diff mbox series

[1/1] mmdebstrap: ensure apt keystore is owned by root

Message ID 20260618152439.3884748-2-wzh@ilbers.de
State Accepted, archived
Headers show
Series [1/1] mmdebstrap: ensure apt keystore is owned by root | expand

Commit Message

Zhihang Wei June 18, 2026, 3:24 p.m. UTC 
From: Felix Moessbauer <felix.moessbauer@siemens.com>

We currently create the /etc/apt/trusted.gpg.d manually during bootstrap
setup to be able to deploy local keys. By that, the directory is owned
by the calling user (the one that executes isar) instead of root.

If the calling user's id is identical to one of an unprivileged user
inside the image, this user is able to alter existing keys and deploy
new ones, silently breaking the apt repo integrity protection.

We fix this by manually chowning the directory to root:root in the setup
step.

Fixes: 9ae41e03 ("mmdebstrap: Move preparations to hooks")
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index cef953ef..e746f469 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -232,6 +232,7 @@  do_bootstrap() {
                    --setup-hook='upload "${WORKDIR}/locale" /etc/locale' \
                    --setup-hook='mkdir -p "$1/etc/apt/trusted.gpg.d"' \
                    --setup-hook='sync-in "${WORKDIR}/trusted.gpg.d" /etc/apt/trusted.gpg.d' \
+                   --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \
                    --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \
                    --extract-hook="$extra_extract" \
                    --essential-hook="$extra_essential" \