Re: [PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

["'Ulrich Teichert' via isar-users" <isar-users@googlegroups.com>]

Hi Felix,

>Bubblewrap 0.12.0 is a security release that contains hardenings
>regarding the handling of symlinks. This breaks the rootfs_cmd helper,
>which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
>(and alike).
>
>From debian bookworm on, /bin (and alike) are just symlinks to the
>corresponding dirs below /usr. In this case, we only need to mount /usr.
>On earlier versions, we need to mount the /bin (and alike) dirs as well.
>
>Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>

Thanks for fixing!

Tested-by: Ulrich Teichert <ulrich.teichert@ebs-group.io>

>---
> meta/classes-recipe/rootfs.bbclass | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
>index 8d394b05..0bef2d45 100644
>--- a/meta/classes-recipe/rootfs.bbclass
>+++ b/meta/classes-recipe/rootfs.bbclass
>@@ -142,8 +142,9 @@ rootfs_cmd() {
>     fi
>     shift  # remove "--", command and its arguments follows
>
>+    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
>     for ro_d in bin etc lib lib64 sys usr var; do
>-        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
>+        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
>         bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
>     done
>
>--
>2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/DB9PR08MB7448B7CDA5EB6138D1A3D43FC3A92%40DB9PR08MB7448.eurprd08.prod.outlook.com.