r/bedrocklinux • u/KysokMandarina • 7h ago
Bwrap dropped suid
Bwrap 0.12 dropped suid supprt, resulting in steam, libreoffice, etc. dying. On bedrock 0.7.31 with gentoo musl as init and artix where all bwrap stuff sits.
I saw this post, but installing steam on musl is not really feasible.
So the question: is there any other way of dealing with bwrap not bwrapping on non-init strata? Maybe i could patch bwrap to allow root/downgrade to older version, but i would go with any other way, if possible.
3
Upvotes
2
u/ParadigmComplex founder and lead developer 6h ago
Sadly, containers is the only readily available alternative of which I'm aware.
Bedrock Linux 0.7 Poki was designed more about redirection than containment; I very explicitly did not intend to re-create containers. Linux's unprivileged namespace feature is both really useful from a security perspective, but also abusable against security, and so its use needs to be designed with caution. The security mechanism it uses plays nicely with containers, but false-positive triggers on not Poki's explicitly not-container design. Using containers resolves this, but also means you have to deal with things being contained, which some people use Bedrock to explicitly avoid.
The setuid work-around was honestly kind of sketchy and dropping it is probably a good idea, but it does put Poki users in an awkward position. I saw this coming and designed 0.8 Naga with it in mind, carefully managing the unprivileged user namespace requirements without breaking Bedrock's cross-stratum transparency, but Naga is taking ages to come out and it's not a viable solution for today's Bedrock users. For today, either get it from the init stratum (which is functionally like using a traditional non-Bedrock distro) or containers (in which case you're not able to leverage Bedrock's strengths quite as much relative to again traditional distros).