From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 21 May 2026 20:49:22 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f56.google.com (mail-pj1-f56.google.com [209.85.216.56]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 64LInKBj001202 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 21 May 2026 20:49:21 +0200 Received: by mail-pj1-f56.google.com with SMTP id 98e67ed59e1d1-366122e01fcsf6417245a91.2 for ; Thu, 21 May 2026 11:49:21 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1779389354; cv=pass; d=google.com; s=arc-20240605; b=A1m9oe2VND5aKuMlahm75ikHfSN+h45kRP/qABihmmZQYMqujLxf/Jk9yyeQLQKqKs a1YduTS1Ai8ueIyity+z/sdolr6u+gisJLA6Vc710Fphu9MkfaFVnp243zdgqNTAC5I+ UTl9Esdk4l5vtIvlUq9nIo4KoOTkwYJKun0u2H9le42iCyumFZEjiKZmW8DMKrEhhk4q LHX/t4m9rimDxUBtZO6q/g/38QzGxi6t5Pqaa51sddp9yMSysl3/puA1pd34Y1lhhv2a LsLZpe1Gu7zYzazAO/8BT5zkyojuISVYbCJvld+wTrB0cJS28D1cI7qg1O923DKePbZz S+ew== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=m++aj1teW48MGR4NrPPpvZjLEnikRvqBhKJhmOJHhvY=; fh=MYhd5eNqivhmMVI/xgokpleIw7CHtZnLNxGeSemccUE=; b=RubW2egWTzBqfSm6hjDNR8GN1l/j++mTvuvV3jYlvr0R7tDDvu5wnIEuKhpWjDaTad 5WIbri23pWNXuBnDQzSE7JgM+4in+kU1jwjt5lhVuOVxT6MgHyDBgerwoRSwysTJPNnK pI1ItIQT2JUSAOZF2yJfb2frJkRTsI2IX7dM1e+Bgfv1i9rThfTkpfjEuaBRlbUaBGK8 g1878wIpZRyu1upY650pZ5jDaiKHDBkRD1DYJB/Gj3mpMqnUwuALQCUV0QiK9h17hoND LRRd7P18sii0i0PYSImz5vslflKHu8J1nW6XbK2EvTqJjgY6BRNvyNzpRENaPzkM6CiV 7zPw==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=nI0jdU+R; spf=pass (google.com: domain of fm-1212295-2026052118491003c2c41e090002073c-3sbusb@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1212295-2026052118491003c2c41e090002073c-3sBuSb@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1779389354; x=1779994154; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=m++aj1teW48MGR4NrPPpvZjLEnikRvqBhKJhmOJHhvY=; b=uelwl9pyx1X+AP8BlK23nejj/4rkHyC9OsRGz4swxnCMgbjXIhNnQcEVDnoV89axwh j6Q443drI5y6lG5B54U4xyXUSqoOH15c/kZ5ycS94ht7g+dRka0lIfjRybiiip96Ca6N 8dOxoFtDZGBmvxDY7VRFLAFAMQoMxPJc7O+kHAVaRhHJdFLMJ3/FUf9nxt8y5JzPsaLg aiLmIhgil/SYMljllLBYmWjkGfowNF4I7AfFn8j7EFyd1eysYlfeoSsrmHV2uTTUQ0h/ FmG5kdjFmz7bOP2f+VwJOwlpVUkMQ0uRypDuF0qqTLE7whu6sha7hi69ikNqQSrFDEwk F27g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779389354; x=1779994154; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=m++aj1teW48MGR4NrPPpvZjLEnikRvqBhKJhmOJHhvY=; b=e6dsUY2BphBtgU2oQLd19jZxPx2qRLW0gtjSuN6i1LwUSmpU2WL4Ns4cXhKB+T9DWM 3rhzZ2X0W9fIEnSCTK7R5dBZM+QA8jHlg40DAS9fcggVcMdycWNYY4b6cPrOE7mpa9SG NZt9sFsUzyWNGfGZP3KKmhNitRCo/d+xe1e1CivBdhy8iHgynGkAuNqfFTvkYHNPdJZ7 Q+ND7ETSmZ9aWpckRDy2urmpNDeYH8IkTdSjJ/FBlzEE7S15VXqazvttmzKt8NdzjMSI 4W6zafqYMWryhY5X2d8xFQuxz3rrVsufUhwqncGHccLk9yKUOnRZdzSrNieSeGhAGZ6c cbfA== X-Forwarded-Encrypted: i=2; AFNElJ8KlfkZursxlGJ3GbWLK4SAJ2IXIO3woCIsF7+QsMZcEiXaO3ydAYoKDo70bOiHlf1Acv94@ilbers.de X-Gm-Message-State: AOJu0YwLqeL6VDS9hdeKXFVpBo5+MwG7TY81UEhsQ4NzstY4UdVnacwZ OV/ZNHz/BH4U5+k5lvdqNzTME2ZTYkvUqzunRMxOe+ukptcOxN/JQK9e X-Received: by 2002:a17:90b:3f85:b0:369:73a:3266 with SMTP id 98e67ed59e1d1-36a67765ae5mr443109a91.10.1779389354519; Thu, 21 May 2026 11:49:14 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AUV6zMOvdWT365GJGZobStNvAKkYLB82by1dGpiWvWYGXHw3NA==" Received: by 2002:a17:90b:5550:b0:365:fdf:fa71 with SMTP id 98e67ed59e1d1-3692fc5b38bls11074396a91.0.-pod-prod-05-us; Thu, 21 May 2026 11:49:13 -0700 (PDT) X-Received: by 2002:a05:6a21:9996:b0:3a2:f14a:4287 with SMTP id adf61e73a8af0-3b3290e675amr177752637.6.1779389353045; Thu, 21 May 2026 11:49:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1779389353; cv=none; d=google.com; s=arc-20240605; b=agKOb3QMJ/6uzVkB4MEdFkkbhQ7+HGCpsP+820j332mNIZYze67/LZUt7Uan5CeHW/ PuQ0fDXh0RwI2wwxUB4GD7VAFjcQA3RC0sWk7UVGvsFaIs0QuwYrN8pQi9S2iPGQqxgD BhhWbFWFIi2t0R/o8b8pE43ERRQa4aem0FZXBBVYUs106RRgIlVdUnZw2LhfzHOs6yHa g4HYgx155b1tHV6sejYbzax8SfG21eQQZb59Zp5Mdi5VSN+soXIF6KlfmCMgoRsd4Ssq FOVEw+pJ8fBv8voQXxRd08dujF/kVnAd/vS7clDTwHtcO82Ayr1ITM9y64GFQIs1oiiK 8+Xw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=feedback-id:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=9TvXDI2sLeakgj77DNAdzIvFfe1dv0VihRwLz+mggas=; fh=1z37pEVhqwMLlkT4FDzOga7XBsM6Rzv6sXOq0pipxqo=; b=FSsI5lPvrIxS3WC07ia2CXV/JyglZ16LIYAA93IA2iduIpKPCWYW/O8slZV0rG9NcY 0eA0oPwskg0qRwmAqN5iJRhb0drlSPdp3eckz8dzv7lb+Sitl9Pi8LwZSbaRSEcXUEka XgTswsOMXU/1Wb/dkgZKIlu4YmKr8g8dd7JnWqMIWnrbCI8/KJD/qsc9wHiAwNQ7DzPe W5PjdQCZ/jCh9A3xcfABDm33nG9196FrskaBAkvxtsLQ3/lhO5IEYjhvkhfR0Mpggjlu a0parcGV5gqHfCtH9f3jSE9hrq/o6vH72o0//AnOEuBDCMEeP4+tNqAHhiuse6GExysX gDxg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=nI0jdU+R; spf=pass (google.com: domain of fm-1212295-2026052118491003c2c41e090002073c-3sbusb@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1212295-2026052118491003c2c41e090002073c-3sBuSb@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net. [185.136.65.226]) by gmr-mx.google.com with ESMTPS id 41be03b00d2f7-c85197849a9si46265a12.1.2026.05.21.11.49.12 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 May 2026 11:49:13 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1212295-2026052118491003c2c41e090002073c-3sbusb@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) client-ip=185.136.65.226; Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 2026052118491003c2c41e090002073c for ; Thu, 21 May 2026 20:49:10 +0200 From: "'Cedric Hombourger' via isar-users" To: isar-users@googlegroups.com Cc: Cedric Hombourger Subject: [RFC PATCH v2] image-account-extension: configure adduser UID/GID pools Date: Thu, 21 May 2026 20:48:44 +0200 Message-ID: <20260521184852.1455458-1-cedric.hombourger@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1212295:519-21489:flowmailer X-Original-Sender: cedric.hombourger@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=nI0jdU+R; spf=pass (google.com: domain of fm-1212295-2026052118491003c2c41e090002073c-3sbusb@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1212295-2026052118491003c2c41e090002073c-3sBuSb@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Cedric Hombourger Reply-To: Cedric Hombourger Content-Type: text/plain; charset="UTF-8" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: nq/V+Kf7XcC+ For users and groups with an explicit uid/gid set, generate adduser pool files so that maintainer scripts calling adduser/addgroup during package installation will reserve the expected IDs. Pool directories (/etc/adduser-uid.pool.d/ and /etc/adduser-gid.pool.d/) are used, with a numbered fragment (00-image-accounts.conf) generated from USERS/GROUPS entries. Additional .uid/.gid files from SRC_URI are installed as numbered fragments, following the same pattern as .list files for apt sources. Duplicates across fragments are filtered out (USERS/GROUPS wins) with build warnings for traceability. A new 'reserve-only' flag allows entries to exist solely for pool reservation without being explicitly created during image postprocessing. After postprocessing, ${IMAGE_FULLNAME}.uid and ${IMAGE_FULLNAME}.gid are deployed to DEPLOY_DIR_IMAGE with all users/groups from the final rootfs in adduser pool format. Work-around: /etc/adduser.conf is pre-created with UID_POOL/GID_POOL directives and --force-confold is passed to dpkg so that our version is kept when the adduser package is installed. This is needed because adduser does not support loading configuration fragments from a .d directory or from environment variables. Signed-off-by: Cedric Hombourger --- doc/user_manual.md | 73 ++++- .../image-account-extension.bbclass | 282 +++++++++++++++++- 2 files changed, 343 insertions(+), 12 deletions(-) diff --git a/doc/user_manual.md b/doc/user_manual.md index 69e8dfef..b5b54f64 100644 --- a/doc/user_manual.md +++ b/doc/user_manual.md @@ -737,7 +737,8 @@ The `GROUP_` variable contains the settings of a group named `groupna - `gid` - The numeric group id. - `flags` - A list of additional flags of the group. Those are the currently recognized flags: - - `system` - The group is created using the `--system` parameter. + - `system` - The group is created using the `--system` parameter. + - `reserve-only` - The group is not explicitly created during image postprocessing. Instead, its `gid` is reserved in the adduser GID pool so that packages creating this group via maintainer scripts will use the specified ID. The `USERS` and `USER:` variable works similar to the `GROUPS` and `GROUP:` variable. The difference are the accepted flags of the `USER:` variable. It accepts the following flags: @@ -750,13 +751,14 @@ The `USERS` and `USER:` variable works similar to the `GROUPS` and `GR - `home` - This changes the default home directory of the user with `usermod --move-home`. Only takes effect when used together with the `create-home` flag. - `shell` - This users login shell - `groups` - A space separated list of groups this user is a member of. - - `flags` - A list of additional flags of the user: - - `no-create-home` - `useradd` will be called with `-M` to prevent creation of the users home directory. - - `create-home` - `useradd` will be called with `-m` to force creation of the users home directory. - - `system` - `useradd` will be called with `--system`. - - `allow-empty-password` - Even if the `password` flag is empty, it will still be set. This results in a login without password. - - `clear-text-password` - The `password` flag of the given user contains a clear-text password and not an encrypted version of it. - - `force-passwd-change` - Force the user to change to password on first login. + - `flags` - A list of additional flags of the user: + - `no-create-home` - `useradd` will be called with `-M` to prevent creation of the users home directory. + - `create-home` - `useradd` will be called with `-m` to force creation of the users home directory. + - `system` - `useradd` will be called with `--system`. + - `allow-empty-password` - Even if the `password` flag is empty, it will still be set. This results in a login without password. + - `clear-text-password` - The `password` flag of the given user contains a clear-text password and not an encrypted version of it. + - `force-passwd-change` - Force the user to change to password on first login. + - `reserve-only` - The user is not explicitly created during image postprocessing. Instead, its `uid` is reserved in the adduser UID pool so that packages creating this user via maintainer scripts will use the specified ID. #### Example @@ -779,6 +781,61 @@ USER_root[flags] = "create-home system force-passwd-change" Some examples can be also found in `meta-isar/conf/local.conf.sample`. +#### UID/GID pool reservation + +When a user or group entry has an explicit `uid` or `gid` set, it is added to +the adduser UID/GID pool. This ensures that packages creating users or groups +via their maintainer scripts (e.g. `adduser` or `addgroup`) will allocate the +specified IDs. Combined with the `reserve-only` flag, this allows reserving IDs +without explicitly creating the accounts: + +``` +USERS += "tss" +USER_tss[uid] = "666" +USER_tss[flags] = "reserve-only" + +GROUPS += "tss" +GROUP_tss[gid] = "666" +GROUP_tss[flags] = "reserve-only" + +GROUPS += "docker" +GROUP_docker[gid] = "1234" +GROUP_docker[flags] = "reserve-only" +``` + +In this example, when `tpm2-abrmd` or `docker.io` are installed, their +maintainer scripts will create the `tss` and `docker` accounts using the +reserved IDs rather than dynamically allocated ones. + +#### UID/GID pool files from SRC_URI + +Pool entries can also be provided via `.uid` and `.gid` files in `SRC_URI`. +These files use the adduser pool format (`name:id`, one per line) and are +installed as numbered fragments in `/etc/adduser-uid.pool.d/` and +`/etc/adduser-gid.pool.d/` respectively. + +``` +SRC_URI += "file://my-accounts.uid file://my-accounts.gid" +``` + +Where `my-accounts.uid` might contain: + +``` +# Reserve UIDs for package-created users +tss:666 +sshd:800 +``` + +Entries from `USERS`/`GROUPS` (placed in `00-image-accounts.conf`) take +priority over SRC_URI pool files. Duplicates are automatically filtered +with a build warning indicating which entries were dropped and from which +file. + +After image postprocessing, `${IMAGE_FULLNAME}.uid` and +`${IMAGE_FULLNAME}.gid` files are deployed to `DEPLOY_DIR_IMAGE` containing +all users and groups from the final rootfs. These files can be used as pool +inputs for other images to maintain consistent UID/GID allocation. + #### Home directory contents prefilling To cover all users simply use `/etc/skel`. Files in there will be available in every home directory under correct permissions. diff --git a/meta/classes-recipe/image-account-extension.bbclass b/meta/classes-recipe/image-account-extension.bbclass index e874f3c7..52eeec1b 100644 --- a/meta/classes-recipe/image-account-extension.bbclass +++ b/meta/classes-recipe/image-account-extension.bbclass @@ -14,16 +14,18 @@ python() { for entry in (d.getVar("GROUPS") or "").split(): group_entry = "GROUP_{}".format(entry) d.appendVarFlag("image_postprocess_accounts", "vardeps", " {}".format(group_entry)) + d.appendVarFlag("image_configure_adduser_pools", "vardeps", " {}".format(group_entry)) d.appendVarFlag("do_rootfs_install", "vardeps", " {}".format(group_entry)) for entry in (d.getVar("USERS") or "").split(): user_entry = "USER_{}".format(entry) d.appendVarFlag("image_postprocess_accounts", "vardeps", " {}".format(user_entry)) + d.appendVarFlag("image_configure_adduser_pools", "vardeps", " {}".format(user_entry)) d.appendVarFlag("do_rootfs_install", "vardeps", " {}".format(user_entry)) } do_rootfs_install[vardeps] += "GROUPS USERS" -def image_create_groups(d: "DataSmart") -> None: +def image_create_groups(d): """Creates the groups defined in the ``GROUPS`` bitbake variable. Args: @@ -40,6 +42,10 @@ def image_create_groups(d: "DataSmart") -> None: args = [] group_entry = "GROUP_{}".format(entry) + flags = (d.getVarFlag(group_entry, "flags") or "").split() + if "reserve-only" in flags: + continue + with open("{}/etc/group".format(rootfsdir), "r") as group_file: exists = any(line.startswith("{}:".format(entry)) for line in group_file) @@ -59,7 +65,7 @@ def image_create_groups(d: "DataSmart") -> None: bb.process.run([*chroot, "/usr/sbin/groupadd", *args, entry]) -def image_create_users(d: "DataSmart") -> None: +def image_create_users(d): """Creates the users defined in the ``USERS`` bitbake variable. Args: @@ -78,6 +84,10 @@ def image_create_users(d: "DataSmart") -> None: args = [] user_entry = "USER_{}".format(entry) + flags = (d.getVarFlag(user_entry, "flags") or "").split() + if "reserve-only" in flags: + continue + with open("{}/etc/passwd".format(rootfsdir), "r") as passwd_file: exists = any(line.startswith("{}:".format(entry)) for line in passwd_file) @@ -99,8 +109,6 @@ def image_create_users(d: "DataSmart") -> None: args.append("--groups") args.append(','.join(groups)) - flags = (d.getVarFlag(user_entry, "flags") or "").split() - if exists: add_user_option("--home", "home") if d.getVarFlag(user_entry, "home") or "": @@ -143,9 +151,275 @@ def image_create_users(d: "DataSmart") -> None: bb.process.run([*chroot, "/usr/bin/passwd", "--expire", entry]) +def account_pool_files(d): + """Returns lists of .uid and .gid files found in SRC_URI.""" + uid_files = [] + gid_files = [] + sources = d.getVar("SRC_URI").split() + for s in sources: + _, _, local, _, _, _ = bb.fetch.decodeurl(s) + base, ext = os.path.splitext(os.path.basename(local)) + if ext == ".uid": + uid_files.append(local) + elif ext == ".gid": + gid_files.append(local) + return uid_files, gid_files + + +def configure_adduser_pools(d): + """Configures adduser UID/GID pools for users and groups with explicit IDs. + + Creates pool directories (/etc/adduser-uid.pool.d/ and + /etc/adduser-gid.pool.d/) containing: + - A numbered fragment (00-image-accounts.conf) generated from + USERS/GROUPS entries with explicit uid/gid. + - Additional .uid/.gid files from SRC_URI copied as numbered fragments. + + A minimal /etc/adduser.conf is pre-created pointing UID_POOL and GID_POOL + at the respective directories. + + Args: + d (DataSmart): The bitbake datastore. + + Returns: + None + """ + import os + import tempfile + + rootfsdir = d.getVar("ROOTFSDIR") + workdir = d.getVar("WORKDIR") + adduser_conf = "{}/etc/adduser.conf".format(rootfsdir) + uid_pool_dir = "/etc/adduser-uid.pool.d" + gid_pool_dir = "/etc/adduser-gid.pool.d" + + uid_pool_entries = [] + seen_users = set() + for entry in (d.getVar("USERS") or "").split(): + if entry in seen_users: + continue + seen_users.add(entry) + user_entry = "USER_{}".format(entry) + uid = d.getVarFlag(user_entry, "uid") or "" + if uid: + uid_pool_entries.append("{}:{}".format(entry, uid)) + + gid_pool_entries = [] + seen_groups = set() + for entry in (d.getVar("GROUPS") or "").split(): + if entry in seen_groups: + continue + seen_groups.add(entry) + group_entry = "GROUP_{}".format(entry) + gid = d.getVarFlag(group_entry, "gid") or "" + if gid: + gid_pool_entries.append("{}:{}".format(entry, gid)) + + # Collect .uid/.gid files from SRC_URI + src_uid_files, src_gid_files = account_pool_files(d) + + has_uid_pool = uid_pool_entries or src_uid_files + has_gid_pool = gid_pool_entries or src_gid_files + + if not has_uid_pool and not has_gid_pool: + return + + # Create pool directories + if has_uid_pool: + bb.process.run( + ["sudo", "mkdir", "-p", "{}{}".format(rootfsdir, uid_pool_dir)]) + if has_gid_pool: + bb.process.run( + ["sudo", "mkdir", "-p", "{}{}".format(rootfsdir, gid_pool_dir)]) + + # Track seen names and IDs to detect duplicates across fragments. + # 00-image-accounts.conf (from USERS/GROUPS) has highest priority. + uid_seen_names = set() + uid_seen_ids = set() + gid_seen_names = set() + gid_seen_ids = set() + + # Install fragment from USERS/GROUPS as 00-image-accounts.conf + if uid_pool_entries: + for e in uid_pool_entries: + name, uid = e.split(":") + uid_seen_names.add(name) + uid_seen_ids.add(uid) + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: + f.write("\n".join(uid_pool_entries) + "\n") + tmp = f.name + bb.process.run( + ["sudo", "cp", tmp, + "{}{}/00-image-accounts.conf".format(rootfsdir, uid_pool_dir)]) + os.unlink(tmp) + + if gid_pool_entries: + for e in gid_pool_entries: + name, gid = e.split(":") + gid_seen_names.add(name) + gid_seen_ids.add(gid) + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: + f.write("\n".join(gid_pool_entries) + "\n") + tmp = f.name + bb.process.run( + ["sudo", "cp", tmp, + "{}{}/00-image-accounts.conf".format(rootfsdir, gid_pool_dir)]) + os.unlink(tmp) + + # Install .uid files from SRC_URI as numbered fragments, filtering + # duplicates. Keeping original filenames provides traceability. + for idx, uid_file in enumerate(src_uid_files, start=1): + src = os.path.join(workdir, uid_file) + filtered_lines = [] + with open(src, "r") as f: + for line in f: + stripped = line.strip() + if not stripped or stripped.startswith("#"): + filtered_lines.append(line) + continue + parts = stripped.split(":") + if len(parts) < 2: + filtered_lines.append(line) + continue + name, uid = parts[0], parts[1] + if name in uid_seen_names: + bb.warn("{}: dropping '{}' (name already in pool)" + .format(uid_file, stripped)) + continue + if uid in uid_seen_ids: + bb.warn("{}: dropping '{}' (UID {} already in pool)" + .format(uid_file, stripped, uid)) + continue + uid_seen_names.add(name) + uid_seen_ids.add(uid) + filtered_lines.append(line) + + dst_name = "{:02d}-{}.conf".format(idx, os.path.splitext(uid_file)[0]) + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: + f.writelines(filtered_lines) + tmp = f.name + bb.process.run( + ["sudo", "cp", tmp, "{}{}/{}".format(rootfsdir, uid_pool_dir, dst_name)]) + os.unlink(tmp) + + # Install .gid files from SRC_URI as numbered fragments, filtering + # duplicates. + for idx, gid_file in enumerate(src_gid_files, start=1): + src = os.path.join(workdir, gid_file) + filtered_lines = [] + with open(src, "r") as f: + for line in f: + stripped = line.strip() + if not stripped or stripped.startswith("#"): + filtered_lines.append(line) + continue + parts = stripped.split(":") + if len(parts) < 2: + filtered_lines.append(line) + continue + name, gid = parts[0], parts[1] + if name in gid_seen_names: + bb.warn("{}: dropping '{}' (name already in pool)" + .format(gid_file, stripped)) + continue + if gid in gid_seen_ids: + bb.warn("{}: dropping '{}' (GID {} already in pool)" + .format(gid_file, stripped, gid)) + continue + gid_seen_names.add(name) + gid_seen_ids.add(gid) + filtered_lines.append(line) + + dst_name = "{:02d}-{}.conf".format(idx, os.path.splitext(gid_file)[0]) + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: + f.writelines(filtered_lines) + tmp = f.name + bb.process.run( + ["sudo", "cp", tmp, "{}{}/{}".format(rootfsdir, gid_pool_dir, dst_name)]) + os.unlink(tmp) + + # Ensure pool directories are world-readable + if has_uid_pool: + bb.process.run( + ["sudo", "chmod", "-R", "a+rX", "{}{}".format(rootfsdir, uid_pool_dir)]) + if has_gid_pool: + bb.process.run( + ["sudo", "chmod", "-R", "a+rX", "{}{}".format(rootfsdir, gid_pool_dir)]) + + # Work-around: pre-create /etc/adduser.conf with pool directives and use + # --force-confold so dpkg keeps our version when the adduser package is + # installed. This is needed because adduser does not support loading + # configuration from /etc/adduser.conf.d/ or from environment variables. + conf_lines = [] + conf_lines.append("# /etc/adduser.conf: `adduser' configuration.") + conf_lines.append("# See adduser(8) and adduser.conf(5) for full documentation.") + conf_lines.append("") + if has_uid_pool: + conf_lines.append("UID_POOL={}".format(uid_pool_dir)) + if has_gid_pool: + conf_lines.append("GID_POOL={}".format(gid_pool_dir)) + + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: + f.write("\n".join(conf_lines) + "\n") + tmp = f.name + bb.process.run(["sudo", "cp", tmp, adduser_conf]) + bb.process.run(["sudo", "chmod", "644", adduser_conf]) + os.unlink(tmp) + + +# Work-around: use --force-confold so dpkg keeps our pre-created +# /etc/adduser.conf when the adduser package is installed. +ROOTFS_APT_ARGS += "-o DPkg::Options::=--force-confold" + +ROOTFS_CONFIGURE_COMMAND += "image_configure_adduser_pools" +image_configure_adduser_pools[vardeps] += "USERS GROUPS" +python image_configure_adduser_pools() { + configure_adduser_pools(d) +} + ROOTFS_POSTPROCESS_COMMAND += "image_postprocess_accounts" image_postprocess_accounts[vardeps] += "USERS GROUPS" python image_postprocess_accounts() { image_create_groups(d) image_create_users(d) + image_deploy_id_pools(d) } + + +def image_deploy_id_pools(d): + """Deploys UID/GID pool files from the final rootfs to DEPLOY_DIR_IMAGE. + + Generates ${IMAGE_FULLNAME}.uid and ${IMAGE_FULLNAME}.gid files in + adduser pool format (name:id) from /etc/passwd and /etc/group. + + Args: + d (DataSmart): The bitbake datastore. + + Returns: + None + """ + import os + + rootfsdir = d.getVar("ROOTFSDIR") + deploy_dir = d.getVar("DEPLOY_DIR_IMAGE") + image_fullname = d.getVar("IMAGE_FULLNAME") + + os.makedirs(deploy_dir, exist_ok=True) + + # Generate .uid from /etc/passwd + uid_file = os.path.join(deploy_dir, "{}.uid".format(image_fullname)) + with open("{}/etc/passwd".format(rootfsdir), "r") as f: + with open(uid_file, "w") as out: + for line in f: + fields = line.strip().split(":") + if len(fields) >= 3: + out.write("{}:{}\n".format(fields[0], fields[2])) + + # Generate .gid from /etc/group + gid_file = os.path.join(deploy_dir, "{}.gid".format(image_fullname)) + with open("{}/etc/group".format(rootfsdir), "r") as f: + with open(gid_file, "w") as out: + for line in f: + fields = line.strip().split(":") + if len(fields) >= 3: + out.write("{}:{}\n".format(fields[0], fields[2])) -- 2.47.3 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260521184852.1455458-1-cedric.hombourger%40siemens.com.