Re: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2026-09-10 at 15:17 +0000, Ulrich Teichert wrote:
> Hi,
> 
> > From: 'Felix Moessbauer' via isar-users <isar-users@googlegroups.com>
> > Sent: Thursday, 10 September 2026 16:43
> > To: isar-users@googlegroups.com
> > Cc: jan.kiszka@siemens.com; Felix Moessbauer; Clara Kowalsky
> > Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
> > 
> > When using mmdebstrap with the unshare backend, all parent directories
> > of the TMPDIR must be world executable. This requirement is documented
> 
> <nitpick on> you mean that all parent directories need to be world searchable,
> by setting the S_IXOTH access bit, right?

Hi, thanks for the review. Yes, that's right. However, then we diverge
from the terminology that is used by mmdebstrap, which is:

If  you set "TMPDIR" in unshare mode, then the unshared user must be
able to access the directory. This means that the directory itself must
be world-writable and all its ancestors must be at least world-
executable.

> 
> > in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
> > colorful ways.
> > 
> > To indicate what is wrong, we add a check to the isar-check-rootless
> > script.
> > 
> > Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > ---
> > PS: The corresponding kas patch is here:
> > https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY
> > 
> > scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
> > 1 file changed, 33 insertions(+)
> > 
> > diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
> > index b5197111..de96aac7 100755
> > --- a/scripts/isar-check-rootless
> > +++ b/scripts/isar-check-rootless
> > @@ -20,6 +20,35 @@ fi
> > 
> > [ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2
> > 
> > +if ! tmpdir=$( \
> > +       BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
> > +       ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
> > +       echo "error: cannot determine TMPDIR from BitBake" >&2
> > +       exit 1
> > +fi
> > +
> > +[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
> > +
> > +failed=0
> > +fail() {
> > +       echo "error: $1" >&2
> > +       echo "       likely cause: $2" >&2
> > +       failed=1
> > +}
> > +
> > +# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
> > +# subordinate user. That user can only reach it if every ancestor of TMPDIR is
> > +# world-executable (see mmdebstrap(1), TMPDIR).
> 
> Same nitpick remark here
> 
> > +dir=$tmpdir
> > +while [ "$dir" != "/" ]; do
> > +       if [ -e "$dir" ] && \
> > +          [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
> > +               fail "'$dir' is not world-executable" \
> 
> and here

If there are no objections, I would just change to "searchable" instead
of executable, despite the mmdebstrap manpage explicitly states
executable.

Still, test reports if that actually works on other machines would be
great :)

Felix

> 
> > +                       "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
> > +       fi
> > +       dir=$(dirname "$dir")
> > +done
> > +
> > if ! ${run_privileged_cmd} /bin/sh <<'EOF'
> >        failed=0
> > 
> > @@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
> >        exit "$failed"
> > EOF
> > then
> > +       failed=1
> > +fi
> > +
> > +if [ "$failed" != 0 ]; then
> >        echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
> >        exit 1
> > fi
> > --
> > 2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/d359972024ec1136965773f4948adf13a3d1ec94.camel%40siemens.com.