From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 26 Oct 2026 11:10:44 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-pl1-f186.google.com (mail-pl1-f186.google.com [209.85.214.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69QAAegX009548 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 26 Oct 2026 11:10:41 +0100 Received: by mail-pl1-f186.google.com with SMTP id d9443c01a7336-2eaae8d29e0sf12092375ad.2 for ; Mon, 26 Oct 2026 03:10:41 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793009434; cv=pass; d=google.com; s=arc-20260327; b=HdjKbe0JNi416vbWmMpLAN564dnHWSAd3Vg8DCu/scpti7xBSOSOoeOl4HCZBeCnxr 1ISn3Y3LacqCT2RD92oyJK3RUK3chAjGsoqPMmZPcjCxHyDoLDlc4QxE2c0+hHlrhZik ZSv3/aWZROWKx2t8HKZRAQNSRPBeIFtECXK30dg0cL17Cpg2iGsYcaJO765EpQwBGv9m oIGNSyu4kUP79haauJ687E92GcigUH36U1TbLfxV/bf2aexmlKoNXT8lC9v3GUdSCB8t Fwb1afjimXDE/s4qYkC+Gkt0A02zysMjl86DXzvYhXZFrihLHGJ3yxFDChVm1YmGFPDy 9mdw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=xNA00ET7jEldcdTmYOuMU4lMwQwQcFXY5/YBm9aHhLQ=; fh=EMx5nZgHXdROfOElep0VO2e0KTcmliu92mXF+GdzDpM=; b=hxNJKPyuyf4DAvm5IsySxh7GS5ceV1hWJesZbJRGkLd2PDY6oKRjsvTlR6+NfmfP0d 3Mrw+cGv3RvPzcmu1M564Frp5mBL8Ic5A9HrdKcC6h0940evRAVSw56DmVg1xj8jiLCt Fvf9iErTxvnFQjOGqsv6A6+sOentPCcLS/R1mbQEwj5QYLRFRhM8PvYGifPMBo0ZLRfy c3tUmjuJkkEHPjpnQLCzxZQZcR6ihO8sHcs73HK1UWAAJE6qm1R1R3rDQM6mPVpp3SPN spHAqjpEnr6+eyFJ3WKK6ZVcx68NrAj5IcVl+kv73Ff20v1BAAWvrWObHgUwDi2E6guV 0pFA==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=HXAHBTmO; spf=pass (google.com: domain of fm-1047747-20261026101026c2074daf4b0002072f-bbr3ke@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1047747-20261026101026c2074daf4b0002072f-BbR3ke@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1793009434; x=1793614234; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xNA00ET7jEldcdTmYOuMU4lMwQwQcFXY5/YBm9aHhLQ=; b=K9eJKypVqFaSR19INa25ab4GN7ADQsQNHNFukTSVVU+LmVbP7o+zGgHbv6W7Iwiqqg KsAMfcY6z1i83JDL0/15Pwcg3hc8OBSHZikFw0L4TZdIReTwp1S1fmKYFRM4EylfbspY SifaFU2mrdE7nWUesCAzq+aJ3LUkSB7Ggi3FBHMuVYieupOPteDF56Y1XpNaOruZ3g3k fCzKQMsSD4Pk4hw68N1AeCPK2pvoXezIz5QiH6lc3+UVjD3/qVRIvqgteZuhEyjiz3nz EwvjtWcvyldTpxxLs7CbbLO4EGKQp2+YFqU3S9i+Zg8zmqc04jqrd1gFxEq2n3Ll4RRN w1UA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793009434; x=1793614234; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=xNA00ET7jEldcdTmYOuMU4lMwQwQcFXY5/YBm9aHhLQ=; b=VoFjAPz+rglwqX3xsAHsGz+PhggnT/NitxRFz8aglMMlGA+UGX8ieKqa1X4l3fA/Yo cyyLvTDcXIQVutl+BFDYIqBd2A2ccS+bGxsgiyhEhyIRLWHoR6nyjGZo5S8sgk8nhtKJ eE6/r0OigWE6Iekt/9UMoRPkpvgMluM5MC/5ibGQanhqQ6r0nkMs5GqqOdAD+p7ySaLH 7kXmwaHoXg6FSSI2D6RC9A7d+c5uAxY3LK0/7QZZWmEaO7gzQD/hfIkjbRP9zc+3CZ+V SY0tOO3R78fTmpZq/4bFXolbsxtbPHkIL3J/9zZE7cTWrW9Jsk2wxw7PxEgQIMlmyyy7 Gdpg== X-Forwarded-Encrypted: i=2; AKwUvBwx8oZ2LPgraBgpXPVA5CBEY1KmGvaOblooCdNqNxu41UvBWhgMrpBttS+rDUrI5S5/BGP9@ilbers.de X-Gm-Message-State: AFq9FYLQxzXkd+KmynbCBoPcTwoLyHk6UKIpz9dRtpArF5+deJaYdjdN 0JK4Olls8rcQ3HT9vwu2Zj+CAXRRPCUnOrjiZm+98kYPH6W6PW3ceXPF X-Received: by 2002:a17:902:f60a:b0:2e9:5eee:e085 with SMTP id d9443c01a7336-2ea9c6c82c3mr45723295ad.19.1793009434586; Mon, 26 Oct 2026 03:10:34 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLddOyxcDEfX+TpfWNPSBfxW5DMyDTo0Y1qEqceGdhzqMsQ==" Received: by 2002:a17:902:fda3:b0:2e2:dd19:ebd with SMTP id d9443c01a7336-2ea7b926030ls37654125ad.0.-pod-prod-02-us; Mon, 26 Oct 2026 03:10:33 -0700 (PDT) X-Received: by 2002:a17:903:37d0:b0:2e8:4f03:8a4 with SMTP id d9443c01a7336-2ea9c957addmr48214955ad.67.1793009433421; Mon, 26 Oct 2026 03:10:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793009433; cv=none; d=google.com; s=arc-20260327; b=j9h8r6bXvJMhjizeSC9M0e3I75rAN2mM1un19XibiMGDowMGsFKTm2IxR5bfEeEPrX 0XFVAYlaVhRs+r9NzCOrFJ8TOMmW3myE+CT6c4ZgLptiWriAuVfa/TqhCugnjUY4B1C3 nscmCzOHupjYcM+318JnvSW18AlQMUzfMawwA63P6vrBKXSJJXHmtymlHLOB3Wj4ckTK f1ZXSOXn3cBnJaUpWbSQJUF9iuZy9jeJGDkh+p3xAXn1KOceWbhVpMiugWyupi/6n8JA V9ZxLKhm37J4zmShU66lplVIftPOjAlN6IxewBw5jcJxBBzqFs9f29HgYAEYgSJKpxCM rKaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=FiyyUyWX1L1lz2QWdX0g+AeWgl8/4uj9q0WAc42vP/w=; fh=SLhQ9z95daToN/NWg2kUHafQqIBVSlBxJ9bhUZMImFA=; b=FKxA9JPBKs1HpIE63VKBHl9kYKaa3nq2St4mX6dUQh7t8jxetodBg2TXu014lC58Iw Vvh4/1olpt7Ke5rxas6ofFHSHXf2hGktoKAbW4cZapu7MkomkJpiFEmThT8a7pktW60q 2WpjWtLDR/uXxNhMu5ZifOyC2TY2QglENKYy3CUURDUpSBCPPIIdbqeIeYPG+68TbBKp XSIr80uoOzj38x8Wy29L4NWTBDL66xtFBEy+2s3uVOa6/juDSMSDv+A0g6pY4StxSMkV yNqNIg4n5ujuyZOYWKjrnkEN6wUtyj+GnhDyqzSaO56jGdfpltimbX+7Y472pZb3+NL/ QDrQ==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=HXAHBTmO; spf=pass (google.com: domain of fm-1047747-20261026101026c2074daf4b0002072f-bbr3ke@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1047747-20261026101026c2074daf4b0002072f-BbR3ke@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net. [185.136.65.225]) by gmr-mx.google.com with ESMTPS id d9443c01a7336-2ea9b19ea9asi1612395ad.8.2026.10.26.03.10.33 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Oct 2026 03:10:33 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1047747-20261026101026c2074daf4b0002072f-bbr3ke@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) client-ip=185.136.65.225; Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 20261026101026c2074daf4b0002072f for ; Mon, 26 Oct 2026 11:10:26 +0100 From: "'Clara Kowalsky' via isar-users" To: isar-users@googlegroups.com Cc: felix.moessbauer@siemens.com, Clara Kowalsky Subject: [PATCH v2 2/4] rootfs-add-files: use privileged execution helper for rootless builds Date: Mon, 26 Oct 2026 11:10:16 +0100 Message-ID: <20261026101018.276241-2-clara.kowalsky@siemens.com> In-Reply-To: <20261026101018.276241-1-clara.kowalsky@siemens.com> References: <20261026101018.276241-1-clara.kowalsky@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1047747:519-21489:flowmailer X-Original-Sender: clara.kowalsky@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=HXAHBTmO; spf=pass (google.com: domain of fm-1047747-20261026101026c2074daf4b0002072f-bbr3ke@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1047747-20261026101026c2074daf4b0002072f-BbR3ke@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Clara Kowalsky Reply-To: Clara Kowalsky Content-Type: text/plain; charset="UTF-8" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: kxVWXLie1KQ2 rootfs_add_files uses host sudo to create directories and files. In unshare mode, package installation runs as root in a user namespace, where host-root ownership may not map to namespace root. Dpkg can then fail to replace a rootfs file with: Unable to create `.dpkg-new`: Permission denied. Use RUN_PRIVILEGED_CMD for rootfs operations and disable ownership preservation when copying files in unshare mode. Fixes: 4fedb1ae6f90 ("add support for fully rootless builds") Signed-off-by: Clara Kowalsky --- meta/classes-recipe/rootfs-add-files.bbclass | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass index d33752f3..b093a3ce 100644 --- a/meta/classes-recipe/rootfs-add-files.bbclass +++ b/meta/classes-recipe/rootfs-add-files.bbclass @@ -16,6 +16,11 @@ ROOTFS_ADDITIONAL_FILES ??= "" python rootfs_add_files() { + cmd = d.getVar('RUN_PRIVILEGED_CMD') + copy_args = '-a' + if d.getVar('ISAR_CHROOT_MODE') == 'unshare': + copy_args += ' --no-preserve=ownership' + postprocess_additional_files = d.getVar('ROOTFS_ADDITIONAL_FILES').split() rootfsdir = d.getVar("ROOTFSDIR") @@ -24,18 +29,18 @@ python rootfs_add_files() { destination = d.getVarFlag(additional_file_entry, "destination") or "" source = d.getVarFlag(additional_file_entry, "source") or "" if os.path.exists(f"{rootfsdir}/{destination}"): - bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"]) + bb.process.run(f"{cmd} /usr/bin/rm -f {rootfsdir}/{destination}") dest_dir = os.path.dirname(destination) - bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ]) + bb.process.run(f"{cmd} /usr/bin/mkdir -p {rootfsdir}/{dest_dir}") # empty source creates only an empty destination file if not source: - bb.process.run(["sudo", "-E", "/usr/bin/touch", f"{rootfsdir}/{destination}" ]) + bb.process.run(f"{cmd} /usr/bin/touch {rootfsdir}/{destination}") return if not os.path.exists(f"{source}"): bb.error(f"{source} does not exists and cannot be copied to the rootfs!") # no recursive copy only single files - bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a", f"{source}", f"{rootfsdir}/{destination}" ]) + bb.process.run(f"{cmd} /usr/bin/cp {copy_args} {source} {rootfsdir}/{destination}") } ROOTFS_INSTALL_COMMAND += "rootfs_add_files" -- 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261026101018.276241-2-clara.kowalsky%40siemens.com.