diff mbox series

[1/1] rootfs: restore compatibility with bwrap 0.12.0

Message ID 20260831084200.751483-1-felix.moessbauer@siemens.com
State Under Review
Headers show
Series [1/1] rootfs: restore compatibility with bwrap 0.12.0 | expand

Commit Message

Felix Moessbauer Aug. 31, 2026, 8:42 a.m. UTC 
Bubblewrap 0.12.0 is a security release that contains hardenings
regarding the handling of symlinks. This breaks the rootfs_cmd helper,
which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
(and alike).

From debian bookworm on, /bin (and alike) are just symlinks to the
corresponding dirs below /usr. In this case, we only need to mount /usr.
On earlier versions, we need to mount the /bin (and alike) dirs as well.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/rootfs.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Ulrich Teichert Aug. 31, 2026, 1:44 p.m. UTC | #1 
Hi Felix,

>Bubblewrap 0.12.0 is a security release that contains hardenings
>regarding the handling of symlinks. This breaks the rootfs_cmd helper,
>which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
>(and alike).
>
>From debian bookworm on, /bin (and alike) are just symlinks to the
>corresponding dirs below /usr. In this case, we only need to mount /usr.
>On earlier versions, we need to mount the /bin (and alike) dirs as well.
>
>Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>

Thanks for fixing!

Tested-by: Ulrich Teichert <ulrich.teichert@ebs-group.io>

>---
> meta/classes-recipe/rootfs.bbclass | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
>index 8d394b05..0bef2d45 100644
>--- a/meta/classes-recipe/rootfs.bbclass
>+++ b/meta/classes-recipe/rootfs.bbclass
>@@ -142,8 +142,9 @@ rootfs_cmd() {
>     fi
>     shift  # remove "--", command and its arguments follows
>
>+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
>     for ro_d in bin etc lib lib64 sys usr var; do
>-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
>+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
>         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
>     done
>
>--
>2.55.0
diff mbox series

Patch

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8d394b05..0bef2d45 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -142,8 +142,9 @@  rootfs_cmd() {
     fi
     shift  # remove "--", command and its arguments follows
 
+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
     for ro_d in bin etc lib lib64 sys usr var; do
-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
     done