[PATCH 1/1] bootstrap: fix building from isar checkout with strict file permissions

[PATCH 1/1] bootstrap: fix building from isar checkout with strict file permissions

['Felix Moessbauer' via isar-users]

When cloning the isar repository under a umask of 0007, the
chroot-setup.sh file is not world readable. In unshare mode, the
setup-hook of mmdebstrap runs in the unprivileged namespace under a
different user, unable to read the chroot-setup.sh file. By that, the
install <...> fails. For cases like this, mmdebstrap provides the upload
helper, which internally handles the copy in of the file. As this does
not provide a way to set the permissions (in contrast to install), we
chmod the file afterwards.

Fixes: 4fedb1ae ("add support for fully rootless builds")
Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index ee6eda3c..5d4ca1ef 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -248,7 +248,8 @@ do_bootstrap() {
                    --setup-hook='mkdir -p "$1/etc/apt/trusted.gpg.d"' \
                    --setup-hook='sync-in "${WORKDIR}/trusted.gpg.d" /etc/apt/trusted.gpg.d' \
                    --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \
-                   --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \
+                   --setup-hook='upload "${WORKDIR}/chroot-setup.sh" "/chroot-setup.sh"' \
+                   --setup-hook='chmod a+rx "$1/chroot-setup.sh"' \
                    --extract-hook="$extra_extract" \
                    --essential-hook="$extra_essential" \
                    --customize-hook="$extra_customize" \
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260911075941.1175172-1-felix.moessbauer%40siemens.com.

Re: [PATCH 1/1] bootstrap: fix building from isar checkout with strict file permissions

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 9/11/26 09:59, 'Felix Moessbauer' via isar-users wrote:
> When cloning the isar repository under a umask of 0007, the
> chroot-setup.sh file is not world readable. In unshare mode, the
> setup-hook of mmdebstrap runs in the unprivileged namespace under a
> different user, unable to read the chroot-setup.sh file. By that, the
> install <...> fails. For cases like this, mmdebstrap provides the upload
> helper, which internally handles the copy in of the file. As this does
> not provide a way to set the permissions (in contrast to install), we
> chmod the file afterwards.
>
> Fixes: 4fedb1ae ("add support for fully rootless builds")
> Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
> index ee6eda3c..5d4ca1ef 100644
> --- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
> +++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
> @@ -248,7 +248,8 @@ do_bootstrap() {
>                      --setup-hook='mkdir -p "$1/etc/apt/trusted.gpg.d"' \
>                      --setup-hook='sync-in "${WORKDIR}/trusted.gpg.d" /etc/apt/trusted.gpg.d' \
>                      --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \
> -                   --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \
> +                   --setup-hook='upload "${WORKDIR}/chroot-setup.sh" "/chroot-setup.sh"' \
> +                   --setup-hook='chmod a+rx "$1/chroot-setup.sh"' \
>                      --extract-hook="$extra_extract" \
>                      --essential-hook="$extra_essential" \
>                      --customize-hook="$extra_customize" \

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/1aac300f-680d-4110-8438-8193d7cb5260%40ilbers.de.