[PATCH 1/1] isar-check-rootless: check parent dirs are world executable

[Felix Moessbauer]

When using mmdebstrap with the unshare backend, all parent directories
of the TMPDIR must be world executable. This requirement is documented
in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
colorful ways.

To indicate what is wrong, we add a check to the isar-check-rootless
script.

Reported-by: Clara Kowalsky <clara.k...@siemens.com>
Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
PS: The corresponding kas patch is here:
https://groups.google.com/g/kas-devel/c/PZihYBAmlCQ/m/tXkK0P77BAAJ

scripts/isar-check-rootless | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)

diff --git a/scripts/isar-check-rootless b/scripts/isar-check-rootless
index b5197111..de96aac7 100755
--- a/scripts/isar-check-rootless
+++ b/scripts/isar-check-rootless
@@ -20,6 +20,35 @@ fi

[ "$verbose" = 0 ] || echo "RUN_PRIVILEGED_CMD: $run_privileged_cmd" >&2

+if ! tmpdir=$( \
+ BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS} ISAR_ROOTLESS" \
+ ISAR_ROOTLESS=1 bitbake-getvar -q --value TMPDIR); then
+ echo "error: cannot determine TMPDIR from BitBake" >&2
+ exit 1
+fi
+
+[ "$verbose" = 0 ] || echo "TMPDIR: $tmpdir" >&2
+
+failed=0
+fail() {
+ echo "error: $1" >&2
+ echo " likely cause: $2" >&2
+ failed=1
+}
+
+# mmdebstrap in unshare mode populates a temporary directory below TMPDIR as a
+# subordinate user. That user can only reach it if every ancestor of TMPDIR is
+# world-executable (see mmdebstrap(1), TMPDIR).
+dir=$tmpdir
+while [ "$dir" != "/" ]; do
+ if [ -e "$dir" ] && \
+ [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
+ fail "'$dir' is not world-executable" \
+ "a restrictive parent directory (e.g. with 0700) prevents the unshared user from reaching TMPDIR"
+ fi
+ dir=$(dirname "$dir")
+done
+
if ! ${run_privileged_cmd} /bin/sh <<'EOF'
failed=0

@@ -48,6 +77,10 @@ if ! ${run_privileged_cmd} /bin/sh <<'EOF'
exit "$failed"
EOF
then
+ failed=1
+fi
+
+if [ "$failed" != 0 ]; then
echo "error: unprivileged rootless builds are not supported; see the checks above" >&2
exit 1
fi
--
2.55.0

[Ulrich Teichert]

Hi,

>From: 'Felix Moessbauer' via isar-users <isar-...@googlegroups.com>
>Sent: Thursday, 10 September 2026 16:43
>To: isar-...@googlegroups.com
>Cc: jan.k...@siemens.com; Felix Moessbauer; Clara Kowalsky
>Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
>
>When using mmdebstrap with the unshare backend, all parent directories
>of the TMPDIR must be world executable. This requirement is documented

<nitpick on> you mean that all parent directories need to be world searchable,
by setting the S_IXOTH access bit, right?

>in the mmdebstrap man page, but when not fulfilled, mmdebstrap fails in
>colorful ways.
>
>To indicate what is wrong, we add a check to the isar-check-rootless
>script.
>
>Reported-by: Clara Kowalsky <clara.k...@siemens.com>
>Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
>---
>PS: The corresponding kas patch is here:

>https://eu-central-1.protection.sophos.com?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9nL2thcy1kZXZlbC9jL1BaaWhZQkFtbENRL20vdFhrSzBQNzdCQUFK&p=m&i=Njg1ZjQwODk0ZjExMWE2MTRhMzZlYTVh&t=MUg3ZnNlRGlyQmVnWm1VODZ4WmllMURXeUN6eDB5dFU0LzlNTjJXL3lyaz0=&h=bfebb46f6bd343faad9aade498e5e633&s=AVNPUEhUT0NFTkNSWVBUSVbIcQJfcQqDP5O5j04WOwCo19UVlhqc_xWW892xDBS3QPUnhUsRr8ErpwgATazXqj9NIytE57svt3NJ-oa9ycVY

Same nitpick remark here

>+dir=$tmpdir
>+while [ "$dir" != "/" ]; do
>+ if [ -e "$dir" ] && \
>+ [ -z "$(find "$dir" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
>+ fail "'$dir' is not world-executable" \

and here

[MOESSBAUER, Felix]

On Thu, 2026-09-10 at 15:17 +0000, Ulrich Teichert wrote:
> Hi,
>
> > From: 'Felix Moessbauer' via isar-users <isar-...@googlegroups.com>
> > Sent: Thursday, 10 September 2026 16:43
> > To: isar-...@googlegroups.com
> > Cc: jan.k...@siemens.com; Felix Moessbauer; Clara Kowalsky
> > Subject: [PATCH 1/1] isar-check-rootless: check parent dirs are world executable
> >
> > When using mmdebstrap with the unshare backend, all parent directories
> > of the TMPDIR must be world executable. This requirement is documented
>
> <nitpick on> you mean that all parent directories need to be world searchable,
> by setting the S_IXOTH access bit, right?

Hi, thanks for the review. Yes, that's right. However, then we diverge
from the terminology that is used by mmdebstrap, which is:

If you set "TMPDIR" in unshare mode, then the unshared user must be
able to access the directory. This means that the directory itself must
be world-writable and all its ancestors must be at least world-
executable.

If there are no objections, I would just change to "searchable" instead
of executable, despite the mmdebstrap manpage explicitly states
executable.

Still, test reports if that actually works on other machines would be
great :)

Felix