Re: [PATCH] buildchroot: build debian packages as "builder" not "root"

["Maxim Yu. Osipov" <mosipov@ilbers.de>]

On 10/26/18 1:49 PM, Henning Schild wrote:
> We used to build packages as "root" and now do that as a regular user.
> Not building as "root" allows us to find mistakes in debian/rules where
> privileged operations are used while they should not (a sudo was
> found in a rules-file). Further some build steps might actually expect
> to not run as root (seen in openssl test suite).
> 
> Not building as root should increase overall quality and brings us
> closer to how debian packages are build by others.

Applied to the 'next',

Thanks,
Maxim.

> Signed-off-by: Henning Schild <henning.schild@siemens.com>
> ---
>   meta/recipes-devtools/buildchroot/buildchroot-target.bb | 3 ++-
>   meta/recipes-devtools/buildchroot/files/build.sh        | 6 ++++--
>   meta/recipes-devtools/buildchroot/files/configscript.sh | 4 ++++
>   3 files changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/meta/recipes-devtools/buildchroot/buildchroot-target.bb b/meta/recipes-devtools/buildchroot/buildchroot-target.bb
> index 42f47fc..c342625 100644
> --- a/meta/recipes-devtools/buildchroot/buildchroot-target.bb
> +++ b/meta/recipes-devtools/buildchroot/buildchroot-target.bb
> @@ -18,6 +18,7 @@ BUILDCHROOT_PREINSTALL ?= "gcc \
>                              apt \
>                              automake \
>                              devscripts \
> -                           equivs"
> +                           equivs \
> +                           adduser"
>   
>   do_build[depends] = "isar-apt:do_cache_config isar-bootstrap-target:do_bootstrap"
> diff --git a/meta/recipes-devtools/buildchroot/files/build.sh b/meta/recipes-devtools/buildchroot/files/build.sh
> index e74bc14..d98eb2e 100644
> --- a/meta/recipes-devtools/buildchroot/files/build.sh
> +++ b/meta/recipes-devtools/buildchroot/files/build.sh
> @@ -14,5 +14,7 @@ for i in configure aclocal.m4 Makefile.am Makefile.in; do
>       fi
>   done
>   
> -# Build the package
> -dpkg-buildpackage -a$target_arch -d --source-option=-I
> +# Build the package as user "builder"
> +chown -R builder:builder $1 # the sources
> +chown builder:builder $1/.. # the output
> +su - builder -c "cd $1; dpkg-buildpackage -a$target_arch -d --source-option=-I"
> diff --git a/meta/recipes-devtools/buildchroot/files/configscript.sh b/meta/recipes-devtools/buildchroot/files/configscript.sh
> index d591c2a..30660e7 100644
> --- a/meta/recipes-devtools/buildchroot/files/configscript.sh
> +++ b/meta/recipes-devtools/buildchroot/files/configscript.sh
> @@ -9,3 +9,7 @@ debconf-set-selections <<END
>   locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8
>   locales locales/default_environment_locale select en_US.UTF-8
>   END
> +
> +addgroup --quiet --system builder
> +useradd --system --gid builder --no-create-home --home /home/builder --no-user-group --comment "Isar buildchroot build user" builder
> +chown -R builder:builder /home/builder
> 


-- 
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov