Re: [PATCH v2 00/16] add support to build isar unprivileged

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 17.03.26 19:41, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
> On Fri, 2026-02-27 at 15:57 +0100, Felix Moessbauer wrote:
>> Dear isar-users,
>>
>> currently isar requires password-less sudo and an environment
>> where mounting file systems is possible. This has proven problematic
>> for security reasons, both when running in a privileged container or
>> locally.
>>
>> To solve this, we implement fully rootless builds that rely on the
>> unshare syscall which allows us to avoid sudo and instead operate in
>> temporary kernel namespaces as a user that is just privileged within
>> that namespace. This comes with some challenges regarding the handling
>> of mounts (they are cleared when leaving the namespace), as well as
>> cross namespace deployments (the outer user might not be able to access
>> the inner data). For that, we rework the handling of mounts and artifact
>> passing to make it compatible with both chroot modes (schroot and
>> unshare).
>>
>> Note, that this series can be tested on a custom kas-container build
>> provided in [1]. Hints how to migrate downstream layers are provided
>> in the API changelog.
>>
> 
> Dear isar-users,
> 
> I'm currently waiting for the isar release and then plan to send out a
> v3 that adds support for the cached-base-repo and src / dbg package
> downloading. By that, the series should be feature complete.
> 
> The last remaining aspect I don't have a solution to (yet) is the
> sbuild_dpkg_log_export in dpkg.bbclass. To me it looks like the dpkg
> dump is generated but never consumed anywhere. If someone could guide
> me how this is processed, I'll implement support for this as well.
> 

You read 03c0c7154d1632b92c9420ceb23706cc959b7cb3? Adding Uladzimir.

> We further need to clarify the interface between kas and isar. The
> current proposal is as following:
> 
> In isar, the rootless mode is activated by setting ISAR_ROOTLESS = "1".
> In kas, the rootless mode is selected by setting build_system: isar-
> rootless, which then sets the ISAR_ROOTLESS bitbake variable. We need
> this two-staged approach, as kas-container needs to be able to parse
> the top-level kas file and extract the isar / isar-privileged / isar-
> rootless mode so that it can start the container accordingly.

For kas, we are furthermore introducing the build_system
"isar-privileged", urging the users of the current "isar" mode to move
over while still mapping it on "isar-privileged" for now.

The question is if we should apply a similar pattern to Isar, pushing
users of the privileged build mode to also state that explicitly
(ISAR_PRIVILEGED = "1" or so) so that we can eventually make rootless
the default and even drop ISAR_ROOTLESS (in some years from now).

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/e2fa098c-ea23-4b0f-9478-a1548e2695fc%40siemens.com.