From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 25 Jun 2026 16:40:08 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wm1-f55.google.com (mail-wm1-f55.google.com [209.85.128.55]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65PEe7YO003794 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 25 Jun 2026 16:40:07 +0200 Received: by mail-wm1-f55.google.com with SMTP id 5b1f17b1804b1-490bae3a39bsf18962085e9.1 for ; Thu, 25 Jun 2026 07:40:07 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1782398402; cv=pass; d=google.com; s=arc-20260327; b=Y8YDAe2ukkYuZINp5MGYHcQ4NCmTYO3LAOFTVg3N7vIfuHhSl0ISYbnbJkyhqeq/qH PuPqvMztGybwEBKCFB2UBS140Q5O0L1RxATD015uqCqly7g1YDGmOS+ZQiPc6lK28TG8 xbnMi3UNdhvTFSld59hBexLyxV3joDofwkrSMxd5vxBGTWJSw9LX9SB6SUtqzFBZd0s/ mpN8gMOt68Rt4hc+sJRvCK7QjF3pUmJcHBn//JlK5LQLwlQ86HrF6D+jJl2zxA7gEvFY 0TsMz9OxbKvLPi2ONrGIIp958fkz1WNUUX22Hmf6bnxcjP13sOmsP7XwjdPty5+OiBvg 72tw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=2/DtkoXxt6iD3c2j4IlmFNUXpcTG1xr9+dNEcGN2nrw=; fh=7Xxh/fdzSmdl95E0JzDRrKcSKWC5S8xOp1N1JfIwIoU=; b=qs+LiGllRrIWugjEb4wcGRDiX93uf4eDXhjl6uKMc8+Kp8YWWjotJwGJDo25OytsQF +4chwv5PlsvZnmwX7X0af+b6hCNwJVLVz9ROItsqE1V5ZMzyua/gbRGj3R2FtJszfYPx ImgFKxNeplD5XplVLk5NL/DAx5viWPJjvVlgHsUtcUSCIvvoqf235csrZESEcoYOcu+B 6NuRCtjYivn6ja1ESZadcmzh6gI56a2PTYx/xQZTKIZ6WTtSPZJ3hZcR7IDK7+P6g+5l 6U+yFGB0In+JBeOrXvaiL7R85ov5Yo9uRBb43BKO0WRECBA2aN259OK9/y/qqc+ZuZtw gsQw==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782398402; x=1783003202; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:in-reply-to:from:content-language:references:cc :to:subject:user-agent:mime-version:date:message-id:sender:from:to :cc:subject:date:message-id:reply-to; bh=2/DtkoXxt6iD3c2j4IlmFNUXpcTG1xr9+dNEcGN2nrw=; b=khSk9DJPRjGXD2aYF7yUPeYN/FN3ErqN2tWwoRLQSTX7FoFZYze91E/RqIymk1eBq6 0k4eyKDT1U7X7PMT9u6ZZJ/33hxXWsZF/kX3nfLoqFcSffYSQRfLs+LjP9UXfXLCQJxo eFml74bwLBIkg7ifEllGXIL4I9z4xug2axrW6EYMC/I7RF0TPF+y0Q95U7ilK69Y6RQz XKro7TzYy3xwWaPwgVDz6d3Zgkoi7/b6yG9l2sxM4ME4iTA/VyJKPVaBnTzEn5RcKgrR W8FXVFxkYLiqX92JpKBRM9Ky9IPoFergkd7+lLd1+BQKD4QQV/kMIOjqxjeYB7yJ2+7q MraQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782398402; x=1783003202; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:in-reply-to :from:content-language:references:cc:to:subject:user-agent :mime-version:date:message-id:x-beenthere:x-gm-message-state:sender :from:to:cc:subject:date:message-id:reply-to; bh=2/DtkoXxt6iD3c2j4IlmFNUXpcTG1xr9+dNEcGN2nrw=; b=YaYrC2YmkPLrCKKVkB94uusczAin16v1hNjtGTZZpkX/LWVOvMxwx4qzUR+5iMm8YT luI8qatsn02YDmJLEIXwN97Q7y8mlg7CeJqAkrPnpmeoX6uYdLaSV5aSlKSuS0mPJ4QI qqpO0PkG17BdstnxsJCbVEN2PHTijGdV2j6w7nVwwXJBXQURRfuGhd5rENCf1qZFjTeq X0Z6x5jAdF2LoS+OALa/HbATCq+EE7ukkTGvIMhvhNBLobPmyLKHMR3jA5t8GwNfiSrn V8YVMQc5DeOcVPBQG/tdkP9GNz1mUA/tEv2yYHXtEnB3P9WXBDCr/pn6atiL5hrxsU2U 2cww== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ9xDTYik5UFy78vdIoEf6kb4uBs+Ldd9IWDWDN4FtXIB5wGj1Tm/hcNDn07m39YY3TYq9P3@ilbers.de X-Gm-Message-State: AOJu0YzXGXBt9GbIJMfI/pfZk73WCSjlFMPDU61fRk6VYkI2pW8zh9QS XodW3BERNSs2i0qPbisC1sG55FNmp368GDL+iRbFeG7xM2zoeDXIXl7T X-Received: by 2002:a05:600d:6446:20b0:491:ba04:2ce4 with SMTP id 5b1f17b1804b1-49266872d6cmr32186295e9.16.1782398402103; Thu, 25 Jun 2026 07:40:02 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUfRfCRpO1km/e+Ko6Vo1WlKLqNnrvnhSo0FhDT+MOUqMg==" Received: by 2002:a05:600c:1d16:b0:490:6b4f:82f8 with SMTP id 5b1f17b1804b1-49237da55a7ls69827045e9.0.-pod-prod-02-eu; Thu, 25 Jun 2026 07:39:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ9ug/x6UXvuUFtx6FW9kpfZFrU+i1E2bkBm90tw/Lh2TQ/YrTt8Nr6G+fEMOYFAWe6CVY2DM8HoViec@googlegroups.com X-Received: by 2002:a7b:ce93:0:b0:491:91cc:d12d with SMTP id 5b1f17b1804b1-4926689998amr30787635e9.25.1782398399458; Thu, 25 Jun 2026 07:39:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782398399; cv=none; d=google.com; s=arc-20260327; b=TwaEZyWHIlpjMhzP7c8+TT4xXBBYGtkbxIrDUPxKFJQ9YziaNCAlbdOJ1IXx0JwJkf EXzOJjDNmxdyHcErnd5WZ2YJQkl+sSJWiM6chh8M8ehvtTH54XDs5ZVi2DnTMhJpgN5m aJLeUUxKZnA3Ln96OTILhhoAD7YkMtI19p5bF9SKKGI7hNUMWYxAmpb9qnOQqb/PZmX7 cWAGe1DxZ7lvD0/ldf53u54D2TaCN5ktjKnNq2Dc08GZixShNNCp7+nOUTlSHIfq+6e8 Z8iX7r4IUWvkBQZNbRRDn/elMXfWXCF0tmpVJROuQNg0RXe5G2aKyYdAwBpHXtyNG0rH fUug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=9DYSwtxGXhTkBbLQvsdI9GqTbuGyXfWxuI4RQCjG/Js=; fh=snPUeFaciPd44DGD7CKIfMxKy9UIWquFtZirq2e+a3E=; b=ptoHGWce4e+9Jf76QJhTageysec31FvxI4LTg5CtUO6bmMp38cX/zaBGb6POlYQ0qj YS/uPZd8Euo2nl05mItYYuEx5Hi+zFC0HaRIPomzd/JU97CdrYeqhjq1eo5oKFAVKG76 n/z8tzcTVnpiR/vm2S27EWENsdqRkuQwIH+hWqOrWdRJZ25UUMZHQ5mhJmV34UAFQRW5 LcNF9R/uteoM2GyZtTOc+xSqewsoL0W3g4HCZ9HmyFAecymdP+6Ij59rRl82GSAqTKVj EwrlTAJlz8XV1d6M3hjqMS0ZKg7mRKkkDUsBPotYDuHcRpgruIcDH10FIcOnM4ZAIFSe 1Fqw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id ffacd0b85a97d-46c20cc21a0si118964f8f.6.2026.06.25.07.39.59 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 25 Jun 2026 07:39:59 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.148] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 65PEdwj2003765 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 25 Jun 2026 16:39:58 +0200 Message-ID: Date: Thu, 25 Jun 2026 16:39:58 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v6 00/17] add support to build isar unprivileged To: "MOESSBAUER, Felix" , "isar-users@googlegroups.com" Cc: "Kiszka, Jan" , "Gylstorff, Quirin" References: <20260615092458.259691-1-felix.moessbauer@siemens.com> <8b64ce39d3096fd3399056ae2aabf36d763ba88c.camel@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: wPuziUXvkGH0 On 6/25/26 15:27, MOESSBAUER, Felix wrote: > On Thu, 2026-06-25 at 14:58 +0200, Zhihang Wei wrote: >> On 6/25/26 10:59, MOESSBAUER, Felix wrote: >>> On Mon, 2026-06-15 at 11:24 +0200, Felix Moessbauer wrote: >>>> Dear isar-users, >>>> >>>> currently isar requires password-less sudo and an environment >>>> where mounting file systems is possible. This has proven problematic >>>> for security reasons, both when running in a privileged container or >>>> locally. >>>> >>>> To solve this, we implement fully rootless builds that rely on the >>>> unshare syscall which allows us to avoid sudo and instead operate in >>>> temporary kernel namespaces as a user that is just privileged within >>>> that namespace. This comes with some challenges regarding the handling >>>> of mounts (they are cleared when leaving the namespace), as well as >>>> cross namespace deployments (the outer user might not be able to access >>>> the inner data). For that, we rework the handling of mounts and artifact >>>> passing to make it compatible with both chroot modes (schroot and >>>> unshare). >>> Hi, >>> >>> are there any news on this? As this series has been successfully tested >>> in privileged mode, I would like to get it merged, so subsequent >>> patches already can use the run_privileged helpers. >>> >>> Cleanups and improvements still can be done later on, but my fear is >>> that we will get a lot of back-and-forth between sudo and >>> run_privileged if not merged. >>> >>> I also have some patches regarding the rootfs_postprocess idempotency >>> issues in my pipeline which also depend on the run_privileged wrappers. >>> >> Hi, >> >> We are currently integrating rootless build testing into our CI pipeline. We >> need to ensure that future patches do not break rootless build. > Hi, sounds good! > > I have an improvement for p10 which avoids the emulation of apt in > rootfs_install_pkgs_download, which I would fold in in case a v7 of > this series is needed (or if you want something to test your > infrastructure). > > Otherwise this can also be added later on as a standalone patch. Just > let me know. > > Best regards, > Felix > Then it's better to send v7. I'll take the chance to test it on the infrastructure once it's done. Zhihang -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/c1cbf111-464c-48dd-bbfe-c9914f015138%40ilbers.de.