[RFC PATCH 1/2] rootfs: introduce wrapper to run native commands against a rootfs

["'Cedric Hombourger' via isar-users" <isar-users@googlegroups.com>]

"sudo chroot" is used in several places to run commands inside rootfs
directories constructed by Isar. There are cases where a native command
could be used without elevated privileges as long as special folders
such as /isar-apt are mounted (they are often referenced as /isar-apt
in configuration files found in the target rootfs). For such cases,
bubblewrap may be used to create a non-privileged namespace (either
in a bare/native environment or within a docker/podman container)
to achieve better performance when execution through QEMU may be
avoided.

Signed-off-by: Cedric Hombourger <cedric.hombourger@siemens.com>
---
 meta/classes/rootfs.bbclass | 64 +++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index f16ecc00..2975eb6b 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -30,6 +30,70 @@ export LANG = "C"
 export LANGUAGE = "C"
 export LC_ALL = "C"
 
+# Execute a native command against a rootfs and with isar-apt bind-mounted.
+# Additional mounts may be specified using --bind <source> <target> and a
+# custom directory for the command to be executed with --chdir <dir>. The
+# command is assumed to follow the special "--" argument. This would replace
+# "sudo chroot" calls especially when a native command may be used instead of
+# chroot'ed command and without elevated privileges (the command will likely
+# take the rootfs as argument; e.g. apt-get -o Dir=${ROOTFSDIR}).
+#
+# Usage: rootfs_native_cmd [options] -- command
+#
+rootfs_native_cmd() {
+    set -- "$@"
+    bwrap_args="--bind ${REPO_ISAR_DIR}/${DISTRO} /isar-apt"
+    rootfs=""
+
+    while [ "${#}" -gt "0" ] && [ "${1}" != "--" ]; do
+        case "${1}" in
+            --bind)
+                if [ "${#}" -lt "3" ]; then
+                    bbfatal "--bind requires two arguments"
+                fi
+                bwrap_args="${bwrap_args} --bind ${2} ${3}"
+                shift 3
+                ;;
+            --chdir)
+                if [ "${#}" -lt "2" ]; then
+                    bbfatal "${1} requires an argument"
+                fi
+                bwrap_args="${bwrap_args} ${1} ${2}"
+                shift 2
+                ;;
+            -*)
+                bbfatal "${1} is not a supported option!"
+                ;;
+            *)
+                if [ -z "${rootfs}" ]; then
+                    rootfs="${1}"
+                    shift
+                else
+                    bbfatal "unexpected argument '${1}'"
+                fi
+                ;;
+        esac
+    done
+
+    [ -n "${rootfs}" ] || bbfatal "no rootfs path provided"
+
+    if [ "${#}" -le "1" ] || [ "${1}" != "--" ]; then
+        bbfatal "no command specified (missing --)"
+    fi
+
+    shift  # remove the "--"
+    exec bwrap \
+        ${bwrap_args} \
+        --bind "${rootfs}" "${rootfs}" \
+        --unshare-user \
+        --unshare-pid \
+        --dev-bind /dev /dev --proc /proc --ro-bind /sys /sys \
+        --ro-bind /etc /etc --ro-bind /bin /bin \
+        --ro-bind /lib /lib --ro-bind /lib64 /lib64 \
+        --ro-bind /usr /usr --tmpfs /tmp \
+        -- "${@}"
+}
+
 rootfs_do_mounts[weight] = "3"
 rootfs_do_mounts() {
     sudo -s <<'EOSUDO'
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250515150727.1764989-2-cedric.hombourger%40siemens.com.