diff mbox series

[v2,1/2] add script to check if the current environment supports rootless builds

Message ID 20260821131229.2235147-1-felix.moessbauer@siemens.com
State Under Review
Headers show
Series [v2,1/2] add script to check if the current environment supports rootless builds | expand

Commit Message

Felix Moessbauer Aug. 21, 2026, 1:12 p.m. UTC 
Running builds in rootless mode has a lot of non obvious pre conditions.
To help the user check if his system is configured correctly, we provide
a script that checks the needed features. If a feature is missing, it
issues an error regarding what likely is the root cause.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
Changes since v1:
- ensure rootless is enabled before calling bitbake-getvar
- add -v option to print the RUN_PRIVILEGED_CMD variable
 scripts/isar-check-rootless | 55 +++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100755 scripts/isar-check-rootless
diff mbox series

Patch

diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
new file mode 100755
index 00000000..b5197111
--- /dev/null
+++ b/scripts/isar-check-rootless
@@ -0,0 +1,55 @@ 
+#!/bin/sh
+# Copyright (C) 2026 Siemens AG
+# SPDX-License-Identifier: MIT
+#
+# Helper script to check if the current environment supports unprivileged
+# rootless builds with unshare.
+# Returns 0 if supported, otherwise returns 1 and prints an error message to stderr.
+
+verbose=0
+if [ "$1" = "-v" ]; then
+	verbose=1
+fi
+
+if ! run_privileged_cmd=$( \
+	BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
+	ISAR_ROOTLESS=1 bitbake-getvar -q --value RUN_PRIVILEGED_CMD); then
+	echo "error: cannot determine RUN_PRIVILEGED_CMD from BitBake" >&2
+	exit 1
+fi
+
+[ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
+
+if ! ${run_privileged_cmd} /bin/sh <<'EOF'
+	failed=0
+
+	fail() {
+		echo "error: $1" >&2
+		echo "       likely cause: $2" >&2
+		failed=1
+	}
+
+	mountpoint=$(mktemp -d)
+	if [ -n "$mountpoint" ]; then
+		if ! mount -t proc proc "$mountpoint"; then
+			fail "cannot mount procfs in the user namespace" \
+				"procfs is over-mounted by the container runtime, or the host security policy blocks procfs mounts"
+		else
+			umount "$mountpoint"
+		fi
+		rmdir "$mountpoint"
+	fi
+
+	if ! setpriv --reuid=nobody --regid=nogroup --clear-groups /usr/bin/true; then
+		fail "cannot execute as nobody:nogroup in the user namespace" \
+			"the subuid / subgid ID range is too small or incomplete"
+	fi
+
+	exit "$failed"
+EOF
+then
+	echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
+	exit 1
+fi
+
+echo "unprivileged rootless builds are supported"