[PATCH 1/1] isar-check-rootless: check parent dirs are world executable

[PATCH 1/1] isar-check-rootless: check parent dirs are world executable

['Felix Moessbauer' via isar-users]

When using mmdebstrap with the unshare backend, all parent directories
of the TMPDIR must be world executable. This requirement is documented
in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
colorful ways.

To indicate what is wrong, we add a check to the isar-check-rootless
script.

Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
PS: The corresponding kas patch is here:
https://groups.google.com/g/kas-devel/c/PZihYBAmlCQ/m/tXkK0P77BAAJ

 scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
index b5197111..de96aac7 100755
--- a/scripts/isar-check-rootless
+++ b/scripts/isar-check-rootless
@@ -20,6 +20,35 @@ fi
 
 [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
 
+if ! tmpdir=$( \
+	BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
+	ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
+	echo "error: cannot determine TMPDIR from BitBake" >&2
+	exit 1
+fi
+
+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
+
+failed=0
+fail() {
+	echo "error: $1" >&2
+	echo "       likely cause: $2" >&2
+	failed=1
+}
+
+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
+# subordinate user. That user can only reach it if every ancestor of TMPDIR is
+# world-executable (see mmdebstrap(1), TMPDIR).
+dir=$tmpdir
+while [ "$dir" != "/" ]; do
+	if [ -e "$dir" ] && \
+	   [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
+		fail "'$dir' is not world-executable" \
+			"a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
+	fi
+	dir=$(dirname "$dir")
+done
+
 if ! ${run_privileged_cmd} /bin/sh <<'EOF'
 	failed=0
 
@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
 	exit "$failed"
 EOF
 then
+	failed=1
+fi
+
+if [ "$failed" != 0 ]; then
 	echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
 	exit 1
 fi
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260910144327.775731-1-felix.moessbauer%40siemens.com.

Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable

['Ulrich Teichert' via isar-users]

Hi,

>From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com>
>Sent: Thursday, 10 September 2026 16:43
>To: isar-users@googlegroups.com
>Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky
>Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
>
>When using mmdebstrap with the unshare backend, all parent directories
>of the TMPDIR must be world executable. This requirement is documented

<nitpick on> you mean that all parent directories need to be world searchable,
by setting the S_IXOTH access bit, right?

>in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
>colorful ways.
>
>To indicate what is wrong, we add a check to the isar-check-rootless
>script.
>
>Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
>Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>---
>PS: The corresponding kas patch is here:
>https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY
>
> scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
> 1 file changed, 33 insertions(+)
>
>diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
>index b5197111..de96aac7 100755
>--- a/scripts/isar-check-rootless
>+++ b/scripts/isar-check-rootless
>@@ -20,6 +20,35 @@ fi
>
> [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
>
>+if ! tmpdir=$( \
>+       BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
>+       ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
>+       echo "error: cannot determine TMPDIR from BitBake" >&2
>+       exit 1
>+fi
>+
>+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
>+
>+failed=0
>+fail() {
>+       echo "error: $1" >&2
>+       echo "       likely cause: $2" >&2
>+       failed=1
>+}
>+
>+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
>+# subordinate user. That user can only reach it if every ancestor of TMPDIR is
>+# world-executable (see mmdebstrap(1), TMPDIR).

Same nitpick remark here

>+dir=$tmpdir
>+while [ "$dir" != "/" ]; do
>+       if [ -e "$dir" ] && \
>+          [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
>+               fail "'$dir' is not world-executable" \

and here

>+                       "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
>+       fi
>+       dir=$(dirname "$dir")
>+done
>+
> if ! ${run_privileged_cmd} /bin/sh <<'EOF'
>        failed=0
>
>@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
>        exit "$failed"
> EOF
> then
>+       failed=1
>+fi
>+
>+if [ "$failed" != 0 ]; then
>        echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
>        exit 1
> fi
>--
>2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS4PR08MB7455B64FA1D9720033122A57C3BF2%40AS4PR08MB7455.eurprd08.prod.outlook.com.

Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable

['MOESSBAUER, Felix' via isar-users]

On Thu, 2026-09-10 at 15:17 +0000, Ulrich Teichert wrote:
> Hi,
> 
> > From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com>
> > Sent: Thursday, 10 September 2026 16:43
> > To: isar-users@googlegroups.com
> > Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky
> > Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
> > 
> > When using mmdebstrap with the unshare backend, all parent directories
> > of the TMPDIR must be world executable. This requirement is documented
> 
> <nitpick on> you mean that all parent directories need to be world searchable,
> by setting the S_IXOTH access bit, right?

Hi, thanks for the review. Yes, that's right. However, then we diverge
from the terminology that is used by mmdebstrap, which is:

If  you set "TMPDIR" in unshare mode, then the unshared user must be
able to access the directory. This means that the directory itself must
be world-writable and all its ancestors must be at least world-
executable.

> 
> > in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
> > colorful ways.
> > 
> > To indicate what is wrong, we add a check to the isar-check-rootless
> > script.
> > 
> > Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > ---
> > PS: The corresponding kas patch is here:
> > https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY
> > 
> > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
> > 1 file changed, 33 insertions(+)
> > 
> > diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
> > index b5197111..de96aac7 100755
> > --- a/scripts/isar-check-rootless
> > +++ b/scripts/isar-check-rootless
> > @@ -20,6 +20,35 @@ fi
> > 
> > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
> > 
> > +if ! tmpdir=$( \
> > +       BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
> > +       ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
> > +       echo "error: cannot determine TMPDIR from BitBake" >&2
> > +       exit 1
> > +fi
> > +
> > +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
> > +
> > +failed=0
> > +fail() {
> > +       echo "error: $1" >&2
> > +       echo "       likely cause: $2" >&2
> > +       failed=1
> > +}
> > +
> > +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
> > +# subordinate user. That user can only reach it if every ancestor of TMPDIR is
> > +# world-executable (see mmdebstrap(1), TMPDIR).
> 
> Same nitpick remark here
> 
> > +dir=$tmpdir
> > +while [ "$dir" != "/" ]; do
> > +       if [ -e "$dir" ] && \
> > +          [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
> > +               fail "'$dir' is not world-executable" \
> 
> and here

If there are no objections, I would just change to "searchable" instead
of executable, despite the mmdebstrap manpage explicitly states
executable.

Still, test reports if that actually works on other machines would be
great :)

Felix

> 
> > +                       "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
> > +       fi
> > +       dir=$(dirname "$dir")
> > +done
> > +
> > if ! ${run_privileged_cmd} /bin/sh <<'EOF'
> >        failed=0
> > 
> > @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
> >        exit "$failed"
> > EOF
> > then
> > +       failed=1
> > +fi
> > +
> > +if [ "$failed" != 0 ]; then
> >        echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
> >        exit 1
> > fi
> > --
> > 2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/d359972024ec1136965773f4948adf13a3d1ec94.camel%40siemens.com.