Re: [RFC 11/12] add support for fully rootless builds

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 18.02.26 12:58, 'Felix Moessbauer' via isar-users wrote:
> Currently isar requires passwordless sudo and an environment
> where mounting file systems is possible. This has proven problematic
> for security reasons, both when running in a privileged container or
> locally.
> 
> To solve this, we implement fully rootless builds that rely on the
> unshare syscall which allows us to avoid sudo and instead operate in
> temporary kernel namespaces as a user that is just privileged within
> that namespace. This comes with some challenges regarding the handling
> of mounts (they are cleared when leaving the namespace), as well as
> cross namespace deployments (the outer user might not be able to access
> the inner data). For that, we rework the handling of mounts and artifact
> passing to make it compatible with both chroot modes (schroot and
> unshare).
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  Kconfig                                       |  2 +-
>  RECIPE-API-CHANGELOG.md                       | 29 +++++++
>  doc/user_manual.md                            |  2 +
>  meta/classes-global/base.bbclass              | 67 ++++++++++++++-
>  meta/classes-recipe/deb-dl-dir.bbclass        |  9 +-
>  meta/classes-recipe/dpkg-base.bbclass         | 16 +++-
>  meta/classes-recipe/dpkg.bbclass              | 14 +++-
>  .../image-locales-extension.bbclass           |  9 +-
>  .../image-tools-extension.bbclass             | 82 +++++++++++++++++++
>  meta/classes-recipe/rootfs.bbclass            | 53 +++++++++---
>  meta/classes-recipe/sbuild.bbclass            | 27 +++++-
>  meta/classes-recipe/sdk.bbclass               | 11 ++-
>  meta/conf/bitbake.conf                        |  7 +-
>  .../isar-mmdebstrap/isar-mmdebstrap.inc       | 12 ++-
>  .../sbuild-chroot/sbuild-chroot.inc           | 24 +++++-
>  15 files changed, 332 insertions(+), 32 deletions(-)
> 
> diff --git a/Kconfig b/Kconfig
> index 683c0da5..5ef2bfcb 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -14,7 +14,7 @@ config KAS_INCLUDE_MAIN
>  
>  config KAS_BUILD_SYSTEM
>  	string
> -	default "isar"
> +	default "isar-rootless"

You didn't patch kas/isar.yaml as well - might be a trap for people not
using the menu.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/fe587e5b-9d7d-432b-aee5-df18d10a5743%40siemens.com.