Install bubblewrap by default to make use of MAT2's sandboxing

[madaidan]

Whonix should install bubblewrap by default. MAT2 uses bubblewrap for sandboxing and is automatically enabled if it is installed.

This currently won’t work though due to a bug (Whonix uses hidepid).

[HulaHoop]

Will having the on fixed version installed break MAT2 startup? If not then we can incldue it.

[madaidan]

@HulaHoop

Will having the on fixed version installed break MAT2 startup?

Yes, it likely will.

I’m not saying to include bubblewrap immediately. It can be included after the bug is fixed.

[madaidan]

I’ve submitted a pull request to bubblewrap that should fix the MAT2 issue.

Make "--unshare-user-try" check if /proc is mounted with hidepid

It might take a while before it gets merged and then a longer while before it’s in Debian.

There are also some users encountering this bug https://0xacab.org/jvoisin/mat2/issues/121

[nurmagoz]

although this bug not solved yet, bubblewrap now included anyway in WS (mat2 and libwebkit2gtk depends on bubblewrap).

[madaidan]

Bubblewrap can be disabled by using mat2’s --no-sandbox flag now if any errors occur.

[Patrick_mobile]

Tor Browser Hardening (hardened malloc, firejail, apparmor) vs Web Fingerprint

bubblewrap will be installed by default after upgrades. bubblewrap will also be installed by default in Whonix 15.0.0.7.1 (and above). But not because any decision / change by Whonix. bubblewrap is a dependency. sudo apt dist-upgrade and even sudo apt dist-upgrade --no-install-recommends on Whonix-Gateway 15.0.0.4.9 will install bubblewrap. Technical reasons (dependency chain): libwebkit2gtk-4.0-37 depends on bubblewrap zenity depends on libwebkit2gtk-4.0-37 msgcollector-gui depends…