From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 15 Sep 2026 11:03:56 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wm1-f59.google.com (mail-wm1-f59.google.com [209.85.128.59]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 68F93sMV001230 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 15 Sep 2026 11:03:54 +0200 Received: by mail-wm1-f59.google.com with SMTP id 5b1f17b1804b1-49e745d5dabsf23867055e9.0 for ; Tue, 15 Sep 2026 02:03:54 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1789463029; cv=pass; d=google.com; s=arc-20260327; b=gWI6RyNctD+EO0qSB4RJA1otLuTe94RvksPssUr+iVH8nfkQ7HhJNtotGuq3psrC0M LVvwDIS3X5Kv1HxOzy/1EOgpa4zINovhrwJnJBOTG3m15tmdvcSGeAzC1yveg0ravQlT v3bGgT2+bXKg/O7wjf0jUA+P0IQ6s26CshDM/1Y2P4D3LVF26zjujIpXF9/QYFI6//mp zID9q1gzbU1rwnSH6oJXIm7pgqgLij8mKFcYZ9yEXdJLQtS+cbtVEk4eyh28jhl8eKWH Jw4GYb7U7flytLfawRtAd0WKZHtvdMHpAul08DjjGRkigGISCt0UN4YVdCflqvR5bBEZ b8Tw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=oN6vWQEQXqGzIkyb8aqwvs2x1YBBgWQB8Q0REy5aqJ0=; fh=4haxqmn2UEPDUUwM1FWssgBxiYbsLa1uOzPsSdjpYeU=; b=mKnKVLiGtgsZYJh3axByRUtHRiVDjMKx2BcX5jQ7IJr9N28M72dnYgF8HQnMEi7ewU Bsr/+NbL+JF0+RuKXSLiOPnWC3tcF02PiA0BXKNiZeHR1OB+jKIRw/4B35+M7Mju9ngT 3pI+MqUkhHQGEMuUQGh+oRg8YcFvHbkURr4WGkhK9VrzyGYsRoYOwDislFeezfmOBmwV bNEGYBpU74lMi80jF66zAYAdoIcC5bHFyIxyhU1YTOA1HpV+9yDkHopEnMHp9EWHhAEI i4bD+rEVwJDg86pJtuiqT/TghkBDqn0cS+xe+9//oX0ujixLoUjPt32DZCA4CL05DFlM hJ6A==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1789463029; x=1790067829; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-type:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=oN6vWQEQXqGzIkyb8aqwvs2x1YBBgWQB8Q0REy5aqJ0=; b=Qs/31tHlZrcdfAKGgWbgv8d4/2Hj7Da/TsnE6OhJB0a0VeGk+hsxneuDsOix0EfEFo JLqfXtinQ2ZLmibhKc487JoEUOmmJG9N4PLkHV1stF8NAKs9ivMBZ7EazPrtR1KT76xq gNwQ/gYIXaYduA8mldBYDO+sd2en0fcFSgqIf9GTUizQQiM6aDtrY4CVbOqSjUNn38pl MHHxeF74ifs2co2cvAcCd2sm/hY8+jBWkGb8rPvo30jiMzYEMTtllbLBK4T0BbuhZwt5 6J4ZcxPemFz2F50xnXkZdFuqJKBwNaRxbsELJz2av9jEK2+zNeIzwn2eopulaMgsPhNw mbug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789463029; x=1790067829; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:content-type :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oN6vWQEQXqGzIkyb8aqwvs2x1YBBgWQB8Q0REy5aqJ0=; b=SPHAz8hF+KyWsbwl1B5LACqvLLeZUHgA0v7UGNtTHQJ8Ir/kVl9IPAnTaaDeSD14KJ eznLY7XxSXEogqD6U4UPraGatkKVJ3QLnTdy1XS6dTXRucaSCbA/nPeTYVLBzyekzFi/ tTFzkdUbNRVkq4a95Y5o/UAt1CoAj2pl/4FInkjEJ+iuObKHJLWNnHidSk7ZfcC322TB QcF3kY8dBj1hPgeOAwhiD3VvWfT7K7nmJrqDzyyrQ29CKYucAmLYGopiOCaStHQ4dBbI P8y2ZyPureAXou51WuvxVgq5W/eLHiuX0QMAOFq0pHt26GieRDkzsU0MzeIUIS0a2brc UxYw== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AKwUvBxtD2sChsviKWL7hWcuyVF6dDUjK0zKlKjn8+SW2tPHC7q+4vL/ic3nC/kQ/EFo37Z9tahB@ilbers.de X-Gm-Message-State: AFuF++kW1V0ZIXgGWcErpcHSkMDWHiAtXQ117M8+t8+z/fBIHGfihROt 0cA7lj01k2Gj2r0hiQ5DeQd9Z13O81qryCZMkjHUNoZ5FWeJsixpkAdf X-Received: by 2002:a05:600c:c09b:b0:49c:d52e:d0ea with SMTP id 5b1f17b1804b1-49e7d4601c4mr73131495e9.4.1789463029288; Tue, 15 Sep 2026 02:03:49 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdch23wp4aH7uinjc3inyRHjKHHJwuqPHfldOEU1BPzNJQ==" Received: by 2002:a05:600c:6289:b0:495:5dfd:ff7c with SMTP id 5b1f17b1804b1-49d266850bcls43977215e9.1.-pod-prod-02-eu; Tue, 15 Sep 2026 02:03:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzpHareo3aRK51WwXVVVTqeC11Z4zA6Cb6T0aLTUl3+OPd94WfktI2HwF0voNOi6ubHk8xSq2df2SpK@googlegroups.com X-Received: by 2002:a05:6000:4a17:b0:486:f282:e66b with SMTP id ffacd0b85a97d-48702aacdaemr14909086f8f.2.1789463026845; Tue, 15 Sep 2026 02:03:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789463026; cv=none; d=google.com; s=arc-20260327; b=aH5vo4LpuNV0QSkIX+Y/MnKq5GFrfZiVwKPwKHvCY6GUrcjrcSU1ePX58Nq4oafyda u8DH6ZKeHzW6UU4eTIaS9rmoS0gI6QEKth0BIwwgjF3fY5OwpuvlnGT7R0KPPft33Cdc vkPQ9OLiP+y2mI+4HH+5oLm7Ipwt0TB+Y8EVMT1CUOa+nX9jCXeqEZzW8LhwDRyCQW3L OINQS+lmxqvvVqx0wLEDdvAnYARe7qg6WF9cHhxdNUVEMC4g9VFrIhcAub+FWnweYO4J LvsBeG7rrdTX84Qu3PmnKpyWtKNxuyLDJyzVLvUZpIIntPiZxsUY185h004uiQu2pU1r inSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=MN0Md1au2t/NNh40HS2dkNQNOb7jEY1JYoGIF5CwIWw=; fh=2dFEE+ZGxOIbJIeO5uOTpqDdUCG7AtolnzmAGdmLqCM=; b=jyxdTaRp+uM62lc2s6dvmZQgBVKYJe8A2BCmjR44S15/JKunGBuGD6thRTFRxKEzVY e+7sKYb3NrCXrBkiSWpmcqrreRVYrk57RNpdyljoFFw8wY8zpVyxy1/xyMyObzFtjuWx 2Lc/HLsT3PeCyTEbHgVO142DhUatZ7M8qK3yEvdAai/GVzotrOX9Z0AcvkeH/lyXaBwg 1YVaRs2x9q52XukO4rxu4HchDhg9HZEREJ8TvDPQemVsleEaxI5mYOoDm5UHFH5WymIt hlQCb/2+G/dC6rqK5KZcQnzXSWwLjNcl7RNJbMkxOSFqTcb48es1FyrSjkwLiObY8zHN RJiw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id ffacd0b85a97d-486eb3395bcsi246352f8f.3.2026.09.15.02.03.46 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 15 Sep 2026 02:03:46 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.24] (dslb-188-101-241-026.188.101.pools.vodafone-ip.de [188.101.241.26]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 68F93bWr001215 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 15 Sep 2026 11:03:37 +0200 Message-ID: <3a406e64-a546-4e2f-9620-39a45bef2aa1@ilbers.de> Date: Tue, 15 Sep 2026 11:03:36 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/1] isar-check-rootless: check parent dirs are world searchable To: Felix Moessbauer , isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, ulrich.teichert@ebs-group.io, Clara Kowalsky References: <20260911080307.1189531-1-felix.moessbauer@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <20260911080307.1189531-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: Hba2q91FWaVZ Applied to next, thanks. Zhihang On 9/11/26 10:03, 'Felix Moessbauer' via isar-users wrote: > When using mmdebstrap with the unshare backend, all parent directories > of the TMPDIR must be world searchable (S_IXOTH). This requirement is > documented in the mmdebstrap man page, but when not fulfilled, mmdebstrap > fails in colorful ways. > > To indicate what is wrong, we add a check to the isar-check-rootless > script. > > Reported-by: Clara Kowalsky > Signed-off-by: Felix Moessbauer > --- > Changes since v1: > > - reworded "executable" to "searchable" as pointed out by Ulrich > > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ > 1 file changed, 33 insertions(+) > > diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless > index b5197111..04717410 100755 > --- a/scripts/isar-check-rootless > +++ b/scripts/isar-check-rootless > @@ -20,6 +20,35 @@ fi > > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 > > +if ! tmpdir=$( \ > + BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ > + ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then > + echo "error: cannot determine TMPDIR from BitBake" >&2 > + exit 1 > +fi > + > +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 > + > +failed=0 > +fail() { > + echo "error: $1" >&2 > + echo " likely cause: $2" >&2 > + failed=1 > +} > + > +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a > +# subordinate user. That user can only reach it if every ancestor of TMPDIR is > +# world-searchable (see mmdebstrap(1), TMPDIR). > +dir=$tmpdir > +while [ "$dir" != "/" ]; do > + if [ -e "$dir" ] && \ > + [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then > + fail "'$dir' is not world-searchable" \ > + "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" > + fi > + dir=$(dirname "$dir") > +done > + > if ! ${run_privileged_cmd} /bin/sh <<'EOF' > failed=0 > > @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' > exit "$failed" > EOF > then > + failed=1 > +fi > + > +if [ "$failed" != 0 ]; then > echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 > exit 1 > fi -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/3a406e64-a546-4e2f-9620-39a45bef2aa1%40ilbers.de.