| Message ID | 20261021112532.3824701-1-clara.kowalsky@siemens.com |
|---|---|
| State | New |
| Headers | show |
| Series | [1/2] rootfs-add-files: correctly remove files in ROOTFSDIR | expand |
On Wed, 2026-10-21 at 13:25 +0200, 'Clara Kowalsky' via isar-users wrote: > The existence check uses ROOTFSDIR plus destination, but the removal > command uses destination alone. Since the task runs outside the > image chroot, it targets a build-host path instead. > > A replacement-path test confirms that the original code deletes a > host-side file while leaving the image-side file untouched. WTF. That even calls for a CVE. We definitely need a test for the rootfs_add_files logic. Felix > > Fixes: d2eb951a931c ("add new class to add files directly to the rootfs") > Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com> > --- > meta/classes-recipe/rootfs-add-files.bbclass | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass > index 38f739ee..d33752f3 100644 > --- a/meta/classes-recipe/rootfs-add-files.bbclass > +++ b/meta/classes-recipe/rootfs-add-files.bbclass > @@ -24,7 +24,7 @@ python rootfs_add_files() { > destination = d.getVarFlag(additional_file_entry, "destination") or "" > source = d.getVarFlag(additional_file_entry, "source") or "" > if os.path.exists(f"{rootfsdir}/{destination}"): > - bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"]) > + bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"]) > > dest_dir = os.path.dirname(destination) > bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ]) > -- > 2.55.0 > > -- > You received this message because you are subscribed to the Google Groups "isar-users" group. > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021112532.3824701-1-clara.kowalsky%40siemens.com.
diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass index 38f739ee..d33752f3 100644 --- a/meta/classes-recipe/rootfs-add-files.bbclass +++ b/meta/classes-recipe/rootfs-add-files.bbclass @@ -24,7 +24,7 @@ python rootfs_add_files() { destination = d.getVarFlag(additional_file_entry, "destination") or "" source = d.getVarFlag(additional_file_entry, "source") or "" if os.path.exists(f"{rootfsdir}/{destination}"): - bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"]) + bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"]) dest_dir = os.path.dirname(destination) bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
The existence check uses ROOTFSDIR plus destination, but the removal command uses destination alone. Since the task runs outside the image chroot, it targets a build-host path instead. A replacement-path test confirms that the original code deletes a host-side file while leaving the image-side file untouched. Fixes: d2eb951a931c ("add new class to add files directly to the rootfs") Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com> --- meta/classes-recipe/rootfs-add-files.bbclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)