Re: [PATCH v7 10/17] add support for fully rootless builds

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2026-06-25 at 17:36 +0200, Felix Moessbauer wrote:
> Currently isar requires passwordless sudo and an environment
> where mounting file systems is possible. This has proven problematic
> for security reasons, both when running in a privileged container or
> locally.
> 
> To solve this, we implement fully rootless builds that rely on the
> unshare syscall which allows us to avoid sudo and instead operate in
> temporary kernel namespaces as a user that is just privileged within
> that namespace. This comes with some challenges regarding the handling
> of mounts (they are cleared when leaving the namespace), as well as
> cross namespace deployments (the outer user might not be able to access
> the inner data). For that, we rework the handling of mounts and artifact
> passing to make it compatible with both chroot modes (schroot and
> unshare).
> 
> We intentionally do not switch the build_system in isar.yaml resp. the
> KAS_BUILD_SYSTEM in the menu KConfig, as there is no kas release with
> support for the new modes as of today. We further don't want to break
> backward compatibility with older kas versions of the isar examples.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md                       | 20 +++++
>  doc/user_manual.md                            |  2 +
>  meta/classes-global/base.bbclass              | 86 ++++++++++++++++++-
>  meta/classes-recipe/deb-dl-dir.bbclass        |  7 +-
>  meta/classes-recipe/dpkg-base.bbclass         | 22 ++++-
>  meta/classes-recipe/dpkg.bbclass              | 17 ++--
>  .../image-locales-extension.bbclass           |  9 +-
>  .../image-tools-extension.bbclass             | 84 ++++++++++++++++++
>  meta/classes-recipe/image.bbclass             |  7 +-
>  .../imagetypes_container.bbclass              |  4 +-
>  meta/classes-recipe/imagetypes_wic.bbclass    |  6 +-
>  meta/classes-recipe/rootfs.bbclass            | 45 ++++++++--
>  meta/classes-recipe/sbuild.bbclass            | 24 +++++-
>  meta/classes-recipe/sdk.bbclass               | 10 ++-
>  meta/conf/bitbake.conf                        |  7 +-
>  .../isar-mmdebstrap/isar-mmdebstrap.inc       | 18 ++--
>  .../sbuild-chroot/sbuild-chroot.inc           | 24 +++++-
>  17 files changed, 354 insertions(+), 38 deletions(-)
> 

[snip]

>  
>  ROOTFS_INSTALL_COMMAND += "rootfs_install_resolvconf"
> @@ -368,8 +388,13 @@ rootfs_install_pkgs_install[weight] = "8000"
>  rootfs_install_pkgs_install[progress] = "custom:rootfs_progress.PkgsInstallProgressHandler"
>  rootfs_install_pkgs_install[network] = "${TASK_USE_SUDO}"
>  rootfs_install_pkgs_install() {
> -    run_in_chroot "${ROOTFSDIR}" \
> +    run_privileged_heredoc <<'EOF'
> +    set -e
> +    ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''}
> +    find ${ROOTFSDIR}/isar-apt
       ^
This is a debugging leftover. Will be removed on next iteration.

Are there any further findings I should fix before sending?

Best regards,
Felix


-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/99b3c876bd27c5f7b2c895e3eb7a4e42bf7940e5.camel%40siemens.com.