mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-02 05:33:57 -09:00
108f51c1b3
Fixes CVE-2026-41163, which affects any system using bubblewrap 0.11.x using a setuid bubblewrap. Release notes: https://github.com/containers/bubblewrap/releases/tag/v0.11.2 Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Julien Olivain <ju.o@free.fr>
46 lines
1.3 KiB
Makefile
46 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# bubblewrap
|
|
#
|
|
################################################################################
|
|
|
|
BUBBLEWRAP_VERSION = 0.11.2
|
|
BUBBLEWRAP_SITE = https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)
|
|
BUBBLEWRAP_SOURCE = bubblewrap-$(BUBBLEWRAP_VERSION).tar.xz
|
|
BUBBLEWRAP_DEPENDENCIES = host-pkgconf libcap
|
|
|
|
BUBBLEWRAP_LICENSE = LGPL-2.0+
|
|
BUBBLEWRAP_LICENSE_FILES = COPYING
|
|
BUBBLEWRAP_CPE_ID_VENDOR = projectatomic
|
|
|
|
BUBBLEWRAP_CONF_OPTS = \
|
|
-Dzsh_completion=disabled \
|
|
-Dman=disabled \
|
|
-Dpython=$(HOST_DIR)/bin/python \
|
|
-Drequire_userns=false \
|
|
-Dsupport_setuid=true \
|
|
-Dtests=false
|
|
|
|
ifeq ($(BR2_PACKAGE_BASH_COMPLETION),y)
|
|
BUBBLEWRAP_CONF_OPTS += \
|
|
-Dbash_completion=enabled \
|
|
-Dbash_completion_dir=/usr/share/bash-completion/completions
|
|
else
|
|
BUBBLEWRAP_CONF_OPTS += -Dbash_completion=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
|
|
BUBBLEWRAP_CONF_OPTS += -Dselinux=enabled
|
|
BUBBLEWRAP_DEPENDENCIES += libselinux
|
|
else
|
|
BUBBLEWRAP_CONF_OPTS += -Dselinux=disabled
|
|
endif
|
|
|
|
# We need to mark bwrap as setuid, in case the kernel
|
|
# has user namespaces disabled for non-root users.
|
|
define BUBBLEWRAP_PERMISSIONS
|
|
/usr/bin/bwrap f 1755 0 0 - - - - -
|
|
endef
|
|
|
|
$(eval $(meson-package))
|