[PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR

[PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR

['Clara Kowalsky' via isar-users]

The existence check uses ROOTFSDIR plus destination, but the removal
command uses destination alone. Since the task runs outside the
image chroot, it targets a build-host path instead.

Fixes: d2eb951a931c ("add new class to add files directly to the rootfs")
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 meta/classes-recipe/rootfs-add-files.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index 38f739ee..d33752f3 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -24,7 +24,7 @@ python rootfs_add_files() {
         destination = d.getVarFlag(additional_file_entry, "destination") or ""
         source = d.getVarFlag(additional_file_entry, "source") or ""
         if os.path.exists(f"{rootfsdir}/{destination}"):
-            bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
+            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
 
         dest_dir = os.path.dirname(destination)
         bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-1-clara.kowalsky%40siemens.com.

[PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds

['Clara Kowalsky' via isar-users]

rootfs_add_files uses host sudo to create directories and files.
In unshare mode, package installation runs as root in a user namespace,
where host-root ownership may not map to namespace root. Dpkg can then
fail to replace a rootfs file with:

Unable to create `<path>.dpkg-new`: Permission denied.

Use RUN_PRIVILEGED_CMD for rootfs operations and disable ownership
preservation when copying files in unshare mode.

Fixes: 4fedb1ae6f90 ("add support for fully rootless builds")
Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 meta/classes-recipe/rootfs-add-files.bbclass | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
index d33752f3..b093a3ce 100644
--- a/meta/classes-recipe/rootfs-add-files.bbclass
+++ b/meta/classes-recipe/rootfs-add-files.bbclass
@@ -16,6 +16,11 @@ ROOTFS_ADDITIONAL_FILES ??= ""
 
 
 python rootfs_add_files() {
+    cmd = d.getVar('RUN_PRIVILEGED_CMD')
+    copy_args = '-a'
+    if d.getVar('ISAR_CHROOT_MODE') == 'unshare':
+        copy_args += ' --no-preserve=ownership'
+
     postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split()
     rootfsdir = d.getVar("ROOTFSDIR")
 
@@ -24,18 +29,18 @@ python rootfs_add_files() {
         destination = d.getVarFlag(additional_file_entry, "destination") or ""
         source = d.getVarFlag(additional_file_entry, "source") or ""
         if os.path.exists(f"{rootfsdir}/{destination}"):
-            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
+            bb.process.run(f"{cmd} /usr/bin/rm -f {rootfsdir}/{destination}")
 
         dest_dir = os.path.dirname(destination)
-        bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
+        bb.process.run(f"{cmd} /usr/bin/mkdir -p {rootfsdir}/{dest_dir}")
         # empty source creates only an empty destination file
         if not source:
-            bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ])
+            bb.process.run(f"{cmd} /usr/bin/touch {rootfsdir}/{destination}")
             return
 
         if not os.path.exists(f"{source}"):
             bb.error(f"{source} does not exists and cannot be copied to the rootfs!")
         # no recursive copy only single files
-        bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a",  f"{source}", f"{rootfsdir}/{destination}" ])
+        bb.process.run(f"{cmd} /usr/bin/cp {copy_args} {source} {rootfsdir}/{destination}")
 }
 ROOTFS_INSTALL_COMMAND += "rootfs_add_files"
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-2-clara.kowalsky%40siemens.com.

[PATCH v2 3/4] testsuite: add installer build test for rootfs-add-files

['Clara Kowalsky' via isar-users]

Install a dpkg-raw test package with a file in /install while building
the installer image. This executes rootfs_add_files with its destination
directory already present.

Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 .../test-rootfs-add-files/test-rootfs-add-files.bb       | 9 +++++++++
 testsuite/citest.py                                      | 1 +
 2 files changed, 10 insertions(+)
 create mode 100644 meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb

diff --git a/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb b/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb
new file mode 100644
index 00000000..ee013e8f
--- /dev/null
+++ b/meta-test/recipes-app/test-rootfs-add-files/test-rootfs-add-files.bb
@@ -0,0 +1,9 @@
+# Test package using dpkg-raw to install a file into /install.
+
+inherit dpkg-raw
+
+do_install[cleandirs] += "${D}/install"
+
+do_install() {
+    printf '%s\n' 'test payload' > "${D}/install/test-rootfs-add-files"
+}
diff --git a/testsuite/citest.py b/testsuite/citest.py
index 0cedcc2c..245a4305 100644
--- a/testsuite/citest.py
+++ b/testsuite/citest.py
@@ -301,6 +301,7 @@ class InstallerTest(CIBaseTest):
                                 installer_device="/dev/sda",
                                 lines=[
                                     "BBMULTICONFIG:append = ' qemuamd64-bookworm'",
+                                    "IMAGE_INSTALL:append = ' test-rootfs-add-files'",
                                 ])
 
     def test_installer_run(self):
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-3-clara.kowalsky%40siemens.com.

[PATCH v2 4/4] testsuite: add rootfs-add-files unittest

['Clara Kowalsky' via isar-users]

Run rootfs_add_files and verify the removal command targets ROOTFSDIR
before the replacement is copied. Cover schroot and unshare commands,
including the unshare ownership.

Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
---
 testsuite/unittests/test_rootfs_add_files.py | 80 ++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 testsuite/unittests/test_rootfs_add_files.py

diff --git a/testsuite/unittests/test_rootfs_add_files.py b/testsuite/unittests/test_rootfs_add_files.py
new file mode 100644
index 00000000..1ef7c4a8
--- /dev/null
+++ b/testsuite/unittests/test_rootfs_add_files.py
@@ -0,0 +1,80 @@
+# This software is a part of Isar.
+# Copyright (C) Siemens AG, 2026
+#
+# SPDX-License-Identifier: MIT
+
+from rootfs import TemporaryRootfs
+
+import os
+import sys
+import unittest
+from unittest.mock import patch
+from typing import Tuple
+
+sys.path.append(os.path.join(os.path.dirname(__file__), '../../bitbake/lib'))
+
+from bb import process
+from bb.build import exec_func
+from bb.data_smart import DataSmart
+from bb.data import init
+from bb.parse import handle
+
+file_name = 'meta/classes-recipe/rootfs-add-files.bbclass'
+
+
+class TestRootfsAddFiles(unittest.TestCase):
+    def assert_remove_targets_rootfs(self, run_mock, rootfs_file):
+        command = run_mock.call_args_list[0].args[0]
+        if isinstance(command, str):
+            command = command.split()
+        self.assertEqual(
+            command[-3:], ['/usr/bin/rm', '-f', rootfs_file],
+            'Expected the existing destination to be removed from ROOTFSDIR.',
+        )
+
+    def setup(self, chroot_mode: str,
+              destination: str = 'install/payload'
+              ) -> Tuple[DataSmart, TemporaryRootfs]:
+        rootfs = TemporaryRootfs()
+        rootfs.create_file('/source', 'payload')
+        rootfs.create_file('/install/payload', 'old payload')
+
+        d = handle(
+            os.path.join(os.path.dirname(__file__), '../..', file_name),
+            init(),
+        )
+        d.setVar('T', f'{rootfs.path()}/temp')
+        d.setVar('ROOTFSDIR', rootfs.path())
+        d.setVar('ROOTFS_ADDITIONAL_FILES', 'payload')
+        d.setVar('RUN_PRIVILEGED_CMD', 'unshare --mount --user'
+                 if chroot_mode == 'unshare' else 'sudo -E')
+        d.setVar('ISAR_CHROOT_MODE', chroot_mode)
+        d.setVarFlag('ROOTFS_ADDITIONAL_FILE_payload', 'source',
+                     f'{rootfs.path()}/source')
+        d.setVarFlag('ROOTFS_ADDITIONAL_FILE_payload', 'destination',
+                     destination)
+        return (d, rootfs)
+
+    def test_replace_existing_file(self):
+        for destination in ('install/payload', '/install/payload'):
+            with self.subTest(destination=destination):
+                d, rootfs = self.setup('schroot', destination)
+                rootfs_file = f'{rootfs.path()}/{destination}'
+
+                with patch.object(process, 'run') as run_mock:
+                    exec_func('rootfs_add_files', d)
+
+                self.assert_remove_targets_rootfs(run_mock, rootfs_file)
+
+    def test_replace_existing_file_unshare(self):
+        d, rootfs = self.setup('unshare')
+        rootfs_file = f'{rootfs.path()}/install/payload'
+
+        with patch.object(process, 'run') as run_mock:
+            exec_func('rootfs_add_files', d)
+
+        self.assert_remove_targets_rootfs(run_mock, rootfs_file)
+
+
+if __name__ == '__main__':
+    unittest.main()
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-4-clara.kowalsky%40siemens.com.

Re: [PATCH v2 1/4] rootfs-add-files: correctly remove files in ROOTFSDIR

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 10/26/26 11:10, 'Clara Kowalsky' via isar-users wrote:
> The existence check uses ROOTFSDIR plus destination, but the removal
> command uses destination alone. Since the task runs outside the
> image chroot, it targets a build-host path instead.
>
> Fixes: d2eb951a931c ("add new class to add files directly to the rootfs")
> Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> ---
>   meta/classes-recipe/rootfs-add-files.bbclass | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
> index 38f739ee..d33752f3 100644
> --- a/meta/classes-recipe/rootfs-add-files.bbclass
> +++ b/meta/classes-recipe/rootfs-add-files.bbclass
> @@ -24,7 +24,7 @@ python rootfs_add_files() {
>           destination = d.getVarFlag(additional_file_entry, "destination") or ""
>           source = d.getVarFlag(additional_file_entry, "source") or ""
>           if os.path.exists(f"{rootfsdir}/{destination}"):
> -            bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
> +            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
>   
>           dest_dir = os.path.dirname(destination)
>           bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7aecd2fd-3c00-41f6-b77e-b72af75e94d7%40ilbers.de.