bubblewrap-0.2.0-lp150.2.3.1<>,A](x /=„G% (Yo͚ 8+9 n:"k/u 9M;(Q^rvL"N`*8IKlK28/)~)#d[ynW@w"R/bYs gqYS͔i(8!|x2pWʒū6U7}vl"i8ޥQ^b8'{UB:T{bb s ٴvˮT?vaKa0'hxu >>!`?!Pd   O  7My         =  H l   0l(8$ 9P : FG H I XY\< ]` ^ bcEdeflu vw | x y z !!! !LCbubblewrap0.2.0lp150.2.3.1Core execution tool for unprivileged containersBubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.](x cloud106^openSUSE Leap 15.0openSUSELGPL-2.0+http://bugs.opensuse.orgProductivity/Securityhttps://github.com/projectatomic/bubblewraplinuxx86_64 4c' ׁAA큤A큤A큤](x](x](x](w](xYۃ](xYۃ](x21b198102212c9259c470b88869657f3c5e9fc881f24ccf57e0bda31369368a089f09205318fc84dc135d97494269ab7c5c1efda71b796c9e711aed13c51f0d122f0465ec7a8b1cf74385d6a8f9124013bb3984e7ee75192b94542dc1f4c24dfb7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c09dddb08fbcc3d52a5ce5816189f56ab22d41308d3db20c4139552b4a25cae62rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootbubblewrap-0.2.0-lp150.2.3.1.src.rpmbubblewrapbubblewrap(x86-64)@@@@@@@@@@@    libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.16)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcap.so.2()(64bit)libselinux.so.1()(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1\@YdY@Y_wY&@X @XS@XW֘WWSebastian Wagner sebix+novell.com@sebix.atsebix+novell.com@sebix.atsebix+novell.com@sebix.atsebix+novell.com@sebix.atsebix+novell.com@sebix.atsebix+novell.com@sebix.atColin Walters - 0.1.3-2Kalev Lember - 0.1.2-1Igor Gnatenko - 0.1.1-2Colin Walters - 0.1.1- add fix-cve-2019-12439.patch to fix boo#1136958 CVE-2019-12439- update to version 0.2.0 - bwrap now automatically detects the new user namespace restrictions in Red Hat Enterprise Linux 7.4: bubblewrap: check for max_user_namespaces == 0. - The most notable features are new arguments --as-pid1, and - -cap-add/--cap-drop. These were added for running systemd (or in general a "full" init system) inside bubblewrap. But the capability options are also useful for unprivileged callers to potentially retain capbilities inside the sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled. Conversely, privileged callers (uid 0) can conversely drop capabilities (without user namespaces). Contributed by Giuseppe Scrivano. - With --dev, add /dev/fd and /dev/core symlinks which should improve compatibility with older software.- add group- fix build macro with rpm < 4.12 (non-Factory currently)- update to version 0.1.8 - New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API. - smaller bugfixes- upgrade to upstream version 0.1.7 - note that this package was *never* affected by CVE-2017-5226 as it was introduced in version 0.1.6 - upstream changelog of version 0.1.7: This release backs out the change in 0.1.6 which unconditionally called setsid() in order to fix a security issue with TIOCSTI, aka CVE-2017-522. That change caused some behavioural issues that are hard to work with in some cases. For instance, it makes shell job control not work for the bwrap command. Instead there is now a new option --new-session which works like 0.1.6. It is recommended that you use this if possible, but if not we recommended that you neutralize this some other way, for instance using SECCOMP, which is what flatpak does: https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4 In order to make it easy to create maximally safe sandboxes we have also added a new commandline switch called --unshare-all. It unshares all possible namespaces and is currently equivalent with: - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net - -unshare-uts --unshare-cgroup-try However, the intent is that as new namespaces are added to the kernel they will be added to this list. Additionally, if --share-net is specified the network namespace is not unshared. This release also has some bugfixes: bwrap reaps (unexpected) children that are inherited from the parent, something which can happen if bwrap is part of a shell pipeline. bwrap clears the capability bounding set. The permitted capabilities was already empty, and use of PR_NO_NEW_PRIVS should make it impossible to increase the capabilities, but more layers of protection is better. The seccomp filter is now installed at the very end of bwrap, which means the requirement of the filter is minimal. Any bwrap seccomp filter must at least allow: execve, waitpid and write Alexander Larsson (7): Handle inherited children dying Clear capability bounding set Make the call to setsid() optional, with --new-session demos/bubblewrap-shell.sh: Unshare all namespaces Call setsid() and setexeccon() befor forking the init monitor Install seccomp filter at the very end Bump version to 0.1.7 Colin Walters (6): Release 0.1.6 man: Correct namespace user -> mount demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs Release 0.1.6 ci: Combine ASAN and UBSAN Add --unshare-all and --share-net - upstream changelog for 0.1.6: This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is far from the only program that has this issue, and I think the best fix is probably in the kernel to support disabling this ioctl. Programs can also work around this by calling setsid() on their own in an exec handler before doing an exevp("bwrap"). - upstream changelog for 0.1.5: This is a bugfix release, here are the major changes: Running bubblewrap as root now works again Various fixes for the testsuite Use same default compiler warnings as ostree Handle errors resolving symlinks during bind mounts Alexander Larsson (2): bind-mount: Check for errors in realpath() Bump version to 0.1.5 Colin Walters (6): Don't call capset() unless we need to Only --unshare-user automatically if we're not root ci: Modernize a bit, add f25-ubsan README.md: Update with better one liner and more information utils: Add __attribute__((printf)) to die() build: Sync default warning -> error set from ostree Simon McVittie (4): test-run: be a bash script test-run: don't assume we are uid 1000 Adapt tests so they can be run against installed binaries Fix incorrect nesting of backticks when finding a FUSE mount- upgrade to upstream version 0.1.4 - Build also for Leap 42.2- New upstream version- Update to 0.1.2- Trivial fixes in packaging- Initial packagecloud106 1562933257 0.2.0-lp150.2.3.10.2.0-lp150.2.3.1bwrapbash-completioncompletionsbwrapbubblewrapREADME.mdbubblewrapCOPYINGbwrap.1.gz/usr/bin//usr/share//usr/share/bash-completion//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/bubblewrap//usr/share/licenses//usr/share/licenses/bubblewrap//usr/share/man/man1/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:10583/openSUSE_Leap_15.0_Update/93ba1567d035badd055702b0dd385fdf-bubblewrap.openSUSE_Leap_15.0_Updatedrpmxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 3.2.0, BuildID[sha1]=91005c2f9dfafbecab36111a0dc7b30cdfa44542, strippeddirectoryASCII textASCII text, with very long linestroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) RRRRRRRRR R RzOW+Qutf-8f8554680122aa7257094a08fafc142e1f5c3e7b58d91b30e8e558a945035355c? 7zXZ !t/9]"k%w!?K15e<9]%g( D9LXu?PYH.|ܷ] H2/| Lrb<;Kn 1ugZKYSnڅFOgH2# :_ԂۖOh{zJ>ۭc,ѶNw9g@%H_NPK%{N9V@'|,ud8pD׳QL-#Jdt5[/\ɞ!&ĔȜҴ1`0mjkܿ/C\Jێ{d8# g/`IeY>mMIfߵ*Z: Шo9nux!C, !;t1j&/cqZ {KG.P#G?Em#ƾ̴TTGT=8y mJ ;yX"`BB'LۣsL9L?|?k䗬WJgi@Dwd?&LfYdگr}G&gV1tvrO\պ; -5Mĕ\b`I5tGk/N]s85ׇQ> {G ~Hhy9w|W )Wpߵ1UNi0ZEG8EYtv_~-lyeR$b *$iKJp(~ B?PT{B$q\ 8!xw4gWF8Փ}\osv?Ȗ8eDY|֚rB5Qu^}犱иĊWCE;1NqʋL),D:-6T;mid6dOa`&xGǀWg[$ѫ8a3l,qM*CS{ʜF'z\VңIqV()DYED@;k&>^ .F,/&1AA"QFB\JqjyPjvyۆ KeN4>Zyj'vDR\{k?e˭x o9A!ȁ&ifA-}tZhErfVgy R<tl2UwF n#+701 #Ͽ쑗ݨT ToEҝIwh(#,i_S; !YՎEd7TUkƭ{(|KBKu&!%Iݗ%@bFT.m%W( 6Z bm>oq 2:R4&aYjFq59 /٧ۙF`C4K~f-1fǹW;[.qp!aaR>X[9\J CلD 6+y;K/e"S*'dv}{IU%8M1ƎGAN íK1_FZo4 gr,& QkYFմ0_W\U؄䝱˘,\ZsZ D F4YmE{ߡ!Q&Q1&󮧺:dSuA)d{mÀrX)g,>bY9QoȐ-e+jO`w89ֈDn>M;k*|ꖉZCIOM,NƏ0b%4`5`\ GDSt5_/o:J[[B*}AеΓX(no3So=W"3/aId8*,a%K5*`v7D0\FSyau2Gs?9ㄕ^ӻ 4\or[?Nx8afj$֮,`+F@4R)ʗoi݈ .('r vw: w+2bu^ZEu$ާƀõǂP,{:V%tYQI#Ιp79^xaع@HP#ܬI~ ZƔUX`7vB(lyj[R qq;W^3]H IsлLX٫7 +\VVӫx6~YZ%#Ln#>L{z^jIVjo,]/<&Z2Ov't0fa{RTœ*- -s+b/;p6ׂ\p U"[ނRvIg`*''tx Z̧?~Z-~zOX[}\{µ]4C5mL4tNܼʍR$Ti8/'8pӕ--98ȼsA^A+#>N< _9RE>$oߤ({n[l(;V#\V+yCFx'N|*maqG.]_W+ܗfĀ @PĘfͣuk+]0 % pQVvRͻ{Q\{ۄ !͋)ǕK"AZ:Mv 2kweq("D[knY[P#,Z0-W]KEq3#qS҇l7|k϶^+Xs3'o!I'X&=M)ShGnWMtE/S0O`S tMÞ>@ǜ ۺ/|g3 z&ۦTnҪ,R&4.uhpz#|;d &HDһŗYBKL86c$ c#P@,s1p|~WU:'6%ć̓MÅ#tXɨ f$0 w|3-`n+a{lrR2̍VkQF8HN|" ͫCu6v(/6CbRr廾s(bC+qCgCWew4bS2cc%O-TGߴ,'~MoNpQ_ƛ9hg9YI {!{n_b"0~& j`qGcHTm(Nʉ%d ./AN^4aؐpFlpYL@;2ùOo^,qA &!,+2rJ $;n&jW΍ͧ unKfA'lމq5 B71VlȓpPo,duA?9o !aYnd'r2 j=a*Y :5=y:#$sER'6Y/T&]66|ӉQ;Ŗm%wz7S2~@ Z\a.,{!S*o ]fA[ۍ)MR|(Ã9*;shVw{qw԰ #?輽(;ܣ71Drovi8Ƨ:O<`s7{?gK%$,+>l6-M5f^2VvElZr3"$EmOY j$& w|g82)>Yj,jm g!u =RPWjMde#h {@*7o~,Wl"Lϟ_=##bT8 f> oeNJ4|;v?rPypWzVq뢄gI;B y^pʙ?8as348J,[bcY9!2EkK_,G]{\ݠKv@)#n fs[~Tߺ%~9}=H?FgO ~xdLMJTo]ǫb_:r&؞D}]*ev{N`"e`lHkrm{*{ЪЎ\|sķ(mW)K7Y{Od<~<-uO"UUG>Z!#kIvݽpW*x4,Ö {s1.4I-;ꎹ7 ȀŌwڻX,|(KrjE6Rϑ4~v2hVĪ[t #;ru05ŠIW67׹ZoFgڧK&ͥ3aC!ўkcad;_JJ~C]ê 6Ԃ1al J<"S3%QP>`ls he69248ƫ.Tٺ3tU yj8#i(Pp!$:zӔ|Ī~ǻT!X5M5fHX3fREߠSr} $]z; T! 1K}$tӯG8{䤛jFT֤O oZYj֌{$t䟉z/cyh&<+FASѿ4o\dFnG#O;Z; kPaVhV9BG暺D]?] ruʕDU]5纹ȏSָ+ 0]ui/q#cO]Qr-U֤Aaj- h1>6#>Z8%J_1!=yHwYܶIy'0`>ඓ{nC5Sul,adL|7\2%ѷ56bbY_q7rkKkr]">GD\aJRJ6 u4 T]:zq>?YUr Z6V[Xq纅yg  Qusg$ۺL"#Qywc/ltCa?&Im JJe_h1 qT R;gV+KL\;7̝oQ>bR=C_˦kčX9!3a*_)C,_EJQ]+v?-AY %i+%Ovчg~y i?hWVm(!AP5_oG󡱹lD41|8{|/B]K0Pv, rpZȈc<ĆA6:pAN M-ߜxKr+W]NJ&䤢t69P3LZ$%(3޾`Sfi@ p(K`Oش<4άl46$[T gW`@Z(UB6mY5rBɤ ޖ葔qvb_Kς`q L`iQ|A2)S2C{2W䗿[Z_ЗSlwlg>3́4}3lj0@&ǻ gR6U}< uo<-l joD*;/Duìk9k7_ӳ8r YZ