Bubblewrap
Bubblewrap sets the desk out before the pupil is let in.
Papers you did not put on it simply are not there. Not forbidden, not protected: absent. A pupil cannot break a rule about a paper they cannot see.
What it is
Bubblewrap (bwrap) is an unprivileged sandboxing tool. It uses Linux namespaces to give a
process a different view of the system, most importantly a mount namespace, in which
the visible file system is assembled from scratch.
It needs no root, which is what makes it usable on an ordinary continuous integration (CI) runner.
How Phobos uses it
phobos-filesystem.sh builds the argument list from the policy:
| Argument | Effect |
|---|---|
--ro-bind <path> <path> | the path is visible but read-only |
--bind <path> <path> | the path is visible and writable |
--tmpfs <path> | the path is replaced by an empty temporary filesystem, hiding what was there |
The three map onto the file policy: readable paths are bound read-only, writable paths are
bound writable, and hidden paths get a tmpfs over them.
This is interception at the kernel level and an allow list of paths, applied by a wrapper process that execs the build command inside the namespace it has just built.
Further reading
- containers/bubblewrap — source repository
namespaces(7)— Linux manual pagemount_namespaces(7)— Linux manual page