Re: [PATCH 1/1] rootfs: restore compatibility with bwrap 0.12.0

[Zhihang Wei <wzh@ilbers.de>]

Applied to next, thanks.

Zhihang

On 8/31/26 10:42, 'Felix Moessbauer' via isar-users wrote:
> Bubblewrap 0.12.0 is a security release that contains hardenings
> regarding the handling of symlinks. This breaks the rootfs_cmd helper,
> which over-mounts /bin, /lib and /lib64, which are symlinks to /usr/bin
> (and alike).
>
>  From debian bookworm on, /bin (and alike) are just symlinks to the
> corresponding dirs below /usr. In this case, we only need to mount /usr.
> On earlier versions, we need to mount the /bin (and alike) dirs as well.
>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   meta/classes-recipe/rootfs.bbclass | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
> index 8d394b05..0bef2d45 100644
> --- a/meta/classes-recipe/rootfs.bbclass
> +++ b/meta/classes-recipe/rootfs.bbclass
> @@ -142,8 +142,9 @@ rootfs_cmd() {
>       fi
>       shift  # remove "--", command and its arguments follows
>   
> +    # bin, lib and lib64 are only real directories on unmerged-usr rootfs
>       for ro_d in bin etc lib lib64 sys usr var; do
> -        [ -d ${bwrap_rootfs}/${ro_d} ] || continue
> +        [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue
>           bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}"
>       done
>   

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/d813f511-e7d8-4cb7-b3b1-d004915ef570%40ilbers.de.