From patchwork Thu Jun 18 15:24:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhihang Wei X-Patchwork-Id: 5164 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 18 Jun 2026 17:24:51 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-lj1-f186.google.com (mail-lj1-f186.google.com [209.85.208.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65IFOo7x028897 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 18 Jun 2026 17:24:50 +0200 Received: by mail-lj1-f186.google.com with SMTP id 38308e7fff4ca-39984d51558sf4623051fa.0 for ; Thu, 18 Jun 2026 08:24:50 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1781796284; cv=pass; d=google.com; s=arc-20240605; b=Bk+kW0DQ7gN8DArTiG5BZ3F8IoGYOcubpSTs3DpnLkqsQyFRX00t8lgK55gaW7Lija 7S3ys5HuS8IB/bKm4HnbbILChgdsZb+qclavjS77wM/1JE+SvGN4190dYt63MuTS4C+k RnsrjipLX4ZfNSPR3CZQYMtynmhBFYBw1lDZ2AbU0T8GpiWq2HycUq7+ryzKu2qGBCeR VjNUUquYXXIX5rUHWHIZyDrprEbtjsHFOuTA7R3VqdR+DEx1qNwqTZ7TqMetGPkpzwMY edWdcq2vIqTBloblutlSa3D5j93BNJjFTouJ7xecUdTbRZOA8tzbm86PWFB8ScdfO/lW F+3Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:dkim-signature; bh=WjdVnO+3n2JkqTtUon6IFMqk1knv/42XJtcyVpLgTuE=; fh=qtGYy60Ntuof9O8kyP7BqIAFTbBn9/LJ7s4ddIWOnqM=; b=XrtW7fnCYVJbO2MdyJ1KWrudtiE0A7hNsMjLibVxZTD2hi+m6GQpzDqr1ZebVccZor TcsbIPYaFcS2OZg+Tbqa6i2TA+4plFWcaCAZcizt+hfzXKvqnrX/GgBkJ14odjU9Ct4g qsajvUUXoCftqgoRKCXtPXJFSWACH2qibuG4TJqLPqVX/kXanCLoaPGkUwLGxpcW6sTo EAwuE/CMaAevvfwTK/kk8D1XX2AiJVacSfkuIR3L+Hl6UaArRvThG3W9Ew6YR2ZR13vZ 3FSRyhiaW2SL88P04xVnXD1SOlx5iCM0Lqp00kZZjgcs+sT+DpVG16jiQQRSSL5EoNgE WQJA==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1781796284; x=1782401084; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:sender:from:to:cc:subject:date:message-id :reply-to; bh=WjdVnO+3n2JkqTtUon6IFMqk1knv/42XJtcyVpLgTuE=; b=XXy3EVuMOlc5CWZiPsI8233wDoXHSQlXpSf0fStfvB7DOEyfC/m5I9MGe4j2beBPff LZvlcIOAt1+3leGxet6ZopN/G/HU3cy4qDpVXZjLsYbpXqRprwKt1kBQY8WzcLrFkCbN 2U274YRLkirIiPKW9JN/2dbsl9SEmcdY8chbaTGsBQICSPF8v+WDKcYMk1V+0nhZU03t KXbZEckhECPhKjGIREZhDVSKE8N0JRrDY6bbw4duaQY85YAYcqQNA1OkW8tFBb4/pp5e Vj3vFl8gaDTyU8EsfR0+ScKUqNEzyJ3ym2y4ILwJKj97+C+Lz6WqknjSlk3UF3MVexs+ t5AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781796284; x=1782401084; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to; bh=WjdVnO+3n2JkqTtUon6IFMqk1knv/42XJtcyVpLgTuE=; b=PAUc46gxmjm0ZUDyOVtcBBqqE/1K3gvv98VubDU2WpWVvQJlWMQvkwoLg5xUh6SP4i 0FGbdBHm8Bsh4+l03rXQcqBoeC//6P3jksZiOV9HQiD1cosZ2MHbcMONHIFTzhDf39/G Y4NGlWrgTuUZn7ZHG3YhWK6OMfJZtSTeYKCcrSWCP1WH1S+/8+wqsfLKlV89I8LQ0cBE unaXPUAViHJppCcsktGthkvAt9FHRRqICMtMuLKaXK8WCJdTyfpGvi2eoftKSYEmsF27 xQ+Mf4g35HwjdrQ/KHdHKIIm5vJxFBWAHOFygmhkljLfWx8Zy5mZzx/aiFKbFiRdAtGz kxUw== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ9iu/sloXAfodDMgGKepQtMHjmGYEIR42/JnlpXA97WnRQ4oKuabYCDKSKgNsjf7NOSucxQpMo=@isar-build.org X-Gm-Message-State: AOJu0YwopKMTtANw3YHV5MB2gMOTfKyMhUVAPlQeda+8QNvf8/Mx3V7X Up+pKXBq1cbmIAoSf1IGgKg/79PLCMdDYVNDUBYN7tm/JFpgOQO+kDcv X-Received: by 2002:a05:6512:618c:b0:5aa:6b8b:8c9c with SMTP id 2adb3069b0e04-5ad562c4209mr14644e87.42.1781796283626; Thu, 18 Jun 2026 08:24:43 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUenswxzrLNsKVOKCcdxuKeD8hY0mzZKiHnlW0bmGZd41A==" Received: by 2002:a05:6512:3105:b0:5a8:eb13:4faa with SMTP id 2adb3069b0e04-5ad4dae3117ls453818e87.2.-pod-prod-05-eu; Thu, 18 Jun 2026 08:24:41 -0700 (PDT) X-Received: by 2002:a05:6512:128b:b0:5aa:6a5c:be4d with SMTP id 2adb3069b0e04-5ad5627b06dmr42184e87.9.1781796281066; Thu, 18 Jun 2026 08:24:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1781796281; cv=none; d=google.com; s=arc-20240605; b=bTqO/Al7hyaFQ17oHeewgtefw8O/lw3ri7i3FfH+aL5OlQXJ10XhxoWljXTphxrjT6 n8iGDIxfIMb6+YeL5In6+i65qE0neZ0GtWXYZYXceAOii40olGz5eBoPgBghs1NOp1tC jZxxHlYmts+s7qPcrluzDQJbyxpVVEe/avgqQ0S0BARlX+oAcrHSHvFU/Bp5mq4XpsOY eBIai/jCMlSDG25Vph49n/uxJLjH0PiYuY9JVbsw9QYSwZTTmQltPREtQjByrdeCc4KL V1a06aC1CS8BniGB5hxi3Sz3irraR1+/lUHwlX2O9qJ0dBeVKFXY0wYTENaaqQuVyIIo upMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from; bh=Bv10eyHiEIxtHJInSZ85PH/hkzLQhOwPGVVbtmdMirQ=; fh=dLKbFY1nCVs0gw4Ot3U35lUCgkKClbVzBSGiWA5AeLc=; b=KYV0w2+YO4HHo3Ok36d3x+A8EO9yvtOjBl4MIQbt5SJdFw58bAzDvAsIjr30DrXSC3 2YA+304bBizb8P5J0CpoktT8z2TbFmqsS3i1O0rp9MyEU2HT4Hc+TyZ+9n4QIF/N9pYk 1GYkyI+5eegjOcnn9r/Vy+hL8bf/qm9h0+5nkJUn8bHgqeqXAbQcoTPBvNVRidHMTIg2 yElf/EkXrzsPm4cBjE+cG/72nqwW2JXcLl4Wtxxa0WOUq+tE9uJbyX3rLubJB3Zf3Nhe p20Dc+OKGlUik8GZ/9DEvO3b4wnVwllOvJ+cL9Ar1/v1GfbNOl3PaLsOHnTkOFHQd2qV SIMw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 38308e7fff4ca-39979353714si687121fa.7.2026.06.18.08.24.40 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 18 Jun 2026 08:24:40 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from debian-zwei.m.ilbers.de ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPA id 65IFOdSl028871; Thu, 18 Jun 2026 17:24:39 +0200 From: Zhihang Wei To: isar-users@googlegroups.com Cc: felix.moessbauer@siemens.com Subject: [PATCH 1/1] mmdebstrap: ensure apt keystore is owned by root Date: Thu, 18 Jun 2026 17:24:39 +0200 Message-Id: <20260618152439.3884748-2-wzh@ilbers.de> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260618152439.3884748-1-wzh@ilbers.de> References: <20260618152439.3884748-1-wzh@ilbers.de> MIME-Version: 1.0 X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= From: Felix Moessbauer We currently create the /etc/apt/trusted.gpg.d manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. We fix this by manually chowning the directory to root:root in the setup step. Fixes: 9ae41e03 ("mmdebstrap: Move preparations to hooks") Signed-off-by: Felix Moessbauer --- meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc index cef953ef..e746f469 100644 --- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc +++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc @@ -232,6 +232,7 @@ do_bootstrap() { --setup-hook='upload "${WORKDIR}/locale" /etc/locale' \ --setup-hook='mkdir -p "$1/etc/apt/trusted.gpg.d"' \ --setup-hook='sync-in "${WORKDIR}/trusted.gpg.d" /etc/apt/trusted.gpg.d' \ + --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \ --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \ --extract-hook="$extra_extract" \ --essential-hook="$extra_essential" \