Security follow-up to #50: receive patched bubblewrap 0.12.0 and setup-time escape evidence #79

New issue

Closed

opened 2026-10-08 15:51:47 +00:00 by kilo · 4 comments

kilo commented 2026-10-08 15:51:47 +00:00

Member

Copy link

Goal

Receive the patched maintained bubblewrap verification/test-child profile after GHSA-pxhw-h44j-8pfx / CVE-2026-87766, preserving #50's selected role and existing trust/lifetime requirements. Registration is explicitly authorized by the owner's 2026-10-08 bounded #53 research mandate; this issue is not selected for implementation by that mandate.

Why

ADR0008 and current setup/adapter pin upstream0.11.0 commit9ca3b05ec787acfb4b17bed37db5719fa777834f. Upstream advisory identifies affected versions <0.12.0, patched0.12.0 commit2a76602a8c71f36c1527cf9fc3417d9149822e0c (2026-08-26). Vulnerable setup pathname operations can traverse attacker-controlled symlinks before child seccomp executes. Previous successful runtime negative tests do not receive this setup-time vulnerability.

Scope

Re-evaluate current fixed invocation's applicability with source-backed preconditions and synthetic native evidence. Migrate exact external-tool/source/build provenance and version refusals to patched upstream with correct license/archive handling; preserve default-deny profile. Recertify source-specific reaper parent-death readiness/exec gate, PID1 proc mask, descendant settlement and all verification-only native denials. Do not broaden #50 to harness isolation.

Acceptance Criteria

1. Independently verify exact advisory, fixed revision/safe_openat2 setup semantics and applicability of current empty-root/regular-file snapshot/no-symlink/non-overlapping trusted-resource invocation. Distinguish source assessment from actual native exploit/refusal evidence.
2. Patched exact setup supports only audited archive links and recorded source/binary/libseccomp provenance; unsupported/fake versions and unsafe setup trees refuse, no fail-open --not-a-security-boundary mode or weaker namespace flags.
3. Synthetic native setup-time malicious-symlink/proc-magiclink regression demonstrates no effect on a synthetic host canary, plus existing runtime isolation/forced pre-arming/cancel/crash/setsid/settlement/bystander suite passes with zero skipped required native cases.
4. Reaper readiness ordering is re-received against actual patched source/binary; matching version or previous0.11 receipt is not enough. All current authorization/unknown-cleanup gates retained.
5. LGPL-2.1-or-later patched-distribution rights/build/link notices (including COPYING.LIB -> COPYING) documented truthfully; no source/binary bundled or copied by assumption.
6. Required check/package/audit/native gates and fresh exact-HEAD independent security-critical review. #50 history remains unchanged and this profile stays verification/test-child only. Neither #50 nor this issue proves whole-worker isolation or strict native effect expiry. #53/PR #85 is closed NOT IMPLEMENTED; its post-expiry diagnostic remains evidence of the gap, not a promotion of this profile. This issue does not close or weaken the accepted AC4 baseline.

Constraints

No production activation, security-setting changes, private inputs, live inference, scope promotion or automatic trust migration. Registration only; owner selection required before implementation. Existing trusted-resource/ancestor concurrency assumptions remain explicit. Seccomp and /proc/1 mask are runtime controls, not the upstream setup-time fix.

Links

• Triggering research: #78
• Prior scoped profile: #50
• Separate worker gate: #53
• https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx
• github.com/containers/bubblewrap@2a76602a8c

Non-Goals

No reopening or silent expansion of #50, no whole-worker architecture replacement, no claim existing fixed configuration is exploitable without its missing preconditions, no safety claim from historical native tests.

## Goal Receive the patched maintained bubblewrap verification/test-child profile after GHSA-pxhw-h44j-8pfx / CVE-2026-87766, preserving #50's selected role and existing trust/lifetime requirements. Registration is explicitly authorized by the owner's 2026-10-08 bounded #53 research mandate; this issue is not selected for implementation by that mandate. ## Why ADR0008 and current setup/adapter pin upstream0.11.0 commit9ca3b05ec787acfb4b17bed37db5719fa777834f. Upstream advisory identifies affected versions <0.12.0, patched0.12.0 commit2a76602a8c71f36c1527cf9fc3417d9149822e0c (2026-08-26). Vulnerable setup pathname operations can traverse attacker-controlled symlinks before child seccomp executes. Previous successful runtime negative tests do not receive this setup-time vulnerability. ## Scope Re-evaluate current fixed invocation's applicability with source-backed preconditions and synthetic native evidence. Migrate exact external-tool/source/build provenance and version refusals to patched upstream with correct license/archive handling; preserve default-deny profile. Recertify source-specific reaper parent-death readiness/exec gate, PID1 proc mask, descendant settlement and all verification-only native denials. Do not broaden #50 to harness isolation. ## Acceptance Criteria 1. Independently verify exact advisory, fixed revision/safe_openat2 setup semantics and applicability of current empty-root/regular-file snapshot/no-symlink/non-overlapping trusted-resource invocation. Distinguish source assessment from actual native exploit/refusal evidence. 2. Patched exact setup supports only audited archive links and recorded source/binary/libseccomp provenance; unsupported/fake versions and unsafe setup trees refuse, no fail-open --not-a-security-boundary mode or weaker namespace flags. 3. Synthetic native setup-time malicious-symlink/proc-magiclink regression demonstrates no effect on a synthetic host canary, plus existing runtime isolation/forced pre-arming/cancel/crash/setsid/settlement/bystander suite passes with zero skipped required native cases. 4. Reaper readiness ordering is re-received against actual patched source/binary; matching version or previous0.11 receipt is not enough. All current authorization/unknown-cleanup gates retained. 5. LGPL-2.1-or-later patched-distribution rights/build/link notices (including COPYING.LIB -> COPYING) documented truthfully; no source/binary bundled or copied by assumption. 6. Required check/package/audit/native gates and fresh exact-HEAD independent security-critical review. #50 history remains unchanged and this profile stays verification/test-child only. Neither #50 nor this issue proves whole-worker isolation or strict native effect expiry. #53/PR #85 is closed NOT IMPLEMENTED; its post-expiry diagnostic remains evidence of the gap, not a promotion of this profile. This issue does not close or weaken the accepted AC4 baseline. ## Constraints No production activation, security-setting changes, private inputs, live inference, scope promotion or automatic trust migration. Registration only; owner selection required before implementation. Existing trusted-resource/ancestor concurrency assumptions remain explicit. Seccomp and /proc/1 mask are runtime controls, not the upstream setup-time fix. ## Links - Triggering research: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/78 - Prior scoped profile: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/50 - Separate worker gate: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/53 - https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx - https://github.com/containers/bubblewrap/tree/2a76602a8c71f36c1527cf9fc3417d9149822e0c ## Non-Goals No reopening or silent expansion of #50, no whole-worker architecture replacement, no claim existing fixed configuration is exploitable without its missing preconditions, no safety claim from historical native tests.

kilo commented 2026-10-08 21:50:48 +00:00

Author

Member

Copy link

Explicit Owner Required Ordering: #80 Before #79

Owner directive 2026-10-08T21:50:06Z resumes kernel-loop-20261008T204521Z and requires #80 BEFORE #79: integrate existing bubblewrap security repin PR #82 first; after verified #80 completion rebuild canonical queue and deliver #79 separately if eligible. All #79 acceptance criteria remain unchanged, especially AC3's setup-time malicious-symlink/proc-magiclink regression with observed absence of synthetic host-canary effects. #80's existing runtime-negative-suite rerun does not receive this additional setup-time proof. This issue remains OPEN, not duplicate, not silently consolidated or prematurely completed. Ordering is now owner-settled and must not trigger another ordering decision. No weaker profile, production activation, live inference, release/deployment or host-global change authorized.

## Explicit Owner Required Ordering: #80 Before #79 Owner directive 2026-10-08T21:50:06Z resumes `kernel-loop-20261008T204521Z` and requires **#80 BEFORE #79**: integrate existing bubblewrap security repin PR #82 first; after verified #80 completion rebuild canonical queue and deliver #79 separately if eligible. All #79 acceptance criteria remain unchanged, especially AC3's setup-time malicious-symlink/proc-magiclink regression with observed absence of synthetic host-canary effects. #80's existing runtime-negative-suite rerun does not receive this additional setup-time proof. This issue remains OPEN, not duplicate, not silently consolidated or prematurely completed. Ordering is now owner-settled and must not trigger another ordering decision. No weaker profile, production activation, live inference, release/deployment or host-global change authorized.

kilo referenced this issue 2026-10-08 21:55:30 +00:00

Repin ADR 0008 verification bubblewrap to 0.12.0+ (GHSA-pxhw-h44j-8pfx / CVE-2026-87766) #80

kilo referenced this issue 2026-10-08 22:11:15 +00:00

Repin verification bubblewrap to 0.13.0 (CVE-2026-87766) (#80) #82

kilo referenced this issue from a commit 2026-10-08 22:11:46 +00:00

Merge PR #82: verification bubblewrap security repin (#80)

kilo referenced this issue 2026-10-08 22:14:42 +00:00

Repin ADR 0008 verification bubblewrap to 0.12.0+ (GHSA-pxhw-h44j-8pfx / CVE-2026-87766) #80

adrian.tkacz referenced this issue from a commit 2026-10-09 02:44:43 +00:00

test: receive setup-time bwrap escape evidence with no host canary effect (#79)

kilo referenced this issue 2026-10-09 02:45:30 +00:00

Receive setup-time bubblewrap escape evidence (#79) #83

kilo commented 2026-10-09 02:46:29 +00:00

Author

Member

Copy link

Standalone ZCode/GLM-5.3 delivery — PR #83 opened; independent review in progress

Owner-ordered continuation after verified #80 integration (PR #82 merged cad1998d8, issue #80 closed). This issue remains open with its full original acceptance criteria; nothing was consolidated into #80.

Delivery (issue-79-bwrap-setup-receipt, HEAD 3b5c8b8a8d403d6ad8dbd377ff8edd1985b8e5ac, base cad1998d8…, single commit, 2 files +356/-6, no production code changed):

• AC3: synthetic native setup-time regression against the exact pinned 0.13.0 utility — positive control first (the same maintained --dir op genuinely writes through a writable bind of real content), then both advisory escape vectors (post-pivot /oldroot… host alias; live /proc/<pid>/fd/<fd> magic link) refuse during setup with the candidate never executed and the synthetic host canary byte-identical and untouched. Plus the existing runtime isolation/pre-arming/cancel/crash/setsid/settlement/bystander suite: 66 native cases, 0 skipped, on binary 7c0da12c… (same digest as the PR #82 receipt).
• AC2: structural refusal receipts — unsupported/fake version strings (native_version), wrong digest (native_provenance), unsafe scratch trees (scratch_ownership), fail-closed profile pinned with the 0.13.0 fail-open --not-a-security-boundary flag, -try namespace variants and --dev-bind absent.
• AC1: ADR 0008 now records the applicability analysis of the current empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource invocation as a source-backed assessment, explicitly separated from the native evidence.
• AC4: reaper readiness re-receipt confirmed on the pinned source/binary (585/611→613, 3533/3539; forced-interval regressions green).
• AC5: LGPL-2.1-or-later and archive licence-link record confirmed unchanged.

Validation: closed-env make check 1413 tests + 81 subtests PASS (74 honest native skips), make package-check PASS, make audit clean, make native-proof 66 PASS / 0 skip.

Fresh independent whole-PR review at this exact HEAD/base is dispatched (ordinal 1/10 for this delivery). Standalone work does not merge; PR #83 returns READY_TO_MERGE only after an exact-HEAD APPROVE and canonical CI.

**Standalone ZCode/GLM-5.3 delivery — PR #83 opened; independent review in progress** Owner-ordered continuation after verified #80 integration (PR #82 merged `cad1998d8`, issue #80 closed). This issue remains open with its full original acceptance criteria; nothing was consolidated into #80. **Delivery** (`issue-79-bwrap-setup-receipt`, HEAD `3b5c8b8a8d403d6ad8dbd377ff8edd1985b8e5ac`, base `cad1998d8…`, single commit, 2 files +356/-6, no production code changed): - **AC3**: synthetic native setup-time regression against the exact pinned 0.13.0 utility — positive control first (the same maintained `--dir` op genuinely writes through a writable bind of real content), then both advisory escape vectors (post-pivot `/oldroot…` host alias; live `/proc/<pid>/fd/<fd>` magic link) refuse during setup with the candidate never executed and the synthetic host canary byte-identical and untouched. Plus the existing runtime isolation/pre-arming/cancel/crash/setsid/settlement/bystander suite: 66 native cases, 0 skipped, on binary `7c0da12c…` (same digest as the PR #82 receipt). - **AC2**: structural refusal receipts — unsupported/fake version strings (`native_version`), wrong digest (`native_provenance`), unsafe scratch trees (`scratch_ownership`), fail-closed profile pinned with the 0.13.0 fail-open `--not-a-security-boundary` flag, `-try` namespace variants and `--dev-bind` absent. - **AC1**: ADR 0008 now records the applicability analysis of the current empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource invocation as a source-backed assessment, explicitly separated from the native evidence. - **AC4**: reaper readiness re-receipt confirmed on the pinned source/binary (585/611→613, 3533/3539; forced-interval regressions green). - **AC5**: LGPL-2.1-or-later and archive licence-link record confirmed unchanged. **Validation**: closed-env `make check` 1413 tests + 81 subtests PASS (74 honest native skips), `make package-check` PASS, `make audit` clean, `make native-proof` 66 PASS / 0 skip. Fresh independent whole-PR review at this exact HEAD/base is dispatched (ordinal 1/10 for this delivery). Standalone work does not merge; PR #83 returns READY_TO_MERGE only after an exact-HEAD APPROVE and canonical CI.

adrian.tkacz referenced this issue from a commit 2026-10-09 03:13:56 +00:00

fix: pin synthetic verifier fixture modes against runner umask (#79)

adrian.tkacz referenced this issue from a commit 2026-10-09 03:54:45 +00:00

fix: honor unprivileged platform gate in runner-independent refusal receipts (#79)

adrian.tkacz referenced this issue from a commit 2026-10-09 04:22:56 +00:00

docs: record delivered-head native-proof case count in the #79 receipt (#79)

kilo commented 2026-10-09 04:44:28 +00:00

Author

Member

Copy link

#79 delivery READY_TO_MERGE — PR #83 at exact HEAD dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5, base cad1998d8…; independent review APPROVE (ordinal 4, findings none); canonical CI #2401 SUCCESS on that exact head. Standalone work does not merge; this issue remains open pending owner-authorized integration.

Delivery summary (4 commits, 2 files, +397/-6; no production code, dependency or CI change):

• AC3: synthetic native setup-time malicious-symlink/proc-magiclink regression against the pinned 0.13.0 utility with a synthetic host canary — positive control proves the same maintained --dir op writes through a writable bind of real content; both advisory escape vectors (post-pivot /oldroot… alias; live /proc/<pid>/fd/<fd> magic link) die during setup with the candidate never executed and the canary byte-identical. Full native suite: 67 native-proof cases, 0 skipped, on binary 7c0da12c… (same digest as the PR #82 receipt).
• AC2: structural refusal receipts — unsupported/fake version strings, wrong digest, unsafe scratch trees, fail-closed profile pinned (fail-open --not-a-security-boundary, -try variants, --dev-bind absent), plus a deterministic root-runtime refusal receipt.
• AC1: ADR 0008 records the applicability analysis (empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource) as a source-backed assessment, explicitly separated from the native evidence.
• AC4: reaper readiness re-receipt confirmed on the patched pin (585/611→613; 3533/3539; forced-interval regressions green).
• AC5: LGPL-2.1-or-later and archive licence-link record confirmed unchanged.

Review history: ordinals 1-4 consumed (1 APPROVE at superseded 3b5c8b8; 2 COMMENT — canonical CI failures on the first two heads, root-caused to runner environment and fixed in a4ba20b; 3 REQUEST_CHANGES — one stale numeric record, fixed in dbb1369; 4 APPROVE with empty findings at the exact final head). All ordinals, CI runs #2398/#2399/#2400/#2401 and remediations are recorded transparently in the PR description and the excluded delivery ledger. No security gate was weakened; the profile remains verification/test-child only.

**#79 delivery READY_TO_MERGE — PR #83 at exact HEAD `dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5`, base `cad1998d8…`; independent review APPROVE (ordinal 4, findings none); canonical CI #2401 SUCCESS on that exact head. Standalone work does not merge; this issue remains open pending owner-authorized integration.** Delivery summary (4 commits, 2 files, +397/-6; no production code, dependency or CI change): - **AC3**: synthetic native setup-time malicious-symlink/proc-magiclink regression against the pinned 0.13.0 utility with a synthetic host canary — positive control proves the same maintained `--dir` op writes through a writable bind of real content; both advisory escape vectors (post-pivot `/oldroot…` alias; live `/proc/<pid>/fd/<fd>` magic link) die during setup with the candidate never executed and the canary byte-identical. Full native suite: 67 native-proof cases, 0 skipped, on binary `7c0da12c…` (same digest as the PR #82 receipt). - **AC2**: structural refusal receipts — unsupported/fake version strings, wrong digest, unsafe scratch trees, fail-closed profile pinned (fail-open `--not-a-security-boundary`, `-try` variants, `--dev-bind` absent), plus a deterministic root-runtime refusal receipt. - **AC1**: ADR 0008 records the applicability analysis (empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource) as a source-backed assessment, explicitly separated from the native evidence. - **AC4**: reaper readiness re-receipt confirmed on the patched pin (585/611→613; 3533/3539; forced-interval regressions green). - **AC5**: LGPL-2.1-or-later and archive licence-link record confirmed unchanged. Review history: ordinals 1-4 consumed (1 APPROVE at superseded `3b5c8b8`; 2 COMMENT — canonical CI failures on the first two heads, root-caused to runner environment and fixed in `a4ba20b`; 3 REQUEST_CHANGES — one stale numeric record, fixed in `dbb1369`; 4 APPROVE with empty findings at the exact final head). All ordinals, CI runs #2398/#2399/#2400/#2401 and remediations are recorded transparently in the PR description and the excluded delivery ledger. No security gate was weakened; the profile remains verification/test-child only.

adrian.tkacz referenced this issue from a commit 2026-10-09 05:50:29 +00:00

Merge pull request 'Receive setup-time bubblewrap escape evidence (#79)' (#83) from issue-79-bwrap-setup-receipt into develop

kilo referenced this issue 2026-10-09 11:43:16 +00:00

Real Codex app-server native proof inside the #78 OCI boundary (#53) #84

kilo commented 2026-10-18 14:25:52 +00:00

Author

Member

Copy link

Integrated Acceptance Evidence

• Existing PR #83 was merged on 2026-10-09 at 73e3af45c911aa9ae8c26b97bf0ec9f452063f10; original reviewed head dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5, base cad1998d814479cefafe61fe1397fe88fded8b85. Current develop is 40eea02cee517f7b31da01173739b23c510779b0; both PR head and merge commit are ancestors. This loop did not merge or advance that prior delivery.
• Required #80-before-#79 ordering is satisfied by PR #82, merged cad1998d814479cefafe61fe1397fe88fded8b85. The integrated adapter/setup and ADR record the exact bubblewrap 0.13.0 source pin, fail-closed profile, applicability analysis and reaper evidence. The exact setup-time tests include a positive writable-bind control and both oldroot-alias/proc-magiclink cases; they assert setup refusal, no candidate output, and unchanged synthetic canary/tree.
• Independent public checks this invocation verified the GHSA/CVE affected range and setup-time impact, and the exact pinned safe_openat.c RESOLVE_IN_ROOT|RESOLVE_NO_MAGICLINKS implementation/fallback. PR #83 records the exact-head ordinal-4 APPROVE with empty findings, CI #2401 success, and the 67-case/zero-skip native proof on the pinned binary SHA-256 7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237.
• Revalidation ordinals 5–8 were infrastructure COMMENTs with no code findings; the historical exact-head approval remains unchanged. No production profile promotion, live inference or external effects occurred.

Refs #79

## Integrated Acceptance Evidence - Existing PR #83 was merged on 2026-10-09 at `73e3af45c911aa9ae8c26b97bf0ec9f452063f10`; original reviewed head `dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5`, base `cad1998d814479cefafe61fe1397fe88fded8b85`. Current `develop` is `40eea02cee517f7b31da01173739b23c510779b0`; both PR head and merge commit are ancestors. This loop did not merge or advance that prior delivery. - Required #80-before-#79 ordering is satisfied by PR #82, merged `cad1998d814479cefafe61fe1397fe88fded8b85`. The integrated adapter/setup and ADR record the exact bubblewrap 0.13.0 source pin, fail-closed profile, applicability analysis and reaper evidence. The exact setup-time tests include a positive writable-bind control and both oldroot-alias/proc-magiclink cases; they assert setup refusal, no candidate output, and unchanged synthetic canary/tree. - Independent public checks this invocation verified the GHSA/CVE affected range and setup-time impact, and the exact pinned `safe_openat.c` `RESOLVE_IN_ROOT|RESOLVE_NO_MAGICLINKS` implementation/fallback. PR #83 records the exact-head ordinal-4 APPROVE with empty findings, CI #2401 success, and the 67-case/zero-skip native proof on the pinned binary SHA-256 `7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237`. - Revalidation ordinals 5–8 were infrastructure `COMMENT`s with no code findings; the historical exact-head approval remains unchanged. No production profile promotion, live inference or external effects occurred. Refs #79

kilo closed this issue 2026-10-18 14:26:00 +00:00

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

develop

issue-62-installed-compatibility

issue-58-private-outcome-export

issue-57-recovery-preparation-alerts

issue-57-owner-served-state

issue-106-final-authority-dag

issue-106-forgejo-ordinary-execution

issue-105-independent-provider-drivers

issue-59-work-resource-ownership

issue-56-atomic-approval-recovery

issue-56-work-budget-enforcement

issue-103-publish-architecture-backlog

issue-62-platform-reception

issue-55-mi-utilized-reference

issue-52-kilo-offline-proof

docs/conversational-review-policy

issue-60-reception-fixture-plan

issue-62-compatibility-matrix-spec

issue-58-export-rights-spec

issue-57-owner-state-spec

issue-56-task-cost-shapes

issue-90-owned-cancellation

issue-54-product-review

issue-53-runtime-integration

No results found.

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Creatidy/creatidy-kernel#79

No description provided.