From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 26 Oct 2026 11:05:04 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-qt1-f186.google.com (mail-qt1-f186.google.com [209.85.160.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69QA5186009427 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 26 Oct 2026 11:05:02 +0100 Received: by mail-qt1-f186.google.com with SMTP id d75a77b69052e-536720195ebsf67945781cf.1 for ; Mon, 26 Oct 2026 03:05:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1793009096; x=1793613896; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:x-original-sender :content-type:mime-version:subject:references:in-reply-to:message-id :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=rQnnkoQpoKrRGIVUxbNG2X/chwUCQdCf2cMnVtXGOCw=; b=fjR8aO5VpkI8TFOrqG9AS02z/JsGLkpqf/l/E/6ZD5dU3ysbuTzBJo+a7fK0Pw6owV Z0rhAGEFGB/AmtuUWQEbXuxyZls/w7av8uTN4+MYvghrkTLqA6L5j0MCN2doEWRVkCR4 e5KDFCs2oIYDztzLSLhgh+rXEJKtfB3apIvFHihZFDsIEUqGxBIE3lbZONiJ1n+Cnff/ o4aeNcwEODeOdpGflIAMUr45g4lJ8DvbNptaFf46AXM3jKDCNimz4igA1LaxHDHD8DJD 3GreJuR2lwCl6HENHWrq/bfyNrVZMQtfe0MCtIWT73CDADJ+eViTcYzEeoWS/uX/v5C1 22cQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793009096; x=1793613896; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-sender:content-type:mime-version:subject:references :in-reply-to:message-id:to:from:date:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=rQnnkoQpoKrRGIVUxbNG2X/chwUCQdCf2cMnVtXGOCw=; b=SSDIWoKkO3gIWBf41wPd2QFqhrzdKCaxWUGDEg8T2UfX/aIJN+BcxYCQu6gBVPn1i6 oKsUBMB+0nnM9epmfRazTJ1lrKxt+EUYsmfS+Xx6HOZ8Le63PXXk6hgxuK4t7tQyg5VE d/WMWq6bZ9DAVMbqCvNJNQoqTDNn/7y/jDsPkch4BWxdkg7rwfXbyW2f0kKhZ36p6L3b AiHyYmamM2t1oGxILsuzdv5gqO2Ju/XEFCptlk0xf7FFPNsbvo1b6ywWYnpfHkpZOOop bdc/V7skbxE3ZYctZfXukiLjq0CmKVmxPv8RGVnT+OFsqZqMPN843D4Ke9+NDaJhkh9E VaLQ== X-Forwarded-Encrypted: i=1; AKwUvBzYmBJkdetrum3BxO2bvgGOzPI6/v1TyhAk7tfWwuiAPsB+Q4KQZqSwIJHkgXsedNws1KDN@ilbers.de X-Gm-Message-State: AFq9FYJazsKeclI7HesI4wXCyj4RX+rOvTJ8t8eX5RBn27BdHDgRwG+u qVRoQ/ZH2lChREWmBCddKSV405coL0yk/1NjwaTl/rFrLdiJRH2AGOob X-Received: by 2002:a05:622a:308:b0:533:3572:250f with SMTP id d75a77b69052e-5383b52d4aemr96218551cf.36.1793009095573; Mon, 26 Oct 2026 03:04:55 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdff+yq0O2lT6IR8hT/2+1iAhhm8TMX6L/v8HW+xkCgjkA==" Received: by 2002:a05:6214:12c6:b0:91c:6761:5b01 with SMTP id 6a1803df08f44-91c676167d5ls6147846d6.1.-pod-prod-01-us; Mon, 26 Oct 2026 03:04:54 -0700 (PDT) X-Received: by 2002:a05:620a:2b82:b0:93f:5f83:2ca4 with SMTP id af79cd13be357-940ef97bd9cmr921430885a.51.1793009094353; Mon, 26 Oct 2026 03:04:54 -0700 (PDT) Date: Mon, 26 Oct 2026 03:04:53 -0700 (PDT) From: "'Gourav Singh' via isar-users" To: isar-users Message-Id: <38f697af-21d2-4ba7-99cd-fdff50acea24n@googlegroups.com> In-Reply-To: References: <20261025050932.69095-1-gouravsingh@siemens.com> Subject: Re: [PATCH] rootfs-add-files: use run_privileged_cmd instead of sudo MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_213718_731937651.1793009093351" X-Original-Sender: gouravsingh@siemens.com X-Original-From: Gourav Singh Reply-To: Gourav Singh Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,HTML_MESSAGE,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: TQESfUk32kio ------=_Part_213718_731937651.1793009093351 Content-Type: multipart/alternative; boundary="----=_Part_213719_1108475054.1793009093351" ------=_Part_213719_1108475054.1793009093351 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for pointing this out. Please drop this patch as it is a duplicate.= =20 On Monday, October 26, 2026 at 3:19:59=E2=80=AFPM UTC+5:30 Moessbauer, Feli= x wrote: > On Sun, 2026-10-25 at 10:39 +0530, 'Gourav Singh' via isar-users wrote: > > rootfs_add_files hard-codes "sudo -E" to create the destination > > directory and copy the additional files into the rootfs. In rootless > > (unshare) mode, this leaves e.g. the installer's /install directory > > owned by the real root, which is not mapped into the user namespace. > > Subsequent builds then fail in root_cleandirs of do_rootfs_install: > >=20 > > rm: cannot remove '.../rootfs/install/.wic.zst': Permission deni= ed > >=20 > > Use run_privileged_cmd() instead, so that the files are created with > > the same privileges as the rest of the rootfs. > >=20 > > While at it, also fix the removal of a pre-existing destination file, > > which ran unprivileged on the host path instead of the path inside the > > rootfs. > > Hi, this is a duplicate of "[PATCH 2/2] rootfs-add-files: use > privileged execution helper for rootless builds". > > Felix > > >=20 > > Signed-off-by: Gourav Singh > > --- > > meta/classes-recipe/rootfs-add-files.bbclass | 11 ++++++----- > > 1 file changed, 6 insertions(+), 5 deletions(-) > >=20 > > diff --git a/meta/classes-recipe/rootfs-add-files.bbclass=20 > b/meta/classes-recipe/rootfs-add-files.bbclass > > index 38f739ee..d135f6d7 100644 > > --- a/meta/classes-recipe/rootfs-add-files.bbclass > > +++ b/meta/classes-recipe/rootfs-add-files.bbclass > > @@ -18,24 +18,25 @@ ROOTFS_ADDITIONAL_FILES ??=3D "" > > python rootfs_add_files() { > > postprocess_additional_files =3D=20 > d.getVar('ROOTFS_ADDITIONAL_FILES').split() > > rootfsdir =3D d.getVar("ROOTFSDIR") > > + privileged =3D run_privileged_cmd(d).split() > >=20 > > for entry in postprocess_additional_files: > > additional_file_entry =3D f"ROOTFS_ADDITIONAL_FILE_{entry}" > > destination =3D d.getVarFlag(additional_file_entry, "destination") or "= " > > source =3D d.getVarFlag(additional_file_entry, "source") or "" > > - if os.path.exists(f"{rootfsdir}/{destination}"): > > - bb.process.run([ "/usr/bin/rm", "-f", f"{destination}"]) > > + if os.path.lexists(f"{rootfsdir}/{destination}"): > > + bb.process.run(privileged + ["/usr/bin/rm", "-f",=20 > f"{rootfsdir}/{destination}"]) > >=20 > > dest_dir =3D os.path.dirname(destination) > > - bb.process.run(["sudo", "-E", "/usr/bin/mkdir", "-p",=20 > f"{rootfsdir}/{dest_dir}" ]) > > + bb.process.run(privileged + ["/usr/bin/mkdir", "-p",=20 > f"{rootfsdir}/{dest_dir}" ]) > > # empty source creates only an empty destination file > > if not source: > > - bb.process.run(["sudo", "-E", "/usr/bin/touch",=20 > f"{rootfsdir}/{destination}" ]) > > + bb.process.run(privileged + ["/usr/bin/touch",=20 > f"{rootfsdir}/{destination}" ]) > > return > >=20 > > if not os.path.exists(f"{source}"): > > bb.error(f"{source} does not exists and cannot be copied to the rootfs!= ") > > # no recursive copy only single files > > - bb.process.run(["sudo", "-E", "/usr/bin/cp", "-a", f"{source}",=20 > f"{rootfsdir}/{destination}" ]) > > + bb.process.run(privileged + ["/usr/bin/cp", "-a", f"{source}",=20 > f"{rootfsdir}/{destination}" ]) > > } > > ROOTFS_INSTALL_COMMAND +=3D "rootfs_add_files" > > --=20 > > 2.39.5 > >=20 > > > --=20 > > You received this message because you are subscribed to the Google=20 > Groups "isar-users" group. > > To unsubscribe from this group and stop receiving emails from it, send= =20 > an email to isar-users+...@googlegroups.com. > > To view this discussion visit=20 > https://groups.google.com/d/msgid/isar-users/20261025050932.69095-1-goura= vsingh%40siemens.com > . > --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= 38f697af-21d2-4ba7-99cd-fdff50acea24n%40googlegroups.com. ------=_Part_213719_1108475054.1793009093351 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for pointing this out.=C2=A0Please drop this patch as it is a duplic= ate.=C2=A0

On Monday, October 26, 2026 at 3:19:59=E2=80=AFPM UTC+5:30 Moe= ssbauer, Felix wrote:
On Sun, 2026-10-25 at 10:39 +0530, 'Gourav Singh' via isar= -users wrote:
> rootfs_add_files hard-codes "sudo -E" to cr= eate the destination
> directory and copy the additional files into t= he rootfs. In rootless
> (unshare) mode, this leaves e.g. the install= er's /install directory
> owned by the real root, which is not ma= pped into the user namespace.
> Subsequent builds then fail in root_c= leandirs of do_rootfs_install:
>
> rm: cannot remove '..= ./rootfs/install/<image>.wic.zst': Permission denied
>
= > Use run_privileged_cmd() instead, so that the files are created with> the same privileges as the rest of the rootfs.
>
> Whil= e at it, also fix the removal of a pre-existing destination file,
> w= hich ran unprivileged on the host path instead of the path inside the
&g= t; rootfs.

Hi, this is a duplicate of "[PATCH 2/2] rootfs-add-files:= use
privileged execution helper for rootless builds".

Felix

>
> Signed-off-by: Gourav Singh <goura...@siemens.com>
> ---> meta/classes-recipe/rootfs-add-files.bbclass | 11 ++++++-----
&g= t; 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff -= -git a/meta/classes-recipe/rootfs-add-files.bbclass b/meta/classes-recipe/r= ootfs-add-files.bbclass
> index 38f739ee..d135f6d7 100644
> ---= a/meta/classes-recipe/rootfs-add-files.bbclass
> +++ b/meta/classes-= recipe/rootfs-add-files.bbclass
> @@ -18,24 +18,25 @@ ROOTFS_ADDITION= AL_FILES ??=3D ""
> python rootfs_add_files() {
> = postprocess_additional_files =3D d.getVar('ROOTFS_ADDITIONAL_FILES&#= 39;).split()
> rootfsdir =3D d.getVar("ROOTFSDIR")
= > + privileged =3D run_privileged_cmd(d).split()
>
> = for entry in postprocess_additional_files:
> additional_f= ile_entry =3D f"ROOTFS_ADDITIONAL_FILE_{entry}"
> = destination =3D d.getVarFlag(additional_file_entry, "destination"= ) or ""
> source =3D d.getVarFlag(additional_file_= entry, "source") or ""
> - if os.path.exis= ts(f"{rootfsdir}/{destination}"):
> - bb.process= .run([ "/usr/bin/rm", "-f", f"{destination}"]= )
> + if os.path.lexists(f"{rootfsdir}/{destination}"= ;):
> + bb.process.run(privileged + ["/usr/bin/rm&quo= t;, "-f", f"{rootfsdir}/{destination}"])
>
&= gt; dest_dir =3D os.path.dirname(destination)
> - bb.= process.run(["sudo", "-E", "/usr/bin/mkdir", = "-p", f"{rootfsdir}/{dest_dir}" ])
> + bb.= process.run(privileged + ["/usr/bin/mkdir", "-p", f&quo= t;{rootfsdir}/{dest_dir}" ])
> # empty source creates o= nly an empty destination file
> if not source:
> - = bb.process.run(["sudo", "-E", "/usr/bin/to= uch", f"{rootfsdir}/{destination}" ])
> + b= b.process.run(privileged + ["/usr/bin/touch", f"{rootfsdir}/= {destination}" ])
> return
>
> = if not os.path.exists(f"{source}"):
> bb.er= ror(f"{source} does not exists and cannot be copied to the rootfs!&quo= t;)
> # no recursive copy only single files
> - = bb.process.run(["sudo", "-E", "/usr/bin/cp",= "-a", f"{source}", f"{rootfsdir}/{destination}&q= uot; ])
> + bb.process.run(privileged + ["/usr/bin/cp&quo= t;, "-a", f"{source}", f"{rootfsdir}/{destination= }" ])
> }
> ROOTFS_INSTALL_COMMAND +=3D "rootfs_add= _files"
> --
> 2.39.5
>

&g= t; --
> You received this message because you are subscribed to the = Google Groups "isar-users" group.
> To unsubscribe from thi= s group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> To= view this discussion visit https://groups.google.com/d/msgi= d/isar-users/20261025050932.69095-1-gouravsingh%40siemens.com.

<= /p>

--
You received this message because you are subscribed to the Google Groups &= quot;isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-use= rs+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-use= rs/38f697af-21d2-4ba7-99cd-fdff50acea24n%40googlegroups.com.
------=_Part_213719_1108475054.1793009093351-- ------=_Part_213718_731937651.1793009093351--