| Message ID | 20260910144327.775731-1-felix.moessbauer@siemens.com |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] isar-check-rootless: check parent dirs are world executable | expand |
Hi, >From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com> >Sent: Thursday, 10 September 2026 16:43 >To: isar-users@googlegroups.com >Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky >Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable > >When using mmdebstrap with the unshare backend, all parent directories >of the TMPDIR must be world executable. This requirement is documented <nitpick on> you mean that all parent directories need to be world searchable, by setting the S_IXOTH access bit, right? >in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in >colorful ways. > >To indicate what is wrong, we add a check to the isar-check-rootless >script. > >Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> >Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> >--- >PS: The corresponding kas patch is here: >https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY > > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ > 1 file changed, 33 insertions(+) > >diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless >index b5197111..de96aac7 100755 >--- a/scripts/isar-check-rootless >+++ b/scripts/isar-check-rootless >@@ -20,6 +20,35 @@ fi > > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 > >+if ! tmpdir=$( \ >+ BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ >+ ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then >+ echo "error: cannot determine TMPDIR from BitBake" >&2 >+ exit 1 >+fi >+ >+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 >+ >+failed=0 >+fail() { >+ echo "error: $1" >&2 >+ echo " likely cause: $2" >&2 >+ failed=1 >+} >+ >+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a >+# subordinate user. That user can only reach it if every ancestor of TMPDIR is >+# world-executable (see mmdebstrap(1), TMPDIR). Same nitpick remark here >+dir=$tmpdir >+while [ "$dir" != "/" ]; do >+ if [ -e "$dir" ] && \ >+ [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then >+ fail "'$dir' is not world-executable" \ and here >+ "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" >+ fi >+ dir=$(dirname "$dir") >+done >+ > if ! ${run_privileged_cmd} /bin/sh <<'EOF' > failed=0 > >@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' > exit "$failed" > EOF > then >+ failed=1 >+fi >+ >+if [ "$failed" != 0 ]; then > echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 > exit 1 > fi >-- >2.55.0
On Thu, 2026-09-10 at 15:17 +0000, Ulrich Teichert wrote: > Hi, > > > From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com> > > Sent: Thursday, 10 September 2026 16:43 > > To: isar-users@googlegroups.com > > Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky > > Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable > > > > When using mmdebstrap with the unshare backend, all parent directories > > of the TMPDIR must be world executable. This requirement is documented > > <nitpick on> you mean that all parent directories need to be world searchable, > by setting the S_IXOTH access bit, right? Hi, thanks for the review. Yes, that's right. However, then we diverge from the terminology that is used by mmdebstrap, which is: If you set "TMPDIR" in unshare mode, then the unshared user must be able to access the directory. This means that the directory itself must be world-writable and all its ancestors must be at least world- executable. > > > in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in > > colorful ways. > > > > To indicate what is wrong, we add a check to the isar-check-rootless > > script. > > > > Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> > > --- > > PS: The corresponding kas patch is here: > > https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY > > > > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ > > 1 file changed, 33 insertions(+) > > > > diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless > > index b5197111..de96aac7 100755 > > --- a/scripts/isar-check-rootless > > +++ b/scripts/isar-check-rootless > > @@ -20,6 +20,35 @@ fi > > > > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 > > > > +if ! tmpdir=$( \ > > + BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ > > + ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then > > + echo "error: cannot determine TMPDIR from BitBake" >&2 > > + exit 1 > > +fi > > + > > +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 > > + > > +failed=0 > > +fail() { > > + echo "error: $1" >&2 > > + echo " likely cause: $2" >&2 > > + failed=1 > > +} > > + > > +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a > > +# subordinate user. That user can only reach it if every ancestor of TMPDIR is > > +# world-executable (see mmdebstrap(1), TMPDIR). > > Same nitpick remark here > > > +dir=$tmpdir > > +while [ "$dir" != "/" ]; do > > + if [ -e "$dir" ] && \ > > + [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then > > + fail "'$dir' is not world-executable" \ > > and here If there are no objections, I would just change to "searchable" instead of executable, despite the mmdebstrap manpage explicitly states executable. Still, test reports if that actually works on other machines would be great :) Felix > > > + "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" > > + fi > > + dir=$(dirname "$dir") > > +done > > + > > if ! ${run_privileged_cmd} /bin/sh <<'EOF' > > failed=0 > > > > @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' > > exit "$failed" > > EOF > > then > > + failed=1 > > +fi > > + > > +if [ "$failed" != 0 ]; then > > echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 > > exit 1 > > fi > > -- > > 2.55.0
diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless index b5197111..de96aac7 100755 --- a/scripts/isar-check-rootless +++ b/scripts/isar-check-rootless @@ -20,6 +20,35 @@ fi [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 +if ! tmpdir=$( \ + BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ + ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then + echo "error: cannot determine TMPDIR from BitBake" >&2 + exit 1 +fi + +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 + +failed=0 +fail() { + echo "error: $1" >&2 + echo " likely cause: $2" >&2 + failed=1 +} + +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a +# subordinate user. That user can only reach it if every ancestor of TMPDIR is +# world-executable (see mmdebstrap(1), TMPDIR). +dir=$tmpdir +while [ "$dir" != "/" ]; do + if [ -e "$dir" ] && \ + [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then + fail "'$dir' is not world-executable" \ + "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" + fi + dir=$(dirname "$dir") +done + if ! ${run_privileged_cmd} /bin/sh <<'EOF' failed=0 @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' exit "$failed" EOF then + failed=1 +fi + +if [ "$failed" != 0 ]; then echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 exit 1 fi
When using mmdebstrap with the unshare backend, all parent directories of the TMPDIR must be world executable. This requirement is documented in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in colorful ways. To indicate what is wrong, we add a check to the isar-check-rootless script. Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> --- PS: The corresponding kas patch is here: https://groups.google.com/g/kas-devel/c/PZihYBAmlCQ/m/tXkK0P77BAAJ scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)