* [PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds
2026-10-26 10:10 [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR 'Clara Kowalsky' via isar-users
@ 2026-10-26 10:10 ` 'Clara Kowalsky' via isar-users
2026-10-26 10:10 ` [PATCH v2 3/4] testsuite: add installer build test for rootfs-add-files 'Clara Kowalsky' via isar-users
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: 'Clara Kowalsky' via isar-users @ 2026-10-26 10:10 UTC (permalink / raw)
To: isar-users; +Cc: felix.moessbauer, Clara Kowalsky
rootfs_add_files uses host sudo to create directories and files.
In unshare mode, package installation runs as root in a user namespace,
where host-root ownership may not map to namespace root. Dpkg can then
fail to replace a rootfs file with:
Unable to create `<path>.dpkg-new`: Permission denied.
Use RUN_PRIVILEGED_CMD for rootfs operations and disable ownership
preservation when copying files in unshare mode.
Fixes: 4fedb1ae6f90 ("add support for fully rootless builds")
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
meta/classes-recipe/rootfs-add-files.bbclass | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index d33752f3..b093a3ce 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -16,6 +16,11 @@ ROOTFS_ADDITIONAL_FILES ??= ""
python rootfs_add_files() {
+ cmd = d.getVar('RUN_PRIVILEGED_CMD')
+ copy_args = '-a'
+ if d.getVar('ISAR_CHROOT_MODE') == 'unshare':
+ copy_args += ' --no-preserve=ownership'
+
postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
rootfsdir = d.getVar("ROOTFSDIR")
@@ -24,18 +29,18 @@ python rootfs_add_files() {
destination = d.getVarFlag(additional_file_entry, "destination") or ""
source = d.getVarFlag(additional_file_entry, "source") or ""
if os.path.exists(f"{rootfsdir}/{destination}"):
- bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
+ bb.process.run(f"{cmd} /usr/bin/rm -f {rootfsdir}/{destination}")
dest_dir = os.path.dirname(destination)
- bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
+ bb.process.run(f"{cmd} /usr/bin/mkdir -p {rootfsdir}/{dest_dir}")
# empty source creates only an empty destination file
if not source:
- bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
+ bb.process.run(f"{cmd} /usr/bin/touch {rootfsdir}/{destination}")
return
if not os.path.exists(f"{source}"):
bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
# no recursive copy only single files
- bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a", f"{source}", f"{rootfsdir}/{destination}" ])
+ bb.process.run(f"{cmd} /usr/bin/cp {copy_args} {source} {rootfsdir}/{destination}")
}
ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-2-clara.kowalsky%40siemens.com.
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2 3/4] testsuite: add installer build test for rootfs-add-files
2026-10-26 10:10 [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR 'Clara Kowalsky' via isar-users
2026-10-26 10:10 ` [PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds 'Clara Kowalsky' via isar-users
@ 2026-10-26 10:10 ` 'Clara Kowalsky' via isar-users
2026-10-26 10:10 ` [PATCH v2 4/4] testsuite: add rootfs-add-files unittest 'Clara Kowalsky' via isar-users
2026-10-28 16:44 ` [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR Zhihang Wei
3 siblings, 0 replies; 5+ messages in thread
From: 'Clara Kowalsky' via isar-users @ 2026-10-26 10:10 UTC (permalink / raw)
To: isar-users; +Cc: felix.moessbauer, Clara Kowalsky
Install a dpkg-raw test package with a file in /install while building
the installer image. This executes rootfs_add_files with its destination
directory already present.
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
.../test-rootfs-add-files/test-rootfs-add-files.bb | 9 +++++++++
testsuite/citest.py | 1 +
2 files changed, 10 insertions(+)
create mode 100644 meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb
diff --git a/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb b/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb
new file mode 100644
index 00000000..ee013e8f
--- /dev/null
+++ b/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb
@@ -0,0 +1,9 @@
+# Test package using dpkg-raw to install a file into /install.
+
+inherit dpkg-raw
+
+do_install[cleandirs] += "${D}/install"
+
+do_install() {
+ printf '%s\n' 'test payload' > "${D}/install/test-rootfs-add-files"
+}
diff --git a/testsuite/citest.py b/testsuite/citest.py
index 0cedcc2c..245a4305 100644
--- a/testsuite/citest.py
+++ b/testsuite/citest.py
@@ -301,6 +301,7 @@ class InstallerTest(CIBaseTest):
installer_device="/dev/sda",
lines=[
"BBMULTICONFIG:append = ' qemuamd64-bookworm'",
+ "IMAGE_INSTALL:append = ' test-rootfs-add-files'",
])
def test_installer_run(self):
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-3-clara.kowalsky%40siemens.com.
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2 4/4] testsuite: add rootfs-add-files unittest
2026-10-26 10:10 [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR 'Clara Kowalsky' via isar-users
2026-10-26 10:10 ` [PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds 'Clara Kowalsky' via isar-users
2026-10-26 10:10 ` [PATCH v2 3/4] testsuite: add installer build test for rootfs-add-files 'Clara Kowalsky' via isar-users
@ 2026-10-26 10:10 ` 'Clara Kowalsky' via isar-users
2026-10-28 16:44 ` [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR Zhihang Wei
3 siblings, 0 replies; 5+ messages in thread
From: 'Clara Kowalsky' via isar-users @ 2026-10-26 10:10 UTC (permalink / raw)
To: isar-users; +Cc: felix.moessbauer, Clara Kowalsky
Run rootfs_add_files and verify the removal command targets ROOTFSDIR
before the replacement is copied. Cover schroot and unshare commands,
including the unshare ownership.
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
testsuite/unittests/test_rootfs_add_files.py | 80 ++++++++++++++++++++
1 file changed, 80 insertions(+)
create mode 100644 testsuite/unittests/test_rootfs_add_files.py
diff --git a/testsuite/unittests/test_rootfs_add_files.py b/testsuite/unittests/test_rootfs_add_files.py
new file mode 100644
index 00000000..1ef7c4a8
--- /dev/null
+++ b/testsuite/unittests/test_rootfs_add_files.py
@@ -0,0 +1,80 @@
+# This software is a part of Isar.
+# Copyright (C) Siemens AG, 2026
+#
+# SPDX-License-Identifier: MIT
+
+from rootfs import TemporaryRootfs
+
+import os
+import sys
+import unittest
+from unittest.mock import patch
+from typing import Tuple
+
+sys.path.append(os.path.join(os.path.dirname(__file__), '../../bitbake/lib'))
+
+from bb import process
+from bb.build import exec_func
+from bb.data_smart import DataSmart
+from bb.data import init
+from bb.parse import handle
+
+file_name = 'meta/classes-recipe/rootfs-add-files.bbclass'
+
+
+class TestRootfsAddFiles(unittest.TestCase):
+ def assert_remove_targets_rootfs(self, run_mock, rootfs_file):
+ command = run_mock.call_args_list[0].args[0]
+ if isinstance(command, str):
+ command = command.split()
+ self.assertEqual(
+ command[-3:], ['/usr/bin/rm', '-f', rootfs_file],
+ 'Expected the existing destination to be removed from ROOTFSDIR.',
+ )
+
+ def setup(self, chroot_mode: str,
+ destination: str = 'install/payload'
+ ) -> Tuple[DataSmart, TemporaryRootfs]:
+ rootfs = TemporaryRootfs()
+ rootfs.create_file('/source', 'payload')
+ rootfs.create_file('/install/payload', 'old payload')
+
+ d = handle(
+ os.path.join(os.path.dirname(__file__), '../..', file_name),
+ init(),
+ )
+ d.setVar('T', f'{rootfs.path()}/temp')
+ d.setVar('ROOTFSDIR', rootfs.path())
+ d.setVar('ROOTFS_ADDITIONAL_FILES', 'payload')
+ d.setVar('RUN_PRIVILEGED_CMD', 'unshare --mount --user'
+ if chroot_mode == 'unshare' else 'sudo -E')
+ d.setVar('ISAR_CHROOT_MODE', chroot_mode)
+ d.setVarFlag('ROOTFS_ADDITIONAL_FILE_payload', 'source',
+ f'{rootfs.path()}/source')
+ d.setVarFlag('ROOTFS_ADDITIONAL_FILE_payload', 'destination',
+ destination)
+ return (d, rootfs)
+
+ def test_replace_existing_file(self):
+ for destination in ('install/payload', '/install/payload'):
+ with self.subTest(destination=destination):
+ d, rootfs = self.setup('schroot', destination)
+ rootfs_file = f'{rootfs.path()}/{destination}'
+
+ with patch.object(process, 'run') as run_mock:
+ exec_func('rootfs_add_files', d)
+
+ self.assert_remove_targets_rootfs(run_mock, rootfs_file)
+
+ def test_replace_existing_file_unshare(self):
+ d, rootfs = self.setup('unshare')
+ rootfs_file = f'{rootfs.path()}/install/payload'
+
+ with patch.object(process, 'run') as run_mock:
+ exec_func('rootfs_add_files', d)
+
+ self.assert_remove_targets_rootfs(run_mock, rootfs_file)
+
+
+if __name__ == '__main__':
+ unittest.main()
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-4-clara.kowalsky%40siemens.com.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR
2026-10-26 10:10 [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR 'Clara Kowalsky' via isar-users
` (2 preceding siblings ...)
2026-10-26 10:10 ` [PATCH v2 4/4] testsuite: add rootfs-add-files unittest 'Clara Kowalsky' via isar-users
@ 2026-10-28 16:44 ` Zhihang Wei
3 siblings, 0 replies; 5+ messages in thread
From: Zhihang Wei @ 2026-10-28 16:44 UTC (permalink / raw)
To: Clara Kowalsky, isar-users; +Cc: felix.moessbauer
Applied to next, thanks.
Zhihang
On 10/26/26 11:10, 'Clara Kowalsky' via isar-users wrote:
> The existence check uses ROOTFSDIR plus destination, but the removal
> command uses destination alone. Since the task runs outside the
> image chroot, it targets a build-host path instead.
>
> Fixes: d2eb951a931c ("add new class to add files directly to the rootfs")
> Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> ---
> meta/classes-recipe/rootfs-add-files.bbclass | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
> index 38f739ee..d33752f3 100644
> --- a/meta/classes-recipe/rootfs-add-files.bbclass
> +++ b/meta/classes-recipe/rootfs-add-files.bbclass
> @@ -24,7 +24,7 @@ python rootfs_add_files() {
> destination = d.getVarFlag(additional_file_entry, "destination") or ""
> source = d.getVarFlag(additional_file_entry, "source") or ""
> if os.path.exists(f"{rootfsdir}/{destination}"):
> - bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
> + bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
>
> dest_dir = os.path.dirname(destination)
> bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7aecd2fd-3c00-41f6-b77e-b72af75e94d7%40ilbers.de.
^ permalink raw reply [flat|nested] 5+ messages in thread