Re: [PATCH v5 0/5] Debootstrap integration

[Baurzhan Ismagulov <ibr@radix50.net>]

On Tue, Apr 03, 2018 at 12:07:57PM +0200, claudius.heine.ext@siemens.com wrote:
> this is the new version of this patchset, that fixes the
> generate_keyring task in isar-bootstrap for systems with read-only
> homedir.

Thanks, worked fine on my host. CI still in progress.


It's unfortunate that the series introduces regressions you wrote about
(changing mirrors, setting hostname). It's always better to fix the issues on
the spot. If there are no objections, I'd like to add TODOs to the patches.
Please let me know whether it's ok, or you would like to address those before
the merge.

What I'd really like to see is an update to doc/user_manual.md. Would you have
time for that in the next days?


If I understand the code correctly, there is also a security issue:

On Tue, Apr 03, 2018 at 12:08:00PM +0200, claudius.heine.ext@siemens.com wrote:
> +    CDIRS="${@d.expand(d.getVarFlags("do_build").get("root_cleandirs", ""))}"
> +    if [ -n "$CDIRS" ]; then
> +        sudo rm -rf $CDIRS
> +        mkdir -p $CDIRS
> +    fi

Should root_cleandirs items be checked for directory traversal ("/", "..") and
mounted filesystems in the subdirectories? If yes, do we want to drop the
feature from this series and address the issue in a separate step?


With kind regards,
Baurzhan.