projectatomic/bubblewrap
Bubblewrap
Bubblewrap es una utilidad de ejecución en sandbox sin privilegios para Linux que aísla los procesos del sistema host. Crea entornos seguros aprovechando los namespaces de Linux para separar los recursos del sistema, incluyendo las pilas de red, PID e IPC.
El proyecto se distingue por permitir la ejecución de software no confiable sin requerir privilegios de root en la máquina host. Evita la escalada de privilegios deshabilitando la ejecución de binarios setuid y utiliza el mapeo de identidad de usuario para aislar los permisos de proceso del sistema operativo host.
La herramienta gestiona una superficie de seguridad integral que incluye control de acceso al sistema de archivos para restringir la visibilidad de directorios y permisos de solo lectura. Reduce aún más la superficie de ataque del kernel mediante el filtrado de llamadas al sistema seccomp.
Features
- Linux Sandboxes - Creates isolated execution environments using Linux kernel primitives to restrict resource access and system visibility.
- Mount-Namespace Virtualization - Provides a restricted filesystem view by isolating mount points and enforcing read-only permissions.
- Container User Identity Mapping - Translates internal sandbox user identities to host identities to isolate process permissions from the host system.
- Unprivileged Container Execution - Enables the execution of applications in isolated environments without requiring root privileges on the host machine.
- Process Isolation - Restricts process access to system resources by creating private network, PID, and IPC instances.
- Namespace-Based Isolation - Implements isolated environments using Linux kernel namespaces to separate network, PID, and IPC stacks from the host.
- Process User Isolation - Redefines user and group identities to isolate process permissions from the host operating system.
- Isolated Execution Sandboxes - Executes processes in a secure, unprivileged environment using Linux namespaces for isolation.
- System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available host system call interface using seccomp.
- Privilege Escalation Prevention - Prevents privilege escalation by blocking the execution of setuid binaries within the sandboxed environment.
- Read-Only Filesystem Enforcement - Enforces read-only access and restricts visibility of host directories within the secure execution environment.
- System Call Filter Analysis - Limits the specific kernel syscalls a process can execute by applying seccomp filters.
- Seccomp Profiles - Applies seccomp filter profiles to restrict the set of kernel system calls a process can execute.
- Sandboxing and Isolation - Sandboxing tool using namespaces without requiring root.
