[PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

[PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

['Felix Moessbauer' via isar-users]

Bubblewrap 0.12.0 is a security release that contains hardenings
regarding the handling of symlinks. This breaks the rootfs_cmd helper,
which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
(and alike).

From debian bookworm on, /bin (and alike) are just symlinks to the
corresponding dirs below /usr. In this case, we only need to mount /usr.
On earlier versions, we need to mount the /bin (and alike) dirs as well.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/rootfs.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8d394b05..0bef2d45 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -142,8 +142,9 @@ rootfs_cmd() {
     fi
     shift  # remove "--", command and its arguments follows
 
+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
     for ro_d in bin etc lib lib64 sys usr var; do
-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
     done
 
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260831084200.751483-1-felix.moessbauer%40siemens.com.

Re: [PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

['Ulrich Teichert' via isar-users]

Hi Felix,

>Bubblewrap 0.12.0 is a security release that contains hardenings
>regarding the handling of symlinks. This breaks the rootfs_cmd helper,
>which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
>(and alike).
>
>From debian bookworm on, /bin (and alike) are just symlinks to the
>corresponding dirs below /usr. In this case, we only need to mount /usr.
>On earlier versions, we need to mount the /bin (and alike) dirs as well.
>
>Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>

Thanks for fixing!

Tested-by: Ulrich Teichert <ulrich.teichert@ebs-group.io>

>---
> meta/classes-recipe/rootfs.bbclass | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
>index 8d394b05..0bef2d45 100644
>--- a/meta/classes-recipe/rootfs.bbclass
>+++ b/meta/classes-recipe/rootfs.bbclass
>@@ -142,8 +142,9 @@ rootfs_cmd() {
>     fi
>     shift  # remove "--", command and its arguments follows
>
>+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
>     for ro_d in bin etc lib lib64 sys usr var; do
>-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
>+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
>         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
>     done
>
>--
>2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/DB9PR08MB7448B7CDA5EB6138D1A3D43FC3A92%40DB9PR08MB7448.eurprd08.prod.outlook.com.

Re: [PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 8/31/26 10:42, 'Felix Moessbauer' via isar-users wrote:
> Bubblewrap 0.12.0 is a security release that contains hardenings
> regarding the handling of symlinks. This breaks the rootfs_cmd helper,
> which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
> (and alike).
>
>  From debian bookworm on, /bin (and alike) are just symlinks to the
> corresponding dirs below /usr. In this case, we only need to mount /usr.
> On earlier versions, we need to mount the /bin (and alike) dirs as well.
>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   meta/classes-recipe/rootfs.bbclass | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
> index 8d394b05..0bef2d45 100644
> --- a/meta/classes-recipe/rootfs.bbclass
> +++ b/meta/classes-recipe/rootfs.bbclass
> @@ -142,8 +142,9 @@ rootfs_cmd() {
>       fi
>       shift  # remove "--", command and its arguments follows
>   
> +    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
>       for ro_d in bin etc lib lib64 sys usr var; do
> -        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
> +        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
>           bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
>       done
>   

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/d813f511-e7d8-4cb7-b3b1-d004915ef570%40ilbers.de.