[PATCH 1/1] isar-check-rootless: check parent dirs are world executable

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

When using mmdebstrap with the unshare backend, all parent directories
of the TMPDIR must be world executable. This requirement is documented
in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
colorful ways.

To indicate what is wrong, we add a check to the isar-check-rootless
script.

Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
PS: The corresponding kas patch is here:
https://groups.google.com/g/kas-devel/c/PZihYBAmlCQ/m/tXkK0P77BAAJ

 scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
index b5197111..de96aac7 100755
--- a/scripts/isar-check-rootless
+++ b/scripts/isar-check-rootless
@@ -20,6 +20,35 @@ fi
 
 [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
 
+if ! tmpdir=$( \
+	BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
+	ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
+	echo "error: cannot determine TMPDIR from BitBake" >&2
+	exit 1
+fi
+
+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
+
+failed=0
+fail() {
+	echo "error: $1" >&2
+	echo "       likely cause: $2" >&2
+	failed=1
+}
+
+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
+# subordinate user. That user can only reach it if every ancestor of TMPDIR is
+# world-executable (see mmdebstrap(1), TMPDIR).
+dir=$tmpdir
+while [ "$dir" != "/" ]; do
+	if [ -e "$dir" ] && \
+	   [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
+		fail "'$dir' is not world-executable" \
+			"a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
+	fi
+	dir=$(dirname "$dir")
+done
+
 if ! ${run_privileged_cmd} /bin/sh <<'EOF'
 	failed=0
 
@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
 	exit "$failed"
 EOF
 then
+	failed=1
+fi
+
+if [ "$failed" != 0 ]; then
 	echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
 	exit 1
 fi
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260910144327.775731-1-felix.moessbauer%40siemens.com.