Re: [PATCH] kas: Support kas build system selection

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 09.06.26 10:53, Anton Mikanovich wrote:
> This adds yaml Kconfig options that allow to choose kas build system
> from the following list:
> 
>   --isar-rootless
>   --isar-privileged
> 
> After moving to rootless kas container previously used "--isar" option
> turns deprecated and should be replaced by "--isar-privileged".
> 
> Signed-off-by: Anton Mikanovich <amikan@ilbers.de>
> ---
>  Kconfig         |  3 ++-
>  kas/opt/Kconfig | 20 ++++++++++++++++++++
>  2 files changed, 22 insertions(+), 1 deletion(-)
> 
> diff --git a/Kconfig b/Kconfig
> index 66dd4112..cfea1902 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -1,5 +1,5 @@
>  # This software is a part of Isar.
> -# Copyright (C) 2023 ilbers GmbH
> +# Copyright (C) 2023-2026 ilbers GmbH
>  #
>  # SPDX-License-Identifier: MIT
>  #
> @@ -14,6 +14,7 @@ config KAS_INCLUDE_MAIN
>  
>  config KAS_BUILD_SYSTEM
>  	string
> +	default "isar-privileged" if KAS_BUILD_SYSTEM_ISAR_PRIVILEGED
>  	default "isar-rootless"
>  
>  source "kas/machine/Kconfig"
> diff --git a/kas/opt/Kconfig b/kas/opt/Kconfig
> index ac9b2f55..1bea49b8 100644
> --- a/kas/opt/Kconfig
> +++ b/kas/opt/Kconfig
> @@ -115,6 +115,26 @@ config KAS_INCLUDE_USER_ISAR
>  
>  endmenu
>  
> +
> +menu "Kas build system"
> +
> +choice
> +	prompt "Kas build system"
> +	default KAS_BUILD_SYSTEM_ISAR_ROOTLESS
> +	help
> +          Rootless build mode is using unshare syscall to avoid security issues.
> +          Otherwize privileged mode with sudo permissions still can be used.
> +
> +config KAS_BUILD_SYSTEM_ISAR_ROOTLESS
> +	bool "Rootless (--isar-rootless)"
> +
> +config KAS_BUILD_SYSTEM_ISAR_PRIVILEGED
> +	bool "Privileged (--isar-privileged)"
> +
> +endchoice
> +
> +endmenu
> +
>  config KAS_IMAGE_FSTYPES
>  	string "Additional image fstypes"
>  	default ""

As Felix already pointed out, this will not work. I would recommend to
stick with privileged builds until there is at least a kas release which
comes with the required support. Then, Isar could switch its default
over to rootless, leaving privileged mode only via command line
selection for CI purposes.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/40aee07a-beb6-4c8f-b70e-f10900bccd02%40siemens.com.