Re: [PATCH 1/2] rootfs-add-files: correctly remove files in ROOTFSDIR

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Wed, 2026-10-21 at 13:25 +0200, 'Clara Kowalsky' via isar-users
wrote:
> The existence check uses ROOTFSDIR plus destination, but the removal
> command uses destination alone. Since the task runs outside the
> image chroot, it targets a build-host path instead.
> 
> A replacement-path test confirms that the original code deletes a
> host-side file while leaving the image-side file untouched.

WTF. That even calls for a CVE.

We definitely need a test for the rootfs_add_files logic.

Felix

> 
> Fixes: d2eb951a931c ("add new class to add files directly to the rootfs")
> Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> ---
>  meta/classes-recipe/rootfs-add-files.bbclass | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/rootfs-add-files.bbclass
> index 38f739ee..d33752f3 100644
> --- a/meta/classes-recipe/rootfs-add-files.bbclass
> +++ b/meta/classes-recipe/rootfs-add-files.bbclass
> @@ -24,7 +24,7 @@ python rootfs_add_files() {
>          destination = d.getVarFlag(additional_file_entry, "destination") or ""
>          source = d.getVarFlag(additional_file_entry, "source") or ""
>          if os.path.exists(f"{rootfsdir}/{destination}"):
> -            bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"])
> +            bb.process.run(["/usr/bin/rm", "-f", f"{rootfsdir}/{destination}"])
>  
>          dest_dir = os.path.dirname(destination)
>          bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p", f"{rootfsdir}/{dest_dir}" ])
> -- 
> 2.55.0
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021112532.3824701-1-clara.kowalsky%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/36187b719af5eb5cbbdd7d2c72689a672a848fad.camel%40siemens.com.