[PATCH] rootfs-add-files: use run_privileged_cmd instead of sudo

[PATCH] rootfs-add-files: use run_privileged_cmd instead of sudo

['Gourav Singh' via isar-users]

rootfs_add_files hard-codes "sudo -E" to create the destination
directory and copy the additional files into the rootfs. In rootless
(unshare) mode, this leaves e.g. the installer's /install directory
owned by the real root, which is not mapped into the user namespace.
Subsequent builds then fail in root_cleandirs of do_rootfs_install:

  rm: cannot remove '.../rootfs/install/<image>.wic.zst': Permission denied

Use run_privileged_cmd() instead, so that the files are created with
the same privileges as the rest of the rootfs.

While at it, also fix the removal of a pre-existing destination file,
which ran unprivileged on the host path instead of the path inside the
rootfs.

Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
---
 meta/classes-recipe/rootfs-add-files.bbclass | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index 38f739ee..d135f6d7 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -18,24 +18,25 @@ ROOTFS_ADDITIONAL_FILES ??= ""
 python rootfs_add_files() {
     postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
     rootfsdir = d.getVar("ROOTFSDIR")
+    privileged = run_privileged_cmd(d).split()
 
     for entry in postprocess_additional_files:
         additional_file_entry = f"ROOTFS_ADDITIONAL_FILE_{entry}"
         destination = d.getVarFlag(additional_file_entry, "destination") or ""
         source = d.getVarFlag(additional_file_entry, "source") or ""
-        if os.path.exists(f"{rootfsdir}/{destination}"):
-            bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
+        if os.path.lexists(f"{rootfsdir}/{destination}"):
+            bb.process.run(privileged + ["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
 
         dest_dir = os.path.dirname(destination)
-        bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
+        bb.process.run(privileged + ["/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
         # empty source creates only an empty destination file
         if not source:
-            bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
+            bb.process.run(privileged + ["/usr/bin/touch", f"{rootfsdir}/{destination}" ])
             return
 
         if not os.path.exists(f"{source}"):
             bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
         # no recursive copy only single files
-        bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
+        bb.process.run(privileged + ["/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
 }
 ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261025050932.69095-1-gouravsingh%40siemens.com.

Re: [PATCH] rootfs-add-files: use run_privileged_cmd instead of sudo

['Moessbauer, Felix' via isar-users]

On Sun, 2026-10-25 at 10:39 +0530, 'Gourav Singh' via isar-users wrote:
> rootfs_add_files hard-codes "sudo -E" to create the destination
> directory and copy the additional files into the rootfs. In rootless
> (unshare) mode, this leaves e.g. the installer's /install directory
> owned by the real root, which is not mapped into the user namespace.
> Subsequent builds then fail in root_cleandirs of do_rootfs_install:
> 
>   rm: cannot remove '.../rootfs/install/<image>.wic.zst': Permission denied
> 
> Use run_privileged_cmd() instead, so that the files are created with
> the same privileges as the rest of the rootfs.
> 
> While at it, also fix the removal of a pre-existing destination file,
> which ran unprivileged on the host path instead of the path inside the
> rootfs.

Hi, this is a duplicate of "[PATCH 2/2] rootfs-add-files: use
privileged execution helper for rootless builds".

Felix

> 
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  meta/classes-recipe/rootfs-add-files.bbclass | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
> index 38f739ee..d135f6d7 100644
> --- a/meta/classes-recipe/rootfs-add-files.bbclass
> +++ b/meta/classes-recipe/rootfs-add-files.bbclass
> @@ -18,24 +18,25 @@ ROOTFS_ADDITIONAL_FILES ??= ""
>  python rootfs_add_files() {
>      postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
>      rootfsdir = d.getVar("ROOTFSDIR")
> +    privileged = run_privileged_cmd(d).split()
>  
>      for entry in postprocess_additional_files:
>          additional_file_entry = f"ROOTFS_ADDITIONAL_FILE_{entry}"
>          destination = d.getVarFlag(additional_file_entry, "destination") or ""
>          source = d.getVarFlag(additional_file_entry, "source") or ""
> -        if os.path.exists(f"{rootfsdir}/{destination}"):
> -            bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
> +        if os.path.lexists(f"{rootfsdir}/{destination}"):
> +            bb.process.run(privileged + ["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
>  
>          dest_dir = os.path.dirname(destination)
> -        bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
> +        bb.process.run(privileged + ["/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
>          # empty source creates only an empty destination file
>          if not source:
> -            bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
> +            bb.process.run(privileged + ["/usr/bin/touch", f"{rootfsdir}/{destination}" ])
>              return
>  
>          if not os.path.exists(f"{source}"):
>              bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
>          # no recursive copy only single files
> -        bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
> +        bb.process.run(privileged + ["/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
>  }
>  ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
> -- 
> 2.39.5
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261025050932.69095-1-gouravsingh%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/fb4d34340bb3d67c26c82f4dfee59c93ce6a7658.camel%40siemens.com.

Re: [PATCH] rootfs-add-files: use run_privileged_cmd instead of sudo

['Gourav Singh' via isar-users]

[-- Attachment #1.1: Type: text/plain, Size: 4089 bytes --]

Thanks for pointing this out. Please drop this patch as it is a duplicate. 

On Monday, October 26, 2026 at 3:19:59 PM UTC+5:30 Moessbauer, Felix wrote:

> On Sun, 2026-10-25 at 10:39 +0530, 'Gourav Singh' via isar-users wrote:
> > rootfs_add_files hard-codes "sudo -E" to create the destination
> > directory and copy the additional files into the rootfs. In rootless
> > (unshare) mode, this leaves e.g. the installer's /install directory
> > owned by the real root, which is not mapped into the user namespace.
> > Subsequent builds then fail in root_cleandirs of do_rootfs_install:
> > 
> > rm: cannot remove '.../rootfs/install/<image>.wic.zst': Permission denied
> > 
> > Use run_privileged_cmd() instead, so that the files are created with
> > the same privileges as the rest of the rootfs.
> > 
> > While at it, also fix the removal of a pre-existing destination file,
> > which ran unprivileged on the host path instead of the path inside the
> > rootfs.
>
> Hi, this is a duplicate of "[PATCH 2/2] rootfs-add-files: use
> privileged execution helper for rootless builds".
>
> Felix
>
> > 
> > Signed-off-by: Gourav Singh <goura...@siemens.com>
> > ---
> > meta/classes-recipe/rootfs-add-files.bbclass | 11 ++++++-----
> > 1 file changed, 6 insertions(+), 5 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs-add-files.bbclass 
> b/meta/classes-recipe/rootfs-add-files.bbclass
> > index 38f739ee..d135f6d7 100644
> > --- a/meta/classes-recipe/rootfs-add-files.bbclass
> > +++ b/meta/classes-recipe/rootfs-add-files.bbclass
> > @@ -18,24 +18,25 @@ ROOTFS_ADDITIONAL_FILES ??= ""
> > python rootfs_add_files() {
> > postprocess_additional_files = 
> d.getVar('ROOTFS_ADDITIONAL_FILES').split()
> > rootfsdir = d.getVar("ROOTFSDIR")
> > + privileged = run_privileged_cmd(d).split()
> > 
> > for entry in postprocess_additional_files:
> > additional_file_entry = f"ROOTFS_ADDITIONAL_FILE_{entry}"
> > destination = d.getVarFlag(additional_file_entry, "destination") or ""
> > source = d.getVarFlag(additional_file_entry, "source") or ""
> > - if os.path.exists(f"{rootfsdir}/{destination}"):
> > - bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
> > + if os.path.lexists(f"{rootfsdir}/{destination}"):
> > + bb.process.run(privileged + ["/usr/bin/rm", "-f", 
> f"{rootfsdir}/{destination}"])
> > 
> > dest_dir = os.path.dirname(destination)
> > - bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", 
> f"{rootfsdir}/{dest_dir}" ])
> > + bb.process.run(privileged + ["/usr/bin/mkdir", "-p", 
> f"{rootfsdir}/{dest_dir}" ])
> > # empty source creates only an empty destination file
> > if not source:
> > - bb.process.run(["sudo", "-E", "/usr/bin/touch", 
> f"{rootfsdir}/{destination}" ])
> > + bb.process.run(privileged + ["/usr/bin/touch", 
> f"{rootfsdir}/{destination}" ])
> > return
> > 
> > if not os.path.exists(f"{source}"):
> > bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
> > # no recursive copy only single files
> > - bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a", f"{source}", 
> f"{rootfsdir}/{destination}" ])
> > + bb.process.run(privileged + ["/usr/bin/cp", "-a", f"{source}", 
> f"{rootfsdir}/{destination}" ])
> > }
> > ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
> > -- 
> > 2.39.5
> > 
>
> > -- 
> > You received this message because you are subscribed to the Google 
> Groups "isar-users" group.
> > To unsubscribe from this group and stop receiving emails from it, send 
> an email to isar-users+...@googlegroups.com.
> > To view this discussion visit 
> https://groups.google.com/d/msgid/isar-users/20261025050932.69095-1-gouravsingh%40siemens.com
> .
>

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/38f697af-21d2-4ba7-99cd-fdff50acea24n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 5907 bytes --]