[PATCH v2 1/1] fix: rebuild rootfs on change of USERS

[PATCH v2 1/1] fix: rebuild rootfs on change of USERS

['Felix Moessbauer' via isar-users]

In case a change to the Isar created users is done, this currently
only re-triggers the do_rootfs_postprocess task. This task changes the
rootfs (e.g. home dirs are moved) and by that needs to operate on a
clean one. Otherwise old homedirs might still remain in the final rootfs
or move operations are not possible.

We fix this by ensuring that the do_rootfs_install task is executed
whenever a change to USERS is done. By that, we enter the
do_rootfs_postinstall with a clean rootfs.

Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
Changes since v1:

- Also add dependency to USER_<x> for all x in USERS

 meta/classes/image-account-extension.bbclass | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
index ea956cd5..3c461b1a 100644
--- a/meta/classes/image-account-extension.bbclass
+++ b/meta/classes/image-account-extension.bbclass
@@ -8,6 +8,10 @@
 USERS ??= ""
 GROUPS ??= ""
 
+# rebuild rootfs on change of USERS as homes might be moved / created
+# no need to depend on GROUPS as they don't create directories
+# groups need to be created before users, hence do not move the user creation into
+# the do_rootfs_install task but only add a dependency
 python() {
     for entry in (d.getVar("GROUPS") or "").split():
         group_entry = "GROUP_{}".format(entry)
@@ -16,7 +20,9 @@ python() {
     for entry in (d.getVar("USERS") or "").split():
         user_entry = "USER_{}".format(entry)
         d.appendVarFlag("image_postprocess_accounts", "vardeps", " {}".format(user_entry))
+        d.appendVarFlag("do_rootfs_install", "vardeps", " {}".format(user_entry))
 }
+do_rootfs_install[vardeps] += "USERS"
 
 def image_create_groups(d: "DataSmart") -> None:
     """Creates the groups defined in the ``GROUPS`` bitbake variable.
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250411112618.3992560-1-felix.moessbauer%40siemens.com.

Re: [PATCH v2 1/1] fix: rebuild rootfs on change of USERS

['Clara Kowalsky' via isar-users]

On 11.04.25 13:26, Felix Moessbauer wrote:
> In case a change to the Isar created users is done, this currently
> only re-triggers the do_rootfs_postprocess task. This task changes the
> rootfs (e.g. home dirs are moved) and by that needs to operate on a
> clean one. Otherwise old homedirs might still remain in the final rootfs
> or move operations are not possible.
> 
> We fix this by ensuring that the do_rootfs_install task is executed
> whenever a change to USERS is done. By that, we enter the
> do_rootfs_postinstall with a clean rootfs.
> 
> Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> Changes since v1:
> 
> - Also add dependency to USER_<x> for all x in USERS
> 
>   meta/classes/image-account-extension.bbclass | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
> index ea956cd5..3c461b1a 100644
> --- a/meta/classes/image-account-extension.bbclass
> +++ b/meta/classes/image-account-extension.bbclass
> @@ -8,6 +8,10 @@
>   USERS ??= ""
>   GROUPS ??= ""
>   
> +# rebuild rootfs on change of USERS as homes might be moved / created
> +# no need to depend on GROUPS as they don't create directories
> +# groups need to be created before users, hence do not move the user creation into
> +# the do_rootfs_install task but only add a dependency
>   python() {
>       for entry in (d.getVar("GROUPS") or "").split():
>           group_entry = "GROUP_{}".format(entry)
> @@ -16,7 +20,9 @@ python() {
>       for entry in (d.getVar("USERS") or "").split():
>           user_entry = "USER_{}".format(entry)
>           d.appendVarFlag("image_postprocess_accounts", "vardeps", " {}".format(user_entry))
> +        d.appendVarFlag("do_rootfs_install", "vardeps", " {}".format(user_entry))
>   }
> +do_rootfs_install[vardeps] += "USERS"
>   
>   def image_create_groups(d: "DataSmart") -> None:
>       """Creates the groups defined in the ``GROUPS`` bitbake variable.

This works, at least for the case of adding / moving the home directory 
of an existing user. Only removing an existing home dir when removing 
all home flags of a user is not covered, but we can ignore this for now.
BR,
Clara

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/45679a80-dea9-4bc6-91ef-628e3848e403%40siemens.com.

Re: [PATCH v2 1/1] fix: rebuild rootfs on change of USERS

['MOESSBAUER, Felix' via isar-users]

On Fri, 2025-04-11 at 17:56 +0200, Clara Kowalsky wrote:
> 
> 
> On 11.04.25 13:26, Felix Moessbauer wrote:
> > In case a change to the Isar created users is done, this currently
> > only re-triggers the do_rootfs_postprocess task. This task changes
> > the
> > rootfs (e.g. home dirs are moved) and by that needs to operate on a
> > clean one. Otherwise old homedirs might still remain in the final
> > rootfs
> > or move operations are not possible.
> > 
> > We fix this by ensuring that the do_rootfs_install task is executed
> > whenever a change to USERS is done. By that, we enter the
> > do_rootfs_postinstall with a clean rootfs.
> > 
> > Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > ---
> > Changes since v1:
> > 
> > - Also add dependency to USER_<x> for all x in USERS
> > 
> >   meta/classes/image-account-extension.bbclass | 6 ++++++
> >   1 file changed, 6 insertions(+)
> > 
> > diff --git a/meta/classes/image-account-extension.bbclass
> > b/meta/classes/image-account-extension.bbclass
> > index ea956cd5..3c461b1a 100644
> > --- a/meta/classes/image-account-extension.bbclass
> > +++ b/meta/classes/image-account-extension.bbclass
> > @@ -8,6 +8,10 @@
> >   USERS ??= ""
> >   GROUPS ??= ""
> >   
> > +# rebuild rootfs on change of USERS as homes might be moved /
> > created
> > +# no need to depend on GROUPS as they don't create directories
> > +# groups need to be created before users, hence do not move the
> > user creation into
> > +# the do_rootfs_install task but only add a dependency
> >   python() {
> >       for entry in (d.getVar("GROUPS") or "").split():
> >           group_entry = "GROUP_{}".format(entry)
> > @@ -16,7 +20,9 @@ python() {
> >       for entry in (d.getVar("USERS") or "").split():
> >           user_entry = "USER_{}".format(entry)
> >           d.appendVarFlag("image_postprocess_accounts", "vardeps",
> > " {}".format(user_entry))
> > +        d.appendVarFlag("do_rootfs_install", "vardeps", "
> > {}".format(user_entry))
> >   }
> > +do_rootfs_install[vardeps] += "USERS"
> >   
> >   def image_create_groups(d: "DataSmart") -> None:
> >       """Creates the groups defined in the ``GROUPS`` bitbake
> > variable.
> 
> This works, at least for the case of adding / moving the home
> directory 
> of an existing user. Only removing an existing home dir when removing
> all home flags of a user is not covered, but we can ignore this for
> now.

Hi, this can only happen if a user is created by a package and then
transformed using ISAR, right?. IMHO this is simply not in scope, as we
have no way to express "remove-this-homedir".

Anyways, IMHO this patch is good to be merged.

Best regards,
Felix

> BR,
> Clara

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/e77a66df5232c6c445c256256d024a21762f9e04.camel%40siemens.com.

Re: [PATCH v2 1/1] fix: rebuild rootfs on change of USERS

['Clara Kowalsky' via isar-users]

On 29.04.25 10:31, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
> On Fri, 2025-04-11 at 17:56 +0200, Clara Kowalsky wrote:
>>
>>
>> On 11.04.25 13:26, Felix Moessbauer wrote:
>>> In case a change to the Isar created users is done, this currently
>>> only re-triggers the do_rootfs_postprocess task. This task changes
>>> the
>>> rootfs (e.g. home dirs are moved) and by that needs to operate on a
>>> clean one. Otherwise old homedirs might still remain in the final
>>> rootfs
>>> or move operations are not possible.
>>>
>>> We fix this by ensuring that the do_rootfs_install task is executed
>>> whenever a change to USERS is done. By that, we enter the
>>> do_rootfs_postinstall with a clean rootfs.
>>>
>>> Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
>>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>>> ---
>>> Changes since v1:
>>>
>>> - Also add dependency to USER_<x> for all x in USERS
>>>
>>>    meta/classes/image-account-extension.bbclass | 6 ++++++
>>>    1 file changed, 6 insertions(+)
>>>
>>> diff --git a/meta/classes/image-account-extension.bbclass
>>> b/meta/classes/image-account-extension.bbclass
>>> index ea956cd5..3c461b1a 100644
>>> --- a/meta/classes/image-account-extension.bbclass
>>> +++ b/meta/classes/image-account-extension.bbclass
>>> @@ -8,6 +8,10 @@
>>>    USERS ??= ""
>>>    GROUPS ??= ""
>>>    
>>> +# rebuild rootfs on change of USERS as homes might be moved /
>>> created
>>> +# no need to depend on GROUPS as they don't create directories
>>> +# groups need to be created before users, hence do not move the
>>> user creation into
>>> +# the do_rootfs_install task but only add a dependency
>>>    python() {
>>>        for entry in (d.getVar("GROUPS") or "").split():
>>>            group_entry = "GROUP_{}".format(entry)
>>> @@ -16,7 +20,9 @@ python() {
>>>        for entry in (d.getVar("USERS") or "").split():
>>>            user_entry = "USER_{}".format(entry)
>>>            d.appendVarFlag("image_postprocess_accounts", "vardeps",
>>> " {}".format(user_entry))
>>> +        d.appendVarFlag("do_rootfs_install", "vardeps", "
>>> {}".format(user_entry))
>>>    }
>>> +do_rootfs_install[vardeps] += "USERS"
>>>    
>>>    def image_create_groups(d: "DataSmart") -> None:
>>>        """Creates the groups defined in the ``GROUPS`` bitbake
>>> variable.
>>
>> This works, at least for the case of adding / moving the home
>> directory
>> of an existing user. Only removing an existing home dir when removing
>> all home flags of a user is not covered, but we can ignore this for
>> now.
> 
> Hi, this can only happen if a user is created by a package and then
> transformed using ISAR, right?. IMHO this is simply not in scope, as we
> have no way to express "remove-this-homedir".
> 
> Anyways, IMHO this patch is good to be merged.

Yes, removing a home dir is out of scope. The patch can be merged.
BR,
Clara

> 
> Best regards,
> Felix
> 
>> BR,
>> Clara
> 

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/8dc1fe9b-951d-4440-a7e7-267716c1784e%40siemens.com.

Re: [PATCH v2 1/1] fix: rebuild rootfs on change of USERS

[Baurzhan Ismagulov]

On 2025-04-11 13:26, 'Felix Moessbauer' via isar-users wrote:
> In case a change to the Isar created users is done, this currently
> only re-triggers the do_rootfs_postprocess task. This task changes the
> rootfs (e.g. home dirs are moved) and by that needs to operate on a
> clean one. Otherwise old homedirs might still remain in the final rootfs
> or move operations are not possible.
> 
> We fix this by ensuring that the do_rootfs_install task is executed
> whenever a change to USERS is done. By that, we enter the
> do_rootfs_postinstall with a clean rootfs.
> 
> Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>

Applied to next, thanks.

With kind regards,
Baurzhan

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/aBtbLdcdfflSjHcI%40abai.de.

Re: [PATCH v2 1/1] fix: rebuild rootfs on change of USERS

['Jan Kiszka' via isar-users]

On 11.04.25 13:26, 'Felix Moessbauer' via isar-users wrote:
> In case a change to the Isar created users is done, this currently
> only re-triggers the do_rootfs_postprocess task. This task changes the
> rootfs (e.g. home dirs are moved) and by that needs to operate on a
> clean one. Otherwise old homedirs might still remain in the final rootfs
> or move operations are not possible.
> 
> We fix this by ensuring that the do_rootfs_install task is executed
> whenever a change to USERS is done. By that, we enter the
> do_rootfs_postinstall with a clean rootfs.
> 
> Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> Changes since v1:
> 
> - Also add dependency to USER_<x> for all x in USERS
> 
>  meta/classes/image-account-extension.bbclass | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
> index ea956cd5..3c461b1a 100644
> --- a/meta/classes/image-account-extension.bbclass
> +++ b/meta/classes/image-account-extension.bbclass
> @@ -8,6 +8,10 @@
>  USERS ??= ""
>  GROUPS ??= ""
>  
> +# rebuild rootfs on change of USERS as homes might be moved / created
> +# no need to depend on GROUPS as they don't create directories
> +# groups need to be created before users, hence do not move the user creation into
> +# the do_rootfs_install task but only add a dependency

Quirin and I do not yet buy why GROUPS should be excluded. They may also
need a clean baseline if the developer changed a recipe with impact on
groups.

We just had a case where someone changed the gid, and that failed to
rebuild. So, even if groups do not create directories, they influence
that. And some experiments I just did seem to confirm that.

Jan

>  python() {
>      for entry in (d.getVar("GROUPS") or "").split():
>          group_entry = "GROUP_{}".format(entry)
> @@ -16,7 +20,9 @@ python() {
>      for entry in (d.getVar("USERS") or "").split():
>          user_entry = "USER_{}".format(entry)
>          d.appendVarFlag("image_postprocess_accounts", "vardeps", " {}".format(user_entry))
> +        d.appendVarFlag("do_rootfs_install", "vardeps", " {}".format(user_entry))
>  }
> +do_rootfs_install[vardeps] += "USERS"
>  
>  def image_create_groups(d: "DataSmart") -> None:
>      """Creates the groups defined in the ``GROUPS`` bitbake variable.

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/2273660e-648a-4153-8dc0-64bbb20e285f%40siemens.com.