[PATCH 2/2] rootfs-add-files: use privileged execution helper for rootless builds

["'Clara Kowalsky' via isar-users" <isar-users@googlegroups.com>]

rootfs_add_files uses host sudo to create directories and files.
In unshare mode, package installation runs as root in a user namespace,
where host-root ownership may not map to namespace root. Dpkg can then
fail to replace a rootfs file with:

Unable to create `<path>.dpkg-new`: Permission denied.

Use RUN_PRIVILEGED_CMD for rootfs operations and disable ownership
preservation when copying files in unshare mode.

Fixes: 4fedb1ae6f90 ("add support for fully rootless builds")
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 meta/classes-recipe/rootfs-add-files.bbclass | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index d33752f3..b21e282b 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -16,6 +16,13 @@ ROOTFS_ADDITIONAL_FILES ??= ""
 
 
 python rootfs_add_files() {
+    import shlex
+
+    cmd = shlex.split(d.getVar('RUN_PRIVILEGED_CMD'))
+    copy_args = ['-a']
+    if d.getVar('ISAR_CHROOT_MODE') == 'unshare':
+        copy_args.append('--no-preserve=ownership')
+
     postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
     rootfsdir = d.getVar("ROOTFSDIR")
 
@@ -24,18 +31,18 @@ python rootfs_add_files() {
         destination = d.getVarFlag(additional_file_entry, "destination") or ""
         source = d.getVarFlag(additional_file_entry, "source") or ""
         if os.path.exists(f"{rootfsdir}/{destination}"):
-            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
+            bb.process.run(cmd + ["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
 
         dest_dir = os.path.dirname(destination)
-        bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
+        bb.process.run(cmd + ["/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}"])
         # empty source creates only an empty destination file
         if not source:
-            bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
+            bb.process.run(cmd + ["/usr/bin/touch", f"{rootfsdir}/{destination}"])
             return
 
         if not os.path.exists(f"{source}"):
             bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
         # no recursive copy only single files
-        bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
+        bb.process.run(cmd + ["/usr/bin/cp"] + copy_args + [source, f"{rootfsdir}/{destination}"])
 }
 ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021112532.3824701-2-clara.kowalsky%40siemens.com.