From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 22 Jun 2026 10:06:59 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-ed1-f62.google.com (mail-ed1-f62.google.com [209.85.208.62]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65M86xrF018571 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 22 Jun 2026 10:06:59 +0200 Received: by mail-ed1-f62.google.com with SMTP id 4fb4d7f45d1cf-695b677095esf4140273a12.0 for ; Mon, 22 Jun 2026 01:06:59 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1782115613; cv=pass; d=google.com; s=arc-20240605; b=HrIzF5a4qAYiJg3D3LCfpJGnSzt/fPMcdpUqXMh4+3jqz5WmG02901Rk8yApQDhwW8 8sZmyCLjmtC6vvQnwNNROF6ZXj10mHAL3wSrGfGtkC7dnRtTYS3yBSPiqeN0dVg8Z3Qk zU06jnqQtqoph2/FH2lDe1oBReTVHOsFLaVAYtBuKGJ1eFXm5Xh4b2RwIRQLsoOLN+F6 JNyvodqQjej+Zp786ay02eIFxa9fq3ZQP45HSa8JILfdw7w6NZiKkEVMBFLu+5Ss0YsD IC49Dd4QNjew8wBtrMDeJFkITk8bTu3xpR60I4G3lq5C11fDZdfc7PD7l7z7nln8KsBc neBg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=7jTg2JN+C0NM3W2QWu2pt9eGe618iPlyzdjkTuBfofM=; fh=zdjIbU9PaeOV9Zed57C9tZpIFkgxZPB3LgBQwUrvpfQ=; b=CJCJguYGFOm+ZiYjHJGl8ntLHBWXbUjoblX75yd2f9bfArasP9noa+8mnBnljf/uT7 uMiMALI84H6VVLZPh7SCRo/Nu7QMUiWGCUUpGiUt4NBZU+0sP8R7lPDlZphkLFiXsXC2 zJEw2B4I2xCiRQGaXnC3IEdlHt5BY6rJ8Nsi4jAz+AjUI1++b7kSR+pEcR1wtB2YLqiT 9JyklTfSWffUZ5H3huWcb5uAGn0JPmsipjOhbfU9SOPING5TarCTpOB+S+yr12Rb1qWP sRrA8FvE61k1drqN+X7WGy1wBBPxS3n6VMSkIrDIFWts6iS6UP3WBRR3/MUfmCfydPuh Azgg==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782115613; x=1782720413; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:in-reply-to:from:content-language:references:cc :to:subject:user-agent:mime-version:date:message-id:sender:from:to :cc:subject:date:message-id:reply-to; bh=7jTg2JN+C0NM3W2QWu2pt9eGe618iPlyzdjkTuBfofM=; b=u0Cqf36EqiI7HTLGc7/Xz3G54S85LATnyz7aKDNxfvrUR/WHqvX//gokX/J7Cq3p9K UIQBQ7B4XdeIlIQM2Ciz342KK1+sEZ7peG6rTZgyvdfGhSYAQ/6bQlDdeb+g1wh5lfDN aR2QQ2X6KkkXJJlw8MHd9qB4FsXpoPeIlGOaOCmcCIQQ9VAKsvZDfgASJdXb6YE1h7kh x49do6L76IC1M5/SPG8Sfk5tri66C6yV2CEYyhUb96oOuSXMbqBuKQYaJ/9Oz075nFsl sVjf3ATiWTQ7pHsratjAZebesJ0V21e/eXZyeQOSAP2Crxt1Y3DxOAjzLxzyH+YppQJP qGpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782115613; x=1782720413; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:in-reply-to :from:content-language:references:cc:to:subject:user-agent :mime-version:date:message-id:x-beenthere:x-gm-message-state:sender :from:to:cc:subject:date:message-id:reply-to; bh=7jTg2JN+C0NM3W2QWu2pt9eGe618iPlyzdjkTuBfofM=; b=pX2tGytlbuJI/GERJd5y9C3m71u4PbLzkuWR+4PQc8P9g5FXpa/xFxE/zrZrjGkpqI LWji3bkIaN0cb9Aagi2aUBgUUKZYfbFzLhMntYFw3fJR5ln3HX8rm/k9YMiGEv8VxYiy TVRmnB/GLPVwdWj4ALbL0Go5AexJEsJj5reCgdMhgIDZKTz5RTIjyCZAigu5UBZFzkRv GwtvB29UT4TLMyMvJA1+jd12e5snl73/KX19nOVjEOtKxsBNAAOlAKIr3GgS+GMcRvNK pe5+ZXh7wFYR5iw4cUW1q0R8Ny8scVXoimtA6Ccs3yECtTrLBK+l5u9/f63Ad3nHHXXA hedQ== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ+h/FOUQ58OD9f6aYuQaOnCM0EgLYIZhD5UeuTqlDSOh8bkKzL9BJB6Nk9UDjVie9BTN/KY@ilbers.de X-Gm-Message-State: AOJu0YzBZtk7bQxaS6saGo9KQsyTzwKPTzSvQLX4NJNt96yF5Emg88xG 3/i0gDOn8G+9KgDaPoni2zPGcUcNeg/0vCi8Lu6InMv68H5FeqQwvsgu X-Received: by 2002:a17:907:e143:b0:c0e:e175:65a7 with SMTP id a640c23a62f3a-c0ee17588admr72598666b.3.1782115613269; Mon, 22 Jun 2026 01:06:53 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUdCmHo/dBI2jmhZuSBN9LpyATss1hCw2cs+eBUwsQRXqA==" Received: by 2002:a05:6402:2402:b0:672:f72:23ae with SMTP id 4fb4d7f45d1cf-695bb6d8092ls4694621a12.1.-pod-prod-03-eu; Mon, 22 Jun 2026 01:06:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ8ADu2wREHqRif6IutLGOOYt4cQpFRegmbn+BYfWgP1sHL92IS/YxwFhXUplHCfWKsIrnfewHFk7W9f@googlegroups.com X-Received: by 2002:a17:906:6a07:b0:bfe:7f45:44d7 with SMTP id a640c23a62f3a-c0b74989edemr569350766b.47.1782115610517; Mon, 22 Jun 2026 01:06:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782115610; cv=none; d=google.com; s=arc-20260327; b=axGq1xwlgJ4fTHxzkDSfju+FyhLi4iXjwhbxmFk0qm1qC+/LtKtefwSDnmzttbUVEJ qDFvq6AYMtP3ojF+YO2sghsFwR67tNnESJ7QVdKwXN7vBqysZd/J2UJxKazU5bpeRaN2 khJs1wzj2cKuKZkFQ/pyI2nXBDUBZY3YFdeKAaXgGkgeL9zcLzf0YfOu7afRHAueIssn X4Z1PrBgR+lSvsYgMdjRxaVuLDJ4dGHvi2Vn9W7uBP0P0d0IKkgMXg5lB/iW2Yof7jRY W6uVzXtvpnV2OMbe2hN9aMTrqRNYXT/Qe/ea53/LDMj7rIPQIeR7s6f6dVNEa4U3IMvD 4UHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=ZD9yWuXYav9j+sTi2Bx4zCLch+vIuU1Ceq5/UOW7JFA=; fh=snPUeFaciPd44DGD7CKIfMxKy9UIWquFtZirq2e+a3E=; b=YdqDH3vw6SX59MtWtnrIBM/GSWaKn2EldnEWP20RHzfC3k4v5Tgz+ZXFm73c5LsxrM 5qwR5W53srBE+i6Z+2gMEhP3EsGNuv73gBWPYXZve24fGZfAjn+9D4rLCePPkWLlabyc 5ikm2gBQ+yHmsObc75oqONrwY4yqp+QePBn4Af+3fac3A9nwoo/L5iOAWTlTCWcQCGOw +8/XUayugDhPanIr84+a1JmcrGGiHQT29egAy3zHOxBO73k/VYpBtvHfSIw49XI5tM9T 2fp/1Xe4gNRegIq/ZRk607yS3qjaKNlaYwwKFJm+A7sjkc10nWJiu+/Nk7DKIFYL06pc O7Vg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id a640c23a62f3a-c0c5b2ffd34si15631866b.0.2026.06.22.01.06.50 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 22 Jun 2026 01:06:50 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.148] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 65M86n3F018558 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 22 Jun 2026 10:06:49 +0200 Message-ID: Date: Mon, 22 Jun 2026 10:06:49 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v6 00/17] add support to build isar unprivileged To: "MOESSBAUER, Felix" , "isar-users@googlegroups.com" Cc: "Kiszka, Jan" , "Gylstorff, Quirin" References: <20260615092458.259691-1-felix.moessbauer@siemens.com> <4365217a-491e-4b9c-9a8f-f9c92ce6bcda@ilbers.de> Content-Language: en-US From: Zhihang Wei In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: oi70okCdjjnK On 6/19/26 12:13, MOESSBAUER, Felix wrote: > On Fri, 2026-06-19 at 11:00 +0200, Zhihang Wei wrote: >> On 6/15/26 11:24, 'Felix Moessbauer' via isar-users wrote: >>> Dear isar-users, >>> >>> currently isar requires password-less sudo and an environment >>> where mounting file systems is possible. This has proven problematic >>> for security reasons, both when running in a privileged container or >>> locally. >>> >>> To solve this, we implement fully rootless builds that rely on the >>> unshare syscall which allows us to avoid sudo and instead operate in >>> temporary kernel namespaces as a user that is just privileged within >>> that namespace. This comes with some challenges regarding the handling >>> of mounts (they are cleared when leaving the namespace), as well as >>> cross namespace deployments (the outer user might not be able to access >>> the inner data). For that, we rework the handling of mounts and artifact >>> passing to make it compatible with both chroot modes (schroot and >>> unshare). >>> >>> Note, that this series can be tested on a custom kas-container build >>> provided in [1]. Hints how to migrate downstream layers are provided >>> in the API changelog. >>> >>> Changes since PATCH v5: >>> >>> - rebased onto next >>> - adjust to changes from "Rootfs install race fix for isar-apt packages": >>> Manually add isar-apt mount in rootfs_install_pkgs_isar_download on >>> rootless >>> - adjust to changes in "image-postproc: gate systemd preset-all on masked >>> unit state": Trivial change to use run_in_chroot instead of sudo chroot. >>> >> Hi, >> >> I found an issue when testing in rootless mode. >> >> The test was run using a test-container with a customized kas container >> built on 25307f7. >> >> The following test case fails: >> testsuite/citest.py:NoCrossTest.test_nocross >> when building 'mc:qemumipsel-bookworm:isar-image-ci' in nocross mode. >> >> Logs follow: >> [stdlog] 2026-06-19 09:30:44,290 avocado.app cibuilder L0347 ERROR| >> ERROR: mc:qemumipsel-bookworm:isar-mmdebstrap-target-1.0-r0 >> do_bootstrap: >> ExecutionError('/isar/build/tmp/work/debian-bookworm-mipsel/isar-mmdebstrap-target/1.0-r0/temp/run.do_bootstrap.2096', >> 25, None, None) >> [stdlog] 2026-06-19 09:30:44,290 avocado.app cibuilder L0347 ERROR| >> ERROR: Logfile of failure stored in: >> /isar/build/tmp/work/debian-bookworm-mipsel/isar-mmdebstrap-target/1.0-r0/temp/log.do_bootstrap.2096 >> >> DEBUG: Executing python function sstate_task_prefunc >> DEBUG: Python function sstate_task_prefunc finished >> DEBUG: Executing shell function do_bootstrap >> removed >> '/isar/build/tmp/work/debian-bookworm-mipsel/isar-mmdebstrap-target/1.0-r0/sources.list.d/bootstrap.list' >> '/isar/build/tmp/work/debian-bookworm-mipsel/isar-mmdebstrap-target/1.0-r0/apt-sources' >> -> >> '/isar/build/tmp/work/debian-bookworm-mipsel/isar-mmdebstrap-target/1.0-r0/sources.list.d/bootstrap.list' >> W: binfmt_misc not found in /proc/mounts -- not mounted? >> W: cannot find update-binfmts >> E: mipsel can neither be executed natively nor via qemu user emulation >> with binfmt_misc > I just tested this, but cannot reproduce. My build correctly passes in > rootless mode. To me, it looks like your container is started in > rootless mode, but the avocado executes the build in privileged mode > (missing the ISAR_ROOTLESS = 1 flag, which is set by setting -p > rootless=1). > >> When testing them directly in rootful mode, we have an EXT4 filesystem >> error also when running no_cross, but not known yet which target. Also >> not sure whether it's related. Let me check and get back to you. > Let me know once you identified the target. > > Felix Hi, The EXT4 filesystem error in rootful mode is not related to this patch. It's a CI server issue. Please ignore this part. Zhihang -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/c04db4e1-ed71-439b-a536-d1fc4aa68435%40ilbers.de.