Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable

["'Ulrich Teichert' via isar-users" <isar-users@googlegroups.com>]

Hi,

>From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com>
>Sent: Thursday, 10 September 2026 16:43
>To: isar-users@googlegroups.com
>Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky
>Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
>
>When using mmdebstrap with the unshare backend, all parent directories
>of the TMPDIR must be world executable. This requirement is documented

<nitpick on> you mean that all parent directories need to be world searchable,
by setting the S_IXOTH access bit, right?

>in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
>colorful ways.
>
>To indicate what is wrong, we add a check to the isar-check-rootless
>script.
>
>Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
>Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>---
>PS: The corresponding kas patch is here:
>https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY
>
> scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
> 1 file changed, 33 insertions(+)
>
>diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
>index b5197111..de96aac7 100755
>--- a/scripts/isar-check-rootless
>+++ b/scripts/isar-check-rootless
>@@ -20,6 +20,35 @@ fi
>
> [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
>
>+if ! tmpdir=$( \
>+       BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
>+       ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
>+       echo "error: cannot determine TMPDIR from BitBake" >&2
>+       exit 1
>+fi
>+
>+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
>+
>+failed=0
>+fail() {
>+       echo "error: $1" >&2
>+       echo "       likely cause: $2" >&2
>+       failed=1
>+}
>+
>+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
>+# subordinate user. That user can only reach it if every ancestor of TMPDIR is
>+# world-executable (see mmdebstrap(1), TMPDIR).

Same nitpick remark here

>+dir=$tmpdir
>+while [ "$dir" != "/" ]; do
>+       if [ -e "$dir" ] && \
>+          [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
>+               fail "'$dir' is not world-executable" \

and here

>+                       "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
>+       fi
>+       dir=$(dirname "$dir")
>+done
>+
> if ! ${run_privileged_cmd} /bin/sh <<'EOF'
>        failed=0
>
>@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
>        exit "$failed"
> EOF
> then
>+       failed=1
>+fi
>+
>+if [ "$failed" != 0 ]; then
>        echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
>        exit 1
> fi
>--
>2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS4PR08MB7455B64FA1D9720033122A57C3BF2%40AS4PR08MB7455.eurprd08.prod.outlook.com.