Re: [PATCH v3 00/16] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Tue, 2026-04-07 at 16:22 +0200, Felix Moessbauer wrote:
> Dear isar-users,
> 
> currently isar requires password-less sudo and an environment
> where mounting file systems is possible. This has proven problematic
> for security reasons, both when running in a privileged container or
> locally.
> 
> To solve this, we implement fully rootless builds that rely on the
> unshare syscall which allows us to avoid sudo and instead operate in
> temporary kernel namespaces as a user that is just privileged within
> that namespace. This comes with some challenges regarding the handling
> of mounts (they are cleared when leaving the namespace), as well as
> cross namespace deployments (the outer user might not be able to access
> the inner data). For that, we rework the handling of mounts and artifact
> passing to make it compatible with both chroot modes (schroot and
> unshare).

Any news on this one? Do you want me to send a rebase? I did not
receive any objections regarding the proposed interface on the kas
side. By that, I would like to move forward with this.

I'm also fine with scheduling this behind the testsuite execution
series ("Improve testsuite executability, basic GitHub CI"), as this
significantly simplifies testing.

Just let me know.

Best regards,
Felix

> 
> Note, that this series can be tested on a custom kas-container build
> provided in [1]. Hints how to migrate downstream layers are provided
> in the API changelog.
> 
> Changes since PATCH v2:
> 
> - add support for cached base apt
> - rootfs sstate: do not rely on fd3 for copy out, as not always available
> - sbom: use local copy of sbom rootfs to not leave shared instance behind
> - testsuite: add parameter to run in rootless mode
> - rebased onto v1.0
> 
> Changes since PATCH v1:
> 
> - fixed broken rebase onto next
> - fix root_cleandirs implementation
> 
> NOTE: This requires the kas series (v3) from [1] for rootless building.
> 
> Changes since RFC 2:
> 
> - rebased onto next
> - fix usage of root_cleandirs
> - simplify file permission handling by mapping caller user to
>   root inside the namespace. By that, in most cases no changes
>   to the imager are needed anymore.
> - implement support for devshell under rootless
> - switch to getpass.getuser() to query user (needed for dynamically
>   created / remapped kas builder user)
> - rework mapping to be more similar to mapping used by mmdebstrap
> - sbuild: only copy-out of dpkg.log on schroot (unclear if needed
>   on unshare. To be clarified)
> - imager-sbom: ensure sbom is extracted before entering the chroot
> 
> Changes since RFC 1:
> 
> - switch build_type to isar-rootless in isar.yaml (Note: switch back
>   if testing locally in a unprepared kas container)
> - complete overhaul of the mounting in unshared namespaces
>   - fixes the systemd presetting
>   - fixes hangs when pulling from snapshot mirrors
> - rename the run_privileged_here to run_privileged_heredoc to clarify its intention
> - add support for
>   - dpkg-source with do_fetch_common_source
>   - vm images
>   - container images
>   - discoverable disk images
> - add helper script to clean build dir in unprivileged mode
> - reduce clutter we leave after finishing a build
> - fix issues when running in a privileged environment without sub user ids
> - bugfixes
> 
> Note, that the rootless build dir must not reside in a git worktree (a normal git
> dir is fine). This is probably a bug in combination with kas-container.
> 
> [1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg
> 
> Best regards,
> Felix Moessbauer
> Siemens AG
> 
> Felix Moessbauer (16):
>   refactor bootstrap: store rootfs tar with user permissions
>   deb-dl-dir: export without root privileges
>   download debs without locking
>   introduce wrappers for privileged execution
>   bootstrap: move cleanup trap to function
>   rootfs: rework sstate caching of rootfs artifact
>   rootfs_generate_initramfs: rework deployment to avoid chowning
>   use bitbake function to generate mounting scripts
>   apt-fetcher: prepare for chroot specific fetching
>   add support for fully rootless builds
>   add helper script to clean artifacts in build dir
>   apt-fetcher: implement support for unshare backend
>   dpkg-source: implement multiarch support for unshare backend
>   use copy of sbom-chroot for sbom creation
>   add support for devshell on unshare backend
>   testsuite: add parameter to run tests in rootless mode
> 
>  Kconfig                                       |   2 +-
>  RECIPE-API-CHANGELOG.md                       |  42 ++++
>  doc/user_manual.md                            |   2 +
>  kas/isar.yaml                                 |   2 +-
>  meta/classes-global/base.bbclass              | 124 ++++++++++-
>  meta/classes-recipe/deb-dl-dir.bbclass        |  24 ++-
>  meta/classes-recipe/dpkg-base.bbclass         |  94 ++++++--
>  meta/classes-recipe/dpkg-source.bbclass       |  40 +++-
>  meta/classes-recipe/dpkg.bbclass              |  19 +-
>  .../image-account-extension.bbclass           |   4 +-
>  .../image-locales-extension.bbclass           |  13 +-
>  .../image-postproc-extension.bbclass          |  30 +--
>  .../image-tools-extension.bbclass             | 114 +++++++++-
>  meta/classes-recipe/image.bbclass             |  21 +-
>  .../imagetypes_container.bbclass              |  28 +--
>  meta/classes-recipe/imagetypes_wic.bbclass    |  10 +-
>  meta/classes-recipe/rootfs.bbclass            | 203 +++++++++---------
>  meta/classes-recipe/sbuild.bbclass            |  34 ++-
>  meta/classes-recipe/sdk.bbclass               |  22 +-
>  meta/classes/sbom.bbclass                     |  28 ++-
>  meta/conf/bitbake.conf                        |   7 +-
>  meta/lib/aptsrc_fetcher.py                    |  87 +++++++-
>  .../isar-mmdebstrap/isar-mmdebstrap.inc       |  55 +++--
>  .../sbom-chroot/sbom-chroot.bb                |  11 +-
>  .../sbuild-chroot/sbuild-chroot.inc           |  24 ++-
>  scripts/isar-clean-builddir                   |  73 +++++++
>  testsuite/cibuilder.py                        |   6 +
>  .../unittests/test_image_account_extension.py |   9 +-
>  28 files changed, 882 insertions(+), 246 deletions(-)
>  create mode 100755 scripts/isar-clean-builddir
> 
> -- 
> 2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/88aa53960d349c6679345286a5bed59113b0661d.camel%40siemens.com.