mbox series

[v3,00/16] add support to build isar unprivileged

Message ID 20260407142310.2327696-1-felix.moessbauer@siemens.com
Headers show
Series add support to build isar unprivileged | expand

Message

Felix Moessbauer April 7, 2026, 2:22 p.m. UTC 
Dear isar-users,

currently isar requires password-less sudo and an environment
where mounting file systems is possible. This has proven problematic
for security reasons, both when running in a privileged container or
locally.

To solve this, we implement fully rootless builds that rely on the
unshare syscall which allows us to avoid sudo and instead operate in
temporary kernel namespaces as a user that is just privileged within
that namespace. This comes with some challenges regarding the handling
of mounts (they are cleared when leaving the namespace), as well as
cross namespace deployments (the outer user might not be able to access
the inner data). For that, we rework the handling of mounts and artifact
passing to make it compatible with both chroot modes (schroot and
unshare).

Note, that this series can be tested on a custom kas-container build
provided in [1]. Hints how to migrate downstream layers are provided
in the API changelog.

Changes since PATCH v2:

- add support for cached base apt
- rootfs sstate: do not rely on fd3 for copy out, as not always available
- sbom: use local copy of sbom rootfs to not leave shared instance behind
- testsuite: add parameter to run in rootless mode
- rebased onto v1.0

Changes since PATCH v1:

- fixed broken rebase onto next
- fix root_cleandirs implementation

NOTE: This requires the kas series (v3) from [1] for rootless building.

Changes since RFC 2:

- rebased onto next
- fix usage of root_cleandirs
- simplify file permission handling by mapping caller user to
  root inside the namespace. By that, in most cases no changes
  to the imager are needed anymore.
- implement support for devshell under rootless
- switch to getpass.getuser() to query user (needed for dynamically
  created / remapped kas builder user)
- rework mapping to be more similar to mapping used by mmdebstrap
- sbuild: only copy-out of dpkg.log on schroot (unclear if needed
  on unshare. To be clarified)
- imager-sbom: ensure sbom is extracted before entering the chroot

Changes since RFC 1:

- switch build_type to isar-rootless in isar.yaml (Note: switch back
  if testing locally in a unprepared kas container)
- complete overhaul of the mounting in unshared namespaces
  - fixes the systemd presetting
  - fixes hangs when pulling from snapshot mirrors
- rename the run_privileged_here to run_privileged_heredoc to clarify its intention
- add support for
  - dpkg-source with do_fetch_common_source
  - vm images
  - container images
  - discoverable disk images
- add helper script to clean build dir in unprivileged mode
- reduce clutter we leave after finishing a build
- fix issues when running in a privileged environment without sub user ids
- bugfixes

Note, that the rootless build dir must not reside in a git worktree (a normal git
dir is fine). This is probably a bug in combination with kas-container.

[1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (16):
  refactor bootstrap: store rootfs tar with user permissions
  deb-dl-dir: export without root privileges
  download debs without locking
  introduce wrappers for privileged execution
  bootstrap: move cleanup trap to function
  rootfs: rework sstate caching of rootfs artifact
  rootfs_generate_initramfs: rework deployment to avoid chowning
  use bitbake function to generate mounting scripts
  apt-fetcher: prepare for chroot specific fetching
  add support for fully rootless builds
  add helper script to clean artifacts in build dir
  apt-fetcher: implement support for unshare backend
  dpkg-source: implement multiarch support for unshare backend
  use copy of sbom-chroot for sbom creation
  add support for devshell on unshare backend
  testsuite: add parameter to run tests in rootless mode

 Kconfig                                       |   2 +-
 RECIPE-API-CHANGELOG.md                       |  42 ++++
 doc/user_manual.md                            |   2 +
 kas/isar.yaml                                 |   2 +-
 meta/classes-global/base.bbclass              | 124 ++++++++++-
 meta/classes-recipe/deb-dl-dir.bbclass        |  24 ++-
 meta/classes-recipe/dpkg-base.bbclass         |  94 ++++++--
 meta/classes-recipe/dpkg-source.bbclass       |  40 +++-
 meta/classes-recipe/dpkg.bbclass              |  19 +-
 .../image-account-extension.bbclass           |   4 +-
 .../image-locales-extension.bbclass           |  13 +-
 .../image-postproc-extension.bbclass          |  30 +--
 .../image-tools-extension.bbclass             | 114 +++++++++-
 meta/classes-recipe/image.bbclass             |  21 +-
 .../imagetypes_container.bbclass              |  28 +--
 meta/classes-recipe/imagetypes_wic.bbclass    |  10 +-
 meta/classes-recipe/rootfs.bbclass            | 203 +++++++++---------
 meta/classes-recipe/sbuild.bbclass            |  34 ++-
 meta/classes-recipe/sdk.bbclass               |  22 +-
 meta/classes/sbom.bbclass                     |  28 ++-
 meta/conf/bitbake.conf                        |   7 +-
 meta/lib/aptsrc_fetcher.py                    |  87 +++++++-
 .../isar-mmdebstrap/isar-mmdebstrap.inc       |  55 +++--
 .../sbom-chroot/sbom-chroot.bb                |  11 +-
 .../sbuild-chroot/sbuild-chroot.inc           |  24 ++-
 scripts/isar-clean-builddir                   |  73 +++++++
 testsuite/cibuilder.py                        |   6 +
 .../unittests/test_image_account_extension.py |   9 +-
 28 files changed, 882 insertions(+), 246 deletions(-)
 create mode 100755 scripts/isar-clean-builddir