[PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds

["'Clara Kowalsky' via isar-users" <isar-users@googlegroups.com>]

rootfs_add_files uses host sudo to create directories and files.
In unshare mode, package installation runs as root in a user namespace,
where host-root ownership may not map to namespace root. Dpkg can then
fail to replace a rootfs file with:

Unable to create `<path>.dpkg-new`: Permission denied.

Use RUN_PRIVILEGED_CMD for rootfs operations and disable ownership
preservation when copying files in unshare mode.

Fixes: 4fedb1ae6f90 ("add support for fully rootless builds")
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 meta/classes-recipe/rootfs-add-files.bbclass | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index d33752f3..b093a3ce 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -16,6 +16,11 @@ ROOTFS_ADDITIONAL_FILES ??= ""
 
 
 python rootfs_add_files() {
+    cmd = d.getVar('RUN_PRIVILEGED_CMD')
+    copy_args = '-a'
+    if d.getVar('ISAR_CHROOT_MODE') == 'unshare':
+        copy_args += ' --no-preserve=ownership'
+
     postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
     rootfsdir = d.getVar("ROOTFSDIR")
 
@@ -24,18 +29,18 @@ python rootfs_add_files() {
         destination = d.getVarFlag(additional_file_entry, "destination") or ""
         source = d.getVarFlag(additional_file_entry, "source") or ""
         if os.path.exists(f"{rootfsdir}/{destination}"):
-            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
+            bb.process.run(f"{cmd} /usr/bin/rm -f {rootfsdir}/{destination}")
 
         dest_dir = os.path.dirname(destination)
-        bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
+        bb.process.run(f"{cmd} /usr/bin/mkdir -p {rootfsdir}/{dest_dir}")
         # empty source creates only an empty destination file
         if not source:
-            bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
+            bb.process.run(f"{cmd} /usr/bin/touch {rootfsdir}/{destination}")
             return
 
         if not os.path.exists(f"{source}"):
             bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
         # no recursive copy only single files
-        bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
+        bb.process.run(f"{cmd} /usr/bin/cp {copy_args} {source} {rootfsdir}/{destination}")
 }
 ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-2-clara.kowalsky%40siemens.com.