From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 15 Jul 2026 13:06:15 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pl1-f186.google.com (mail-pl1-f186.google.com [209.85.214.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66FB6DpT022799 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 15 Jul 2026 13:06:14 +0200 Received: by mail-pl1-f186.google.com with SMTP id d9443c01a7336-2caa9a3cf7asf6341355ad.0 for ; Wed, 15 Jul 2026 04:06:14 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1784113568; cv=pass; d=google.com; s=arc-20260327; b=RkysWtFplb1V1Xsp13yVQShYb3wKUjHqpcKJcw8H6B1BvIriPl5bNwDl7TtVG5prxE 7o6jiWsIpx+EjtpSEgf6OLo8MPJ2ZbSe+HYoiYbHJ1iLWam+OOneWgXbcHOQtqpOvc9d dNukFYQtC3J+jRBC3sTHG/lfPIIaHmS/ufk7mvx288Uqo1C+eb6Q9Qz16xxda8NllOrF xr9y5tWY2Nywr/Cl6AMPR2VP5aQyXLSAYX/4JTXO9MwIEwH18XHvUkg83fvbsoHZCbmm 2mUg4lsSSuVyzSiKmdBrJHro7Mdj5v2AsoWNulq1gEUlAEjz3wY5uoDafl/Q7OF9zNI+ mLtA== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=dEXfQn+918WyJ7DgaRKB/LChFU4U1/SqURFqwlubEDI=; fh=mUMts5CptexWxDQobg8+HmS3CLXwchxri2p3FMhmUrw=; b=eASc1EJmmmLFB9iqmzM2udIs7czzVVArIM1rTJuVA1O1O4esU8djrXv3HOK0j/obS/ NJ8ymyBoh8VNqZJ9GetWxk5gb2AnLHsprp4BtE6xkC39KyhK8fjesubo4TMG6mEJKgpJ eJZiSD+Pte27JX5RatXL1+IWDbmmTXNkx9a30vtn8j6mT1JbSlHVgUI6Zv6lH5ixktDt NE6EdoHW7LJtD4ZumZK4YSXc+j+nLNi0nqVije+Fb+pIYtATtaeEJzaxmATxmqetPzeU ghFbMbDNrN8aRQfx+ARpfPjXwH50+RmwaKXRMuykFnZU6x/Kff+piUGzepeA5dFykrb4 RtLA==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=xvsgV9S2; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1784113568; x=1784718368; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=dEXfQn+918WyJ7DgaRKB/LChFU4U1/SqURFqwlubEDI=; b=CnVRIXGcrWYkXO79tdeJzIiuI20uhhYdtCyIwHpgFEolCsRy0FHwgBCPAMK/2TE6YO mzY47gywIc9dHorbPwyIfkDXByVlpnn1edjBsrN12nSoTNhaCNKm96ExiupbItJM17xg J5Hp8cJzAPjIyNJ29HmoP3NhbkbPdNueeCyij4N+aaWg4XB32ZO/phCfsaSRCbHR+iGq 2undH8et30z5Q5iOh0oZ/QCS8ZiAKCFaK9qSS3deJJw4C9Evm/qFGiZ3buhW0urcCSkE ODCtaUnAkh0ohJ4jCF4syyOY1SzLaXIB6CQwHJCZnrjfiUIjENcg+1yUEU5w5RU9wiMW 1Qtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784113568; x=1784718368; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=dEXfQn+918WyJ7DgaRKB/LChFU4U1/SqURFqwlubEDI=; b=douXPePhtm+gWZ6iqv0wIMCf7xSzEyaWpGHtSKEVMZbdwQ7oLieRY0Am1JgDuea6Yl MAejCMHVCVPoo53PO4jsTIfMKVcLGrgYpAnON6I9/gbr4WojBQ8+DcJICKaTt8GJRs5f Oy6NPt6JIvo28NFvn86+f03+TWu2++sHWN/xWavXoKaMxKazYIZCj6z8fCmRVwxlReCq o8ylFgdRsw5RjcVOQXbLzYmOscUq+uIUZihuTEdQ9WuindR2PzTZ0f+fZ+gBHx5Acn81 33te9yLQoJVzX6vRN+mjSxmnyZdZ2pUyXeYSo+4WbL3Lrv/GYrdkGR2h0tW5eEvhhvGn ACUA== X-Forwarded-Encrypted: i=3; AHgh+RpKdonksjSKJSgx9IBE6I+MqhecHTr4yiXOR8j+6zlPE5qqI1n+DQ9hx7t479nuXbFcws6Y@ilbers.de X-Gm-Message-State: AOJu0YwQU3TFfZQ8s/VpLKSyCM+lvLw8XsjzsA+WXHlvrHzGsk/58fIJ YBOv0AyfDqWakySvrZP2eNk+PzCOlkrFtFgXdQUfYDDfcj/9VEGPz6qn X-Received: by 2002:a17:903:f8c:b0:2cc:89ce:2f07 with SMTP id d9443c01a7336-2cea16a42fbmr143389445ad.1.1784113567899; Wed, 15 Jul 2026 04:06:07 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Aa7YSPQxJlheVng6EtaSPnUn4y/1o0YDh213DR2kZpPH+MHp9w==" Received: by 2002:a17:902:82c2:b0:2c9:8785:981f with SMTP id d9443c01a7336-2cf091096c3ls2473885ad.2.-pod-prod-00-us-canary; Wed, 15 Jul 2026 04:06:06 -0700 (PDT) X-Received: by 2002:a17:903:3b88:b0:2cc:80d6:b72 with SMTP id d9443c01a7336-2cea1852ee9mr139336255ad.20.1784113566460; Wed, 15 Jul 2026 04:06:06 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1784113566; cv=pass; d=google.com; s=arc-20260327; b=NLhV9NEbzkpAaJmg7y2lHZHAKVev4C97alxVYey+A0X9jx4BD9AHCXSwcTegVfDBjQ zrOwr6Pb8emcRbXmAuL32TyJFg01ErT7jAMLLnYSlm/jcqAj2EWvqN6mpMD2O0JBanlF hPQROAoLh9qL8YVue4mcQLP80Atv/WeMG0pOH+IGZw2TelCc48mIykffn5Hqbbl0gyMr 3YM/Mj5pDtjfsrmjXKUgTKwIUo4miVwUlHyXM9geq/v7h77a2aGlbuU5UvW156485qrq luW7NY2FnpPmG14wULJqZRh3QnRx6BZzY/9ihZ+ikSbyYBqKjOHTsSyto6zpPtZ3p3fo Lhqg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=5+ymrNWVlPads0LEbtMo5+nAH245iRVgPCQ295xHTHA=; fh=WkhL8kaJc+l2wQon1t06Ej3uvBGj9sVhNcE8PaS/XbI=; b=SZGDsm78NGxmlcF4U1sywxbXZuagBS/kLsITrOn+WAvyxjB+lhRR0V16YSI6gWML1P e76Y+0Yvu4wj+AnKUQ9pKDR5B6Kbw2ufqh/uqiOachStg9iySG56hb2x/7goHTXqVtGz uHgS2P38hJGCtYeRFmIoKGjdspyRcovw2YVb/Ln7PYaY7A6Dpz6gje2O0Bg1uUEgA5yI ZqtTZbHimyq48hojOfzlcnuz+cB4p13/vI0z/qx0butOEd43nBxWwVjjQdPx9Jny99PA NHRnWM0BCJJ77Nfpwww8RF2JNrTsdr6xfZH/GWWjKadHlW73KXfxzyJr2KtmW0xwEQjz Lhjw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=xvsgV9S2; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c201::3]) by gmr-mx.google.com with ESMTPS id d9443c01a7336-2cf10489ad5si21625ad.8.2026.07.15.04.06.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 04:06:06 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) client-ip=2a01:111:f403:c201::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BrYfmqYAk6QuRZJpA7Yh7VtWiyugD3xQHzncXF0XZ/3P/crlASdtTYVqZaWWXfHd20aZ9gA4XzCEYQj51nIkOFrUy0PplDo2NO0FzBNALDYQzRwV1Tk909XtljIAuAz2LQ7n6T6dsA6V6iIIrsoVLyNJuLvr6t0HNUE6xRxqAp/5w1lUoHpfloYLzRxh6PbfkOc9pI+LnzExXa6Y5Zygd+SinA8lv0L7QXEx61yJoEhmB59zqDgGCabA4eUleJw9gF2ZuFR4wQpVfG2P40AZKuXAeRVNR3i4XDwg1CAHw3axwW66XnxgtXoLTaqHe0+Z5C6W/R25Ioar3CDxFUclaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5+ymrNWVlPads0LEbtMo5+nAH245iRVgPCQ295xHTHA=; b=Q0/ANUBT0hQ3jBqJv64ObqnSJeIMlw7iLIs683BglInj0xg0DuRIQ8le5QLQuTLmntaJz5IF4BmAG3tr475UINUUOgjYFROM6iYcjplEFN2N7TPFe5tx6KKNwcY1hoVp3onvKWv23VyRgptVFogEt1igXP4DLe7rr1eiNHR+9QUm+KWMokF2tdHsYUOJC4930YandCnPbRnzm84YzGdx3nXpZSvmdeVr2CdhOEHhMrKYKzve6CLqA59LAbcCKTtC6mXonHByVcI4E9pEKvug/EGYO61+nEvCxXwn9zsDcaa++yedVi5zx2RPlbRpkZS2eqyu5hskxH4zXHOqfBjq3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by PAWPR10MB7915.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:366::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.11; Wed, 15 Jul 2026 11:06:02 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%5]) with mapi id 15.21.0202.018; Wed, 15 Jul 2026 11:06:02 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, Felix Moessbauer Subject: [PATCH v8 00/17] add support to build isar unprivileged Date: Wed, 15 Jul 2026 13:05:31 +0200 Message-ID: <20260715110548.3605767-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.53.0 Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR2P281CA0166.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:99::13) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|PAWPR10MB7915:EE_ X-MS-Office365-Filtering-Correlation-Id: e6036596-6809-4ea1-ec39-08dee2610ed5 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|10070799003|376014|6133799003|56012099006|11063799006|10067099003|55112099003|18002099003; X-Microsoft-Antispam-Message-Info: XTKGrWua7OU1Kux78Z2h5HC3+JNTKEJJiuWKcccw/Aw48huPN91jPGPOwrg4cTXBUv0wi1YotQn1E6aIy79tnl5IQZdy3+xxz1lqVwpADgh6QVr41gUomwu/9xbQzGafy9CSPliAOuVqVSTquF7JGsa4rMZZoAXAl8Nf46xTW2jLv27QgpaBj4hfvEnnCd2HIZej9PFdKteRY8cakfCzxVtoUZmAQJOGYTiUfHjxrJWKVnCvZbV/bwPIVC82Zp823nxCCa4nWIVpRzgTzLYTQJ4rLGt1t3wcMmOCK0FmxOlNIisFq71DBtyRHNZk0cHnWz0bWr+xmHP2EJub5gHbnDQP8+qP4C+zd6Wa056N1bn8DxI7WkLAPOpWTZNL6kS9d/bn3MtQuXG1xeT1sVsEeNWJO7baADthxxmihvypLZJe5p0Y6bYW8dhwXM/4K9qJ6Wz7XGrIhpkJhAnzKRvULh61W7nryX04EgBXz0Z6V3xbAoVsL92CHBUtpj3UazFYcWnrClyYzVUDOUCj/aG+Fu0Vw1ud1mDdWB8b8DsT8iv05xesDVIbbRF11STrIMmD1OjTr/wLyWktjuBfxC5GVyDr6YikSWVVVcR/WWfKKcc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(10070799003)(376014)(6133799003)(56012099006)(11063799006)(10067099003)(55112099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?O8g9kCD9X+4SaOT/z8ASwmY1ffMysqwckDW4gq98aU9+3P/unWY97yxonaHh?= =?us-ascii?Q?MG2nxLCqchTw9dD4wpTV0s5Ydz1PJ+nJhZI135lrQSBGcIktNv5E6qqx/u+f?= =?us-ascii?Q?5Qkj8zJAm9syut6YN9Ry8I5O2QWfW6ru+nCzQAVpGqdg9b49xKrTiiTrbM2u?= =?us-ascii?Q?KCbp05mlGDRudwVGUNY3XAbxemnbuuBntTcZlwfIV7PEIl1kelkEC5ZrAsTM?= =?us-ascii?Q?7KrG2dLVsB+PI7wlw72xFp43Dcgk/x6cFwePPf92U19XVELPL6qtfETJpJQF?= =?us-ascii?Q?cEoDp4ZKota9eFTNoddxw+IfNTKDvlTVm4PwJMhLt22HDQbO+el+IJnrAQF7?= =?us-ascii?Q?6GDQi+vKQ6m+Fm2dtu3T9ISpUuuvGW1B0HX/o4QuB6LccxkTB8lKJ3y8NaRw?= =?us-ascii?Q?w+XfEksj7Ry5mH5Ph2KY/aFiie3FHDLiuHtdp92DTcItFmIrWshSYi0ilVMj?= =?us-ascii?Q?rEjIX6QxY1X3yqk/tNsSSyPCjZrhiOwfMGKQeHUdnSSUPKzxGQZBlmV0390X?= =?us-ascii?Q?/T/O5QdK5n+GaoO9JMPkk4YaM4fiIowcXujQpTjjTyaoeLbIn5Mo1PZ+nrc3?= =?us-ascii?Q?6zXQH1iNHGzC57hwtdOMbPc+2S+n3ILzTibHQd4tHT7b4MT8y368DcHNfX5L?= =?us-ascii?Q?y8uuQy4U32hTFvJO3M8wDYyDc7Mguo5ayJBS6aL1ir1QXULhY/YYjIHkgwHL?= =?us-ascii?Q?FFubIKjxvhwkwo9W5+ArBmont3fd7vxafNgnVuNLEVzkAk5V/sENyxzKaBWi?= =?us-ascii?Q?VhucgoyFEtEsA6g4RX9B8wAv9Jz4FG/9pZz69qH/VKNZXUhktCRLTS+nLnsX?= =?us-ascii?Q?stm8pEyj5paTPw7+v8UtK5baL5jBOm6sKgX/de+v8CC2pyBNNDvRTEv8g+TG?= =?us-ascii?Q?DNKhufUyaD2xtbf8pt+rZuSkX2QnX5z1SYAe+PMjTj+Q/sA7F5EqirH7Z1Z8?= =?us-ascii?Q?RnqpxqKAQCFnrQNuAG37zpa0urr4S4WsiTQGGEqUDeHGFoksK4n72G+zN3VV?= =?us-ascii?Q?eUGIKUJZ/3r8xz1/T3UEVbMJOu1FE2gZ7dXkPStpNcOYcoYbwFplGM2oFETI?= =?us-ascii?Q?Jge+/ygn6RAh3GprlcDUTXm6VpVxBtrVazM3p1NeNXKclJFsHGhF2i18r1qf?= =?us-ascii?Q?1yBZ1Cg1bBLRz6deXTbZ/zoryBidW3p5UQI1TeqjsoRHH2E1ORricwpiTOa5?= =?us-ascii?Q?vcZvD3TyF62mV4pa23wPIScox3ZfWtPo7M9YZrrk4fgOEWFB+gfexaMPqa1W?= =?us-ascii?Q?2m7vAcD5+5ToTJBR0Zo+2eucsM1O8+W6y6+Y2c18hVB2reYrqsHwlUmPI9vW?= =?us-ascii?Q?+4f1WyjTF/Dy6RiucrfIl2pPDUhxmmZ5RmgLxMoegS3oY/uTKFyN18znWtka?= =?us-ascii?Q?Y1WoLntRw1QLwiJrlrlI0GIZtPgVePdAu3z39Lqrui0fvGeN4+awa98RAMiJ?= =?us-ascii?Q?TxPWE5ZdbPgHKDC6SpgSW/3fwx2pog1igYtDlmXOd8OQyOOZTCfzSCLzvrRu?= =?us-ascii?Q?E8uqrfa1T9IGdo2gxLTUJZn8w3vLZ2Pgf6XNUkaA2GLjTbtArXSXWO2qfSbF?= =?us-ascii?Q?8kHEHid1PTRWk0aJbpW36UWuYOGep3/76jzNS5wfkU09LslFsw6KNid+up0p?= =?us-ascii?Q?5UsKebE5454WQy1B9fmj5rk9gBSX466pvotDk36h5sNwkHClpceP/SqxA3HL?= =?us-ascii?Q?D0YG3rl0lbNljcOFZ7ng+OL6itufy0Svmg5YQjtF2YrWj2d154Jb5NrHckna?= =?us-ascii?Q?dag11J3ffEJ245160QDFpxKRCOBevU4FrShCKtIJM46kFtCWAXFhKIzGglRr?= X-MS-Exchange-AntiSpam-MessageData-1: X0vjc3eqO4BkJuPMv6GYfcl2yRie0JL5DBM= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: e6036596-6809-4ea1-ec39-08dee2610ed5 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jul 2026 11:06:02.2970 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Brjo23VC29K24uElGOg/rPkavXXlwecsUvL4sseNZjpK/y5iEfterSsEcyASwxVX83z5vRrtBw30MqWaahlyD0A3P2L/pBJ+UDwRp7yNwlw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR10MB7915 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=xvsgV9S2; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: qS/Kv7RkRvBg Dear isar-users, currently isar requires password-less sudo and an environment where mounting file systems is possible. This has proven problematic for security reasons, both when running in a privileged container or locally. To solve this, we implement fully rootless builds that rely on the unshare syscall which allows us to avoid sudo and instead operate in temporary kernel namespaces as a user that is just privileged within that namespace. This comes with some challenges regarding the handling of mounts (they are cleared when leaving the namespace), as well as cross namespace deployments (the outer user might not be able to access the inner data). For that, we rework the handling of mounts and artifact passing to make it compatible with both chroot modes (schroot and unshare). Note, that this series can be tested on a custom kas-container build provided in [1]. Hints how to migrate downstream layers are provided in the API changelog. Changes since PATCH v7: - rebased onto next - consistently format apt args (-o ... instead of -o...) - rootfs: fix check for ISAR_USE_CACHED_BASE_REPO - rootfs: remove left-over debug statement - report error if idmap is not available in unshare mode (instead of crashing) Changes since PATCH v6: - rebased onto next - p10: revert rootfs_install_pkgs_download to bwrap-based implementation, restoring old build performances. The underlying issue was finally understood, so the pattern could stay also under rootless. Changes since PATCH v5: - rebased onto next - adjust to changes from "Rootfs install race fix for isar-apt packages": Manually add isar-apt mount in rootfs_install_pkgs_isar_download on rootless - adjust to changes in "image-postproc: gate systemd preset-all on masked unit state": Trivial change to use run_in_chroot instead of sudo chroot. Changes since PATCH v4: - fix cleanup trap in do_bootstrap (only functional change) - keep build_system entries as "isar" until we have official kas support (and for backwards compatibility). Add reasoning to commit message - improve RECIPE-API-CHANGELOG (the kas interfaces are stable now, but not yet released) Changes since PATCH v3: - fix dracut initrd build issue (p7) - testsuite: print if rootless mode is used in summary - testsuite: append newline after ISAR_ROOTLESS = "1" in ci config - run-tests.sh: catch -p rootless=1 flag and start container in rootless mode (requires a not-yet released kas-container, corresponding kas patches are currently under review) Changes since PATCH v2: - add support for cached base apt - rootfs sstate: do not rely on fd3 for copy out, as not always available - sbom: use local copy of sbom rootfs to not leave shared instance behind - testsuite: add parameter to run in rootless mode - rebased onto v1.0 Changes since PATCH v1: - fixed broken rebase onto next - fix root_cleandirs implementation NOTE: This requires the kas series (v3) from [1] for rootless building. Changes since RFC 2: - rebased onto next - fix usage of root_cleandirs - simplify file permission handling by mapping caller user to root inside the namespace. By that, in most cases no changes to the imager are needed anymore. - implement support for devshell under rootless - switch to getpass.getuser() to query user (needed for dynamically created / remapped kas builder user) - rework mapping to be more similar to mapping used by mmdebstrap - sbuild: only copy-out of dpkg.log on schroot (unclear if needed on unshare. To be clarified) - imager-sbom: ensure sbom is extracted before entering the chroot Changes since RFC 1: - switch build_type to isar-rootless in isar.yaml (Note: switch back if testing locally in a unprepared kas container) - complete overhaul of the mounting in unshared namespaces - fixes the systemd presetting - fixes hangs when pulling from snapshot mirrors - rename the run_privileged_here to run_privileged_heredoc to clarify its intention - add support for - dpkg-source with do_fetch_common_source - vm images - container images - discoverable disk images - add helper script to clean build dir in unprivileged mode - reduce clutter we leave after finishing a build - fix issues when running in a privileged environment without sub user ids - bugfixes Note, that the rootless build dir must not reside in a git worktree (a normal git dir is fine). This is probably a bug in combination with kas-container. [1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg Best regards, Felix Moessbauer Siemens AG Felix Moessbauer (17): refactor bootstrap: store rootfs tar with user permissions deb-dl-dir: export without root privileges download debs without locking introduce wrappers for privileged execution bootstrap: move cleanup trap to function rootfs: rework sstate caching of rootfs artifact rootfs_generate_initramfs: rework deployment to avoid chowning use bitbake function to generate mounting scripts apt-fetcher: prepare for chroot specific fetching add support for fully rootless builds add helper script to clean artifacts in build dir apt-fetcher: implement support for unshare backend dpkg-source: implement multiarch support for unshare backend use copy of sbom-chroot for sbom creation add support for devshell on unshare backend testsuite: add parameter to run tests in rootless mode run-tests: add support for isar-rootless mode RECIPE-API-CHANGELOG.md | 41 ++++ doc/user_manual.md | 2 + meta/classes-global/base.bbclass | 128 +++++++++++- meta/classes-recipe/deb-dl-dir.bbclass | 22 +- meta/classes-recipe/dpkg-base.bbclass | 94 +++++++-- meta/classes-recipe/dpkg-source.bbclass | 40 +++- meta/classes-recipe/dpkg.bbclass | 19 +- .../image-account-extension.bbclass | 4 +- .../image-locales-extension.bbclass | 13 +- .../image-postproc-extension.bbclass | 30 +-- .../image-tools-extension.bbclass | 114 +++++++++- meta/classes-recipe/image.bbclass | 21 +- .../imagetypes_container.bbclass | 28 +-- meta/classes-recipe/imagetypes_wic.bbclass | 10 +- meta/classes-recipe/rootfs.bbclass | 196 +++++++++--------- meta/classes-recipe/sbuild.bbclass | 34 ++- meta/classes-recipe/sdk.bbclass | 22 +- meta/classes/sbom.bbclass | 28 ++- meta/conf/bitbake.conf | 7 +- meta/lib/aptsrc_fetcher.py | 87 +++++++- .../isar-mmdebstrap/isar-mmdebstrap.inc | 56 +++-- .../sbom-chroot/sbom-chroot.bb | 11 +- .../sbuild-chroot/sbuild-chroot.inc | 24 ++- scripts/isar-clean-builddir | 73 +++++++ scripts/run-tests.sh | 7 +- testsuite/cibuilder.py | 7 + .../unittests/test_image_account_extension.py | 9 +- 27 files changed, 886 insertions(+), 241 deletions(-) create mode 100755 scripts/isar-clean-builddir -- 2.53.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260715110548.3605767-1-felix.moessbauer%40siemens.com.