[PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

Bubblewrap 0.12.0 is a security release that contains hardenings
regarding the handling of symlinks. This breaks the rootfs_cmd helper,
which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
(and alike).

From debian bookworm on, /bin (and alike) are just symlinks to the
corresponding dirs below /usr. In this case, we only need to mount /usr.
On earlier versions, we need to mount the /bin (and alike) dirs as well.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/rootfs.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8d394b05..0bef2d45 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -142,8 +142,9 @@ rootfs_cmd() {
     fi
     shift  # remove "--", command and its arguments follows
 
+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
     for ro_d in bin etc lib lib64 sys usr var; do
-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
     done
 
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260831084200.751483-1-felix.moessbauer%40siemens.com.