[RFC 00/12] add support to build isar unprivileged

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

Dear isar-users,

currently isar requires password-less sudo and an environment
where mounting file systems is possible. This has proven problematic
for security reasons, both when running in a privileged container or
locally.

To solve this, we implement fully rootless builds that rely on the
unshare syscall which allows us to avoid sudo and instead operate in
temporary kernel namespaces as a user that is just privileged within
that namespace. This comes with some challenges regarding the handling
of mounts (they are cleared when leaving the namespace), as well as
cross namespace deployments (the outer user might not be able to access
the inner data). For that, we rework the handling of mounts and artifact
passing to make it compatible with both chroot modes (schroot and
unshare).

The patches 1-10 align the file permissions of deployments and artifacts
to avoid the use of chown (which will not work anymore across uid
boundaries). In addition, helpers are introduced to perform privileged
operations, which simplifies the migration of existing layers.

The patches 11 and 12 introduce the unshare mode, which can be executed
as a normal user and does not require root. To enable this mode, set
ISAR_ROOTLESS = "1".

While the series is by far not complete yet, it already passes the DevTest
CI. Know issues are currently:

- no support for VM and container images
- unprivileged cleanup of the build/tmp dir is non trivial
- sporadic issues on partial rebuilds on rootfs_install_sstate_finalize
- interfaces between kas and isar need to be defined

Note, that this series can be tested on a custom kas-container build
provided in [1]. Hints how to migrate downstream layers are provided
in the API changelog.

[1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (12):
  refactor bootstrap: store rootfs tar with user permissions
  deb-dl-dir: export without root privileges
  download debs without locking
  introduce wrappers for privileged execution
  bootstrap: move cleanup trap to function
  rootfs: rework sstate caching of rootfs artifact
  rootfs_generate_initramfs: rework deployment to avoid chowning
  wic: rework image deploy logic to deploy under correct user
  use bitbake function to generate mounting scripts
  apt-fetcher: prepare for chroot specific fetching
  add support for fully rootless builds
  apt-fetcher: implement support for unshare backend

 Kconfig                                       |   2 +-
 RECIPE-API-CHANGELOG.md                       |  57 +++++
 doc/user_manual.md                            |   2 +
 meta/classes-global/base.bbclass              |  93 ++++++++
 meta/classes-recipe/deb-dl-dir.bbclass        |  20 +-
 meta/classes-recipe/dpkg-base.bbclass         |  20 +-
 meta/classes-recipe/dpkg-source.bbclass       |   2 +-
 meta/classes-recipe/dpkg.bbclass              |  16 +-
 .../image-account-extension.bbclass           |   4 +-
 .../image-locales-extension.bbclass           |  13 +-
 .../image-postproc-extension.bbclass          |  30 +--
 .../image-tools-extension.bbclass             |  96 +++++++-
 meta/classes-recipe/image.bbclass             |  24 +-
 meta/classes-recipe/imagetypes.bbclass        |  47 ++--
 .../imagetypes_container.bbclass              |  26 +--
 meta/classes-recipe/imagetypes_wic.bbclass    |  12 +-
 meta/classes-recipe/rootfs.bbclass            | 221 ++++++++++--------
 meta/classes-recipe/sbuild.bbclass            |  37 ++-
 meta/classes-recipe/sdk.bbclass               |  23 +-
 meta/classes-recipe/squashfs.bbclass          |   2 +-
 meta/classes/sbom.bbclass                     |   2 +-
 meta/conf/bitbake.conf                        |   7 +-
 meta/lib/aptsrc_fetcher.py                    |  90 ++++++-
 .../isar-mmdebstrap/isar-mmdebstrap.inc       |  47 ++--
 .../sbuild-chroot/sbuild-chroot.inc           |  24 +-
 .../unittests/test_image_account_extension.py |   9 +-
 26 files changed, 691 insertions(+), 235 deletions(-)

-- 
2.51.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260218115827.3947145-1-felix.moessbauer%40siemens.com.