* [PATCH 1/1] isar-check-rootless: check parent dirs are world executable @ 2026-09-10 14:43 'Felix Moessbauer' via isar-users 2026-09-10 15:17 ` 'Ulrich Teichert' via isar-users 0 siblings, 1 reply; 3+ messages in thread From: 'Felix Moessbauer' via isar-users @ 2026-09-10 14:43 UTC (permalink / raw) To: isar-users; +Cc: jan.kiszka, Felix Moessbauer, Clara Kowalsky When using mmdebstrap with the unshare backend, all parent directories of the TMPDIR must be world executable. This requirement is documented in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in colorful ways. To indicate what is wrong, we add a check to the isar-check-rootless script. Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> --- PS: The corresponding kas patch is here: https://groups.google.com/g/kas-devel/c/PZihYBAmlCQ/m/tXkK0P77BAAJ scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless index b5197111..de96aac7 100755 --- a/scripts/isar-check-rootless +++ b/scripts/isar-check-rootless @@ -20,6 +20,35 @@ fi [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 +if ! tmpdir=$( \ + BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ + ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then + echo "error: cannot determine TMPDIR from BitBake" >&2 + exit 1 +fi + +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 + +failed=0 +fail() { + echo "error: $1" >&2 + echo " likely cause: $2" >&2 + failed=1 +} + +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a +# subordinate user. That user can only reach it if every ancestor of TMPDIR is +# world-executable (see mmdebstrap(1), TMPDIR). +dir=$tmpdir +while [ "$dir" != "/" ]; do + if [ -e "$dir" ] && \ + [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then + fail "'$dir' is not world-executable" \ + "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" + fi + dir=$(dirname "$dir") +done + if ! ${run_privileged_cmd} /bin/sh <<'EOF' failed=0 @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' exit "$failed" EOF then + failed=1 +fi + +if [ "$failed" != 0 ]; then echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 exit 1 fi -- 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260910144327.775731-1-felix.moessbauer%40siemens.com. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable 2026-09-10 14:43 [PATCH 1/1] isar-check-rootless: check parent dirs are world executable 'Felix Moessbauer' via isar-users @ 2026-09-10 15:17 ` 'Ulrich Teichert' via isar-users 2026-09-10 15:58 ` 'MOESSBAUER, Felix' via isar-users 0 siblings, 1 reply; 3+ messages in thread From: 'Ulrich Teichert' via isar-users @ 2026-09-10 15:17 UTC (permalink / raw) To: isar-users, Felix Moessbauer; +Cc: jan.kiszka, Clara Kowalsky Hi, >From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com> >Sent: Thursday, 10 September 2026 16:43 >To: isar-users@googlegroups.com >Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky >Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable > >When using mmdebstrap with the unshare backend, all parent directories >of the TMPDIR must be world executable. This requirement is documented <nitpick on> you mean that all parent directories need to be world searchable, by setting the S_IXOTH access bit, right? >in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in >colorful ways. > >To indicate what is wrong, we add a check to the isar-check-rootless >script. > >Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> >Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> >--- >PS: The corresponding kas patch is here: >https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY > > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ > 1 file changed, 33 insertions(+) > >diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless >index b5197111..de96aac7 100755 >--- a/scripts/isar-check-rootless >+++ b/scripts/isar-check-rootless >@@ -20,6 +20,35 @@ fi > > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 > >+if ! tmpdir=$( \ >+ BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ >+ ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then >+ echo "error: cannot determine TMPDIR from BitBake" >&2 >+ exit 1 >+fi >+ >+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 >+ >+failed=0 >+fail() { >+ echo "error: $1" >&2 >+ echo " likely cause: $2" >&2 >+ failed=1 >+} >+ >+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a >+# subordinate user. That user can only reach it if every ancestor of TMPDIR is >+# world-executable (see mmdebstrap(1), TMPDIR). Same nitpick remark here >+dir=$tmpdir >+while [ "$dir" != "/" ]; do >+ if [ -e "$dir" ] && \ >+ [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then >+ fail "'$dir' is not world-executable" \ and here >+ "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" >+ fi >+ dir=$(dirname "$dir") >+done >+ > if ! ${run_privileged_cmd} /bin/sh <<'EOF' > failed=0 > >@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' > exit "$failed" > EOF > then >+ failed=1 >+fi >+ >+if [ "$failed" != 0 ]; then > echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 > exit 1 > fi >-- >2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS4PR08MB7455B64FA1D9720033122A57C3BF2%40AS4PR08MB7455.eurprd08.prod.outlook.com. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable 2026-09-10 15:17 ` 'Ulrich Teichert' via isar-users @ 2026-09-10 15:58 ` 'MOESSBAUER, Felix' via isar-users 0 siblings, 0 replies; 3+ messages in thread From: 'MOESSBAUER, Felix' via isar-users @ 2026-09-10 15:58 UTC (permalink / raw) To: Ulrich Teichert, isar-users; +Cc: Kiszka, Jan, Kowalsky, Clara On Thu, 2026-09-10 at 15:17 +0000, Ulrich Teichert wrote: > Hi, > > > From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com> > > Sent: Thursday, 10 September 2026 16:43 > > To: isar-users@googlegroups.com > > Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky > > Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable > > > > When using mmdebstrap with the unshare backend, all parent directories > > of the TMPDIR must be world executable. This requirement is documented > > <nitpick on> you mean that all parent directories need to be world searchable, > by setting the S_IXOTH access bit, right? Hi, thanks for the review. Yes, that's right. However, then we diverge from the terminology that is used by mmdebstrap, which is: If you set "TMPDIR" in unshare mode, then the unshared user must be able to access the directory. This means that the directory itself must be world-writable and all its ancestors must be at least world- executable. > > > in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in > > colorful ways. > > > > To indicate what is wrong, we add a check to the isar-check-rootless > > script. > > > > Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> > > --- > > PS: The corresponding kas patch is here: > > https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY > > > > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++ > > 1 file changed, 33 insertions(+) > > > > diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless > > index b5197111..de96aac7 100755 > > --- a/scripts/isar-check-rootless > > +++ b/scripts/isar-check-rootless > > @@ -20,6 +20,35 @@ fi > > > > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2 > > > > +if ! tmpdir=$( \ > > + BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \ > > + ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then > > + echo "error: cannot determine TMPDIR from BitBake" >&2 > > + exit 1 > > +fi > > + > > +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2 > > + > > +failed=0 > > +fail() { > > + echo "error: $1" >&2 > > + echo " likely cause: $2" >&2 > > + failed=1 > > +} > > + > > +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a > > +# subordinate user. That user can only reach it if every ancestor of TMPDIR is > > +# world-executable (see mmdebstrap(1), TMPDIR). > > Same nitpick remark here > > > +dir=$tmpdir > > +while [ "$dir" != "/" ]; do > > + if [ -e "$dir" ] && \ > > + [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then > > + fail "'$dir' is not world-executable" \ > > and here If there are no objections, I would just change to "searchable" instead of executable, despite the mmdebstrap manpage explicitly states executable. Still, test reports if that actually works on other machines would be great :) Felix > > > + "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR" > > + fi > > + dir=$(dirname "$dir") > > +done > > + > > if ! ${run_privileged_cmd} /bin/sh <<'EOF' > > failed=0 > > > > @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF' > > exit "$failed" > > EOF > > then > > + failed=1 > > +fi > > + > > +if [ "$failed" != 0 ]; then > > echo "error: unprivileged rootless builds are not supported; see the checks above" >&2 > > exit 1 > > fi > > -- > > 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/d359972024ec1136965773f4948adf13a3d1ec94.camel%40siemens.com. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-10 15:58 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-10 14:43 [PATCH 1/1] isar-check-rootless: check parent dirs are world executable 'Felix Moessbauer' via isar-users 2026-09-10 15:17 ` 'Ulrich Teichert' via isar-users 2026-09-10 15:58 ` 'MOESSBAUER, Felix' via isar-users
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox