mbox series

[v7,00/17] add support to build isar unprivileged

Message ID 20260625153651.762936-1-felix.moessbauer@siemens.com
Headers show
Series add support to build isar unprivileged | expand

Message

MOESSBAUER, Felix June 25, 2026, 3:36 p.m. UTC 
Dear isar-users,

currently isar requires password-less sudo and an environment
where mounting file systems is possible. This has proven problematic
for security reasons, both when running in a privileged container or
locally.

To solve this, we implement fully rootless builds that rely on the
unshare syscall which allows us to avoid sudo and instead operate in
temporary kernel namespaces as a user that is just privileged within
that namespace. This comes with some challenges regarding the handling
of mounts (they are cleared when leaving the namespace), as well as
cross namespace deployments (the outer user might not be able to access
the inner data). For that, we rework the handling of mounts and artifact
passing to make it compatible with both chroot modes (schroot and
unshare).

Note, that this series can be tested on a custom kas-container build
provided in [1]. Hints how to migrate downstream layers are provided
in the API changelog.

Changes since PATCH v6:

- rebased onto next
- p10: revert rootfs_install_pkgs_download to bwrap-based implementation,
  restoring old build performances. The underlying issue was finally
  understood, so the pattern could stay also under rootless.

Changes since PATCH v5:

- rebased onto next
- adjust to changes from "Rootfs install race fix for isar-apt packages":
  Manually add isar-apt mount in rootfs_install_pkgs_isar_download on
  rootless
- adjust to changes in "image-postproc: gate systemd preset-all on masked
  unit state": Trivial change to use run_in_chroot instead of sudo chroot.

Changes since PATCH v4:

- fix cleanup trap in do_bootstrap (only functional change)
- keep build_system entries as "isar" until we have official kas support
  (and for backwards compatibility). Add reasoning to commit message
- improve RECIPE-API-CHANGELOG (the kas interfaces are stable now, but
  not yet released)

Changes since PATCH v3:

- fix dracut initrd build issue (p7)
- testsuite: print if rootless mode is used in summary
- testsuite: append newline after ISAR_ROOTLESS = "1" in ci config
- run-tests.sh: catch -p rootless=1 flag and start container in rootless mode
  (requires a not-yet released kas-container, corresponding kas patches
   are currently under review)

Changes since PATCH v2:

- add support for cached base apt
- rootfs sstate: do not rely on fd3 for copy out, as not always available
- sbom: use local copy of sbom rootfs to not leave shared instance behind
- testsuite: add parameter to run in rootless mode
- rebased onto v1.0

Changes since PATCH v1:

- fixed broken rebase onto next
- fix root_cleandirs implementation

NOTE: This requires the kas series (v3) from [1] for rootless building.

Changes since RFC 2:

- rebased onto next
- fix usage of root_cleandirs
- simplify file permission handling by mapping caller user to
  root inside the namespace. By that, in most cases no changes
  to the imager are needed anymore.
- implement support for devshell under rootless
- switch to getpass.getuser() to query user (needed for dynamically
  created / remapped kas builder user)
- rework mapping to be more similar to mapping used by mmdebstrap
- sbuild: only copy-out of dpkg.log on schroot (unclear if needed
  on unshare. To be clarified)
- imager-sbom: ensure sbom is extracted before entering the chroot

Changes since RFC 1:

- switch build_type to isar-rootless in isar.yaml (Note: switch back
  if testing locally in a unprepared kas container)
- complete overhaul of the mounting in unshared namespaces
  - fixes the systemd presetting
  - fixes hangs when pulling from snapshot mirrors
- rename the run_privileged_here to run_privileged_heredoc to clarify its intention
- add support for
  - dpkg-source with do_fetch_common_source
  - vm images
  - container images
  - discoverable disk images
- add helper script to clean build dir in unprivileged mode
- reduce clutter we leave after finishing a build
- fix issues when running in a privileged environment without sub user ids
- bugfixes

Note, that the rootless build dir must not reside in a git worktree (a normal git
dir is fine). This is probably a bug in combination with kas-container.

[1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (17):
  refactor bootstrap: store rootfs tar with user permissions
  deb-dl-dir: export without root privileges
  download debs without locking
  introduce wrappers for privileged execution
  bootstrap: move cleanup trap to function
  rootfs: rework sstate caching of rootfs artifact
  rootfs_generate_initramfs: rework deployment to avoid chowning
  use bitbake function to generate mounting scripts
  apt-fetcher: prepare for chroot specific fetching
  add support for fully rootless builds
  add helper script to clean artifacts in build dir
  apt-fetcher: implement support for unshare backend
  dpkg-source: implement multiarch support for unshare backend
  use copy of sbom-chroot for sbom creation
  add support for devshell on unshare backend
  testsuite: add parameter to run tests in rootless mode
  run-tests: add support for isar-rootless mode

 RECIPE-API-CHANGELOG.md                       |  41 ++++
 doc/user_manual.md                            |   2 +
 meta/classes-global/base.bbclass              | 124 ++++++++++-
 meta/classes-recipe/deb-dl-dir.bbclass        |  22 +-
 meta/classes-recipe/dpkg-base.bbclass         |  94 +++++++--
 meta/classes-recipe/dpkg-source.bbclass       |  40 +++-
 meta/classes-recipe/dpkg.bbclass              |  19 +-
 .../image-account-extension.bbclass           |   4 +-
 .../image-locales-extension.bbclass           |  13 +-
 .../image-postproc-extension.bbclass          |  30 +--
 .../image-tools-extension.bbclass             | 114 +++++++++-
 meta/classes-recipe/image.bbclass             |  21 +-
 .../imagetypes_container.bbclass              |  28 +--
 meta/classes-recipe/imagetypes_wic.bbclass    |  10 +-
 meta/classes-recipe/rootfs.bbclass            | 197 +++++++++---------
 meta/classes-recipe/sbuild.bbclass            |  34 ++-
 meta/classes-recipe/sdk.bbclass               |  22 +-
 meta/classes/sbom.bbclass                     |  28 ++-
 meta/conf/bitbake.conf                        |   7 +-
 meta/lib/aptsrc_fetcher.py                    |  87 +++++++-
 .../isar-mmdebstrap/isar-mmdebstrap.inc       |  56 +++--
 .../sbom-chroot/sbom-chroot.bb                |  11 +-
 .../sbuild-chroot/sbuild-chroot.inc           |  24 ++-
 scripts/isar-clean-builddir                   |  73 +++++++
 scripts/run-tests.sh                          |   7 +-
 testsuite/cibuilder.py                        |   7 +
 .../unittests/test_image_account_extension.py |   9 +-
 27 files changed, 883 insertions(+), 241 deletions(-)
 create mode 100755 scripts/isar-clean-builddir