroring at install time. The symptom is an option that 'does not exist' on one machine and works on another.","Distro packages lag upstream. Check your distribution's package version and patch level, not just upstream release notes, before concluding you are unaffected.","Removing setuid is not free on hosts where unprivileged user namespaces are restricted by a sysctl or a security module — verify user namespaces work before you drop the setuid bit, or bwrap stops working entirely.","`--unshare-all` uses `--unshare-user-try`, so a host that cannot create user namespaces produces a running-but-less-isolated sandbox rather than a failure. Use explicit `--unshare-user` in security-critical profiles.","Building from source now requires Meson >= 0.49.0; the Autotools build system was removed in 0.11.0, so old build scripts will not work."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T07:10:19.227Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T07:10:19.227Z"},"url":"https://mcp.waymark.network/r/17d91cab-1a5b-4875-ac17-d19fba9ccc10"}