Re: [PATCH v5 0/5] Debootstrap integration

[Jan Kiszka <jan.kiszka@siemens.com>]

On 2018-04-11 08:28, Baurzhan Ismagulov wrote:
> On Thu, Apr 05, 2018 at 11:16:43AM +0200, Jan Kiszka wrote:
>> I would call this a "safety" concern - building images via Isar is not
>> secure in any way as long as we require root permissions.
> 
> However we call it (directory traversal is commonly classified as a security
> issue as opposed to safety as in health injury), it doesn't mean we should

safety: measures against accidental errors, hardware failures etc.
security: measures against malicious attackers (intentional errors)

Isar has currently no own means for the latter due to requiring root
privileges.

> easily add more of them just because the existing code already isn't perfect.
> I've raised the issue to understand the implications, consider advantages and
> disadvantages, and possibly determine TODOs if we end up with a trade-off.
> 
> For example, for this specific case, does upstream bitbake and / or OE check
> whether cleandirs are within the build directory?

That is a good question - though upstream does not have to run as root,
thus can be confined more easily.

Jan