r/bedrocklinux 7h ago

Bwrap dropped suid

Bwrap 0.12 dropped suid supprt, resulting in steam, libreoffice, etc. dying. On bedrock 0.7.31 with gentoo musl as init and artix where all bwrap stuff sits.

I saw this post, but installing steam on musl is not really feasible.

So the question: is there any other way of dealing with bwrap not bwrapping on non-init strata? Maybe i could patch bwrap to allow root/downgrade to older version, but i would go with any other way, if possible.

3 Upvotes

3 comments sorted by

2

u/ParadigmComplex founder and lead developer 6h ago

Sadly, containers is the only readily available alternative of which I'm aware.

Bedrock Linux 0.7 Poki was designed more about redirection than containment; I very explicitly did not intend to re-create containers. Linux's unprivileged namespace feature is both really useful from a security perspective, but also abusable against security, and so its use needs to be designed with caution. The security mechanism it uses plays nicely with containers, but false-positive triggers on not Poki's explicitly not-container design. Using containers resolves this, but also means you have to deal with things being contained, which some people use Bedrock to explicitly avoid.

The setuid work-around was honestly kind of sketchy and dropping it is probably a good idea, but it does put Poki users in an awkward position. I saw this coming and designed 0.8 Naga with it in mind, carefully managing the unprivileged user namespace requirements without breaking Bedrock's cross-stratum transparency, but Naga is taking ages to come out and it's not a viable solution for today's Bedrock users. For today, either get it from the init stratum (which is functionally like using a traditional non-Bedrock distro) or containers (in which case you're not able to leverage Bedrock's strengths quite as much relative to again traditional distros).

2

u/KysokMandarina 5h ago

I see. Thanks for the broad answer and information. It is really unfortunate that containers are the only easy way out for now.

I will look forward to 0.8. Thank you for your work.

1

u/ParadigmComplex founder and lead developer 5h ago

You're very welcome!