Re: [PATCH] buildchroot: Align UID and GID of builder user with caller

[Henning Schild <henning.schild@siemens.com>]

Am Mon, 12 Nov 2018 10:19:54 +0100
schrieb Jan Kiszka <jan.kiszka@siemens.com>:

> On 12.11.18 10:16, [ext] Henning Schild wrote:
> > I am afraid that this is not correct. The ids you are taking from
> > the "host" might be taken inside the chroot. As a result creating
> > the user/group would fail. Chances might be low ... This also
> > assumes that  
> 
> Really? I thought that these commands are run very early during
> bootstrap where there are no other users - if not, that would be a
> bug.

I think the only uid/gid you can really be sure about is 0. 1 could
already be a regular user on the host, and 1 is "daemon" on a current
debian ... probably there right after debootstrap.

1000 being the first "user" is more a convention than something you can
rely on for any host. (/etc/login.defs UID_MIN/MAX etc.)

Henning

> Jan
> 
> > ids/hosts will never change and breaks migrating a build to another
> > host.
> > If the host fails to remove/overwrite the files, we will have to use
> > sudo on the host.
> > 
> > Henning
> > 
> > Am Sat, 10 Nov 2018 08:52:38 +0100
> > schrieb Jan Kiszka <jan.kiszka@web.de>:
> >   
> >> From: Jan Kiszka <jan.kiszka@siemens.com>
> >>
> >> This fixes EPERM on rebuild and also some clean builds: We have to
> >> align the IDs of the builder user with the user in the host
> >> environment. Otherwise, files and directories can become
> >> unaccessible during the build.
> >>
> >> Fixes: be291cd991bd ("buildchroot: build debian packages as
> >> "builder" not "root"") Signed-off-by: Jan Kiszka
> >> <jan.kiszka@siemens.com> ---
> >>   meta/recipes-devtools/buildchroot/buildchroot.inc       | 4 +++-
> >>   meta/recipes-devtools/buildchroot/files/configscript.sh | 4 ++--
> >>   2 files changed, 5 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/meta/recipes-devtools/buildchroot/buildchroot.inc
> >> b/meta/recipes-devtools/buildchroot/buildchroot.inc index
> >> 7dd909e..2c44db9 100644 ---
> >> a/meta/recipes-devtools/buildchroot/buildchroot.inc +++
> >> b/meta/recipes-devtools/buildchroot/buildchroot.inc @@ -36,7 +36,9
> >> @@ do_build() {
> >>       # Configure root filesystem
> >>       sudo install -m 755 ${WORKDIR}/configscript.sh
> >> ${BUILDCHROOT_DIR}
> >> -    sudo chroot ${BUILDCHROOT_DIR} /configscript.sh
> >> +    USER_ID=$(id -u)
> >> +    GROUP_ID=$(id -g)
> >> +    sudo chroot ${BUILDCHROOT_DIR} /configscript.sh $USER_ID
> >> $GROUP_ID
> >>       sudo mount --bind ${DL_DIR} ${BUILDCHROOT_DIR}/downloads
> >>   }
> >> diff --git
> >> a/meta/recipes-devtools/buildchroot/files/configscript.sh
> >> b/meta/recipes-devtools/buildchroot/files/configscript.sh index
> >> 30660e7..7e49385 100644 ---
> >> a/meta/recipes-devtools/buildchroot/files/configscript.sh +++
> >> b/meta/recipes-devtools/buildchroot/files/configscript.sh @@ -10,6
> >> +10,6 @@ locales locales/locales_to_be_generated multiselect
> >> en_US.UTF-8 UTF-8 locales locales/default_environment_locale
> >> select en_US.UTF-8 END -addgroup --quiet --system builder
> >> -useradd --system --gid builder --no-create-home
> >> --home /home/builder --no-user-group --comment "Isar buildchroot
> >> build user" builder +addgroup --quiet --system builder --gid $2
> >> +useradd --system --uid $1 --gid builder --no-create-home
> >> --home /home/builder --no-user-group --comment "Isar buildchroot
> >> build user" builder chown -R builder:builder /home/builder  
> >   
>