[PATCH 1/1] kas-container: bind-mount dirs below workdir if not traversable

[Felix Moessbauer]

In case the user uses a strict umask that results in the KAS_WORK_DIR
not being traversable by others, building currently fails. The reason is
a requirement of mmdebstrap with unshare backend that requires all
parent dirs of the TMPDIR to be world executable.

We fix this by bind-mounting all directories that are placed below the
KAS_WORK_DIR in case KAS_WORK_DIR is not traversable by others.
This is in general a good idea to get standard umasks / file permissions
on the build environment.

Reported-by: Clara Kowalsky <clara.k...@siemens.com>
Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
PS: There will be a corresponding isar patch that checks the condition.

kas-container | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kas-container b/kas-container
index caaff0429..070cb5141 100755
--- a/kas-container
+++ b/kas-container
@@ -240,6 +240,13 @@ setup_kas_dirs()
{
KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
+ # If KAS_WORK_DIR is not traversable by other users (e.g. chmod 700),
+ # the build user inside the container cannot reach directories located
+ # below it via /work. Force such directories into dedicated mounts.
+ if [ -z "$(find "${KAS_WORK_DIR}" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then
+ KAS_WORK_DIR_NO_OTHER_EXEC=1
+ KAS_BUILD_DIR=${KAS_BUILD_DIR:-${KAS_WORK_DIR}/build}
+ fi
KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
DL_DIR="$(check_and_expand DL_DIR createrec)"
@@ -291,8 +298,8 @@ forward_dir()
eval _varval=\"\$"$1"\"
[ -z "$_varval" ] && return
FW_DIR_REL=$(realpath -q --relative-base="${KAS_WORK_DIR}" "$_varval")
- if [ "${FW_DIR_REL}" = "$_varval" ]; then
- KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -v ${FW_DIR_REL}:$2:$3 -e $1=$2"
+ if [ "${FW_DIR_REL}" = "$_varval" ] || [ -n "${KAS_WORK_DIR_NO_OTHER_EXEC}" ]; then
+ KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -v ${_varval}:$2:$3 -e $1=$2"
else
KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e $1=/work/${FW_DIR_REL}"
fi
--
2.55.0

[Jan Kiszka]

On 10.09.26 16:41, 'Felix Moessbauer' via kas-devel wrote:
> In case the user uses a strict umask that results in the KAS_WORK_DIR
> not being traversable by others, building currently fails. The reason is
> a requirement of mmdebstrap with unshare backend that requires all
> parent dirs of the TMPDIR to be world executable.
>
> We fix this by bind-mounting all directories that are placed below the

It's not "all directories" but more like all kas-managed subdirectories
of KAS_WORK_DIR, those that are separately forwarded (and differently
mounted inside the container). Other, random files or directories in
KAS_WORK_DIR are not handled specifically.

Why replacing FW_DIR_REL with _varval? Those are identical, but this is
causing a needless line diff.

> else
> KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e $1=/work/${FW_DIR_REL}"
> fi

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Felix Moessbauer]

In case the user uses a strict umask that results in the KAS_WORK_DIR
not being traversable by others, building currently fails. The reason is
a requirement of mmdebstrap with unshare backend that requires all
parent dirs of the TMPDIR to be world executable.

We fix this by bind-mounting kas-container managed subdirectories of

KAS_WORK_DIR in case KAS_WORK_DIR is not traversable by others. This is
in general a good idea to get standard umasks / file permissions on the

build environment. As these dirs are potentially created by
kas-container outside the container (e.g. KAS_BUILD_DIR is created if not
present), we set a suitable and stable umask. This also ensures that the
change only affects dirs we create - but not ones which have been
created externally by the user.

Reported-by: Clara Kowalsky <clara.k...@siemens.com>
Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

Changes since v1:

- set a umask to let kas-container create the dirs with correct permissions
- reword variable name, invert logic, initialize it
- avoid not needed change (reduce diff)

kas-container | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/kas-container b/kas-container
index caaff0429..f254ec914 100755
--- a/kas-container
+++ b/kas-container
@@ -238,8 +238,19 @@ check_and_expand()
# shellcheck disable=2034
setup_kas_dirs()
{
+ # Use a stable umask for directories created by kas-container, without
+ # affecting permissions on user-provided directories.
+ umask 0022
+ KAS_WORK_DIR_HAS_S_IXOTH=1

KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
+ # If KAS_WORK_DIR is not traversable by other users (e.g. chmod 700),
+ # the build user inside the container cannot reach directories located
+ # below it via /work. Force such directories into dedicated mounts.
+ if [ -z "$(find "${KAS_WORK_DIR}" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then

+ KAS_WORK_DIR_HAS_S_IXOTH=0

+ KAS_BUILD_DIR=${KAS_BUILD_DIR:-${KAS_WORK_DIR}/build}
+ fi
KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
DL_DIR="$(check_and_expand DL_DIR createrec)"

@@ -291,7 +302,7 @@ forward_dir()

eval _varval=\"\$"$1"\"
[ -z "$_varval" ] && return
FW_DIR_REL=$(realpath -q --relative-base="${KAS_WORK_DIR}" "$_varval")
- if [ "${FW_DIR_REL}" = "$_varval" ]; then

+ if [ "${FW_DIR_REL}" = "$_varval" ] || [ "${KAS_WORK_DIR_HAS_S_IXOTH}" = "0" ]; then

KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -v ${FW_DIR_REL}:$2:$3 -e $1=$2"

else
KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e $1=/work/${FW_DIR_REL}"

--
2.55.0

[MOESSBAUER, Felix]

Well... they're not necessarily and this indeed makes a difference now.
$_varval always provides the expanded, absolute path. And podman treats
-v mounts completely differently when mounting an absolute vs. a
relative path.

On paths starting with a / or ./, (e.g. -v /foo/bar:/build:rw) podman
simply bind mounts the directory and aligns the permissions according
to --userns. By that, it belongs to the builder user in our case.

On path starting without / or ./, podman creates a volume and mounts
that into the container. The volume belongs to root:root, hence our
builder user cannot write to it.

Will revert the change in v3 and add a reasoning to the commit message.

Felix

[Felix Moessbauer]

In case the user uses a strict umask that results in the KAS_WORK_DIR
not being traversable by others, building currently fails. The reason is
a requirement of mmdebstrap with unshare backend that requires all
parent dirs of the TMPDIR to be world executable.

We fix this by bind-mounting kas-container managed subdirectories of

KAS_WORK_DIR in case KAS_WORK_DIR is not traversable by others. This is
in general a good idea to get standard umasks / file permissions on the

build environment. As these dirs are potentially created by
kas-container outside the container (e.g. KAS_BUILD_DIR is created if not
present), we set a suitable and stable umask. This also ensures that the
change only affects dirs we create - but not ones which have been
created externally by the user.

As the condition to mount a directory now depends not only on the path,
we must use the raw, expanded value (varval) as the host side of the
mount flag. Otherwise a relative path not starting with ./ would be
mounted as volume belonging to root inside the container (podman only).

Reported-by: Clara Kowalsky <clara.k...@siemens.com>
Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

Changes since v2:

- ensure the bind mounts are always absolute, to enforce that these
are mounted as bind-mounts instead of volumes on podman

Changes since v1:

- set a umask to let kas-container create the dirs with correct permissions
- reword variable name, invert logic, initialize it
- avoid not needed change (reduce diff)

kas-container | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/kas-container b/kas-container
index caaff0429..597bc4cc8 100755
--- a/kas-container
+++ b/kas-container

@@ -238,8 +238,19 @@ check_and_expand()
# shellcheck disable=2034
setup_kas_dirs()
{
+ # Use a stable umask for directories created by kas-container, without
+ # affecting permissions on user-provided directories.
+ umask 0022
+ KAS_WORK_DIR_HAS_S_IXOTH=1

KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
+ # If KAS_WORK_DIR is not traversable by other users (e.g. chmod 700),
+ # the build user inside the container cannot reach directories located
+ # below it via /work. Force such directories into dedicated mounts.
+ if [ -z "$(find "${KAS_WORK_DIR}" -maxdepth 0 -perm -0001 2>/dev/null)" ]; then

+ KAS_WORK_DIR_HAS_S_IXOTH=0

+ KAS_BUILD_DIR=${KAS_BUILD_DIR:-${KAS_WORK_DIR}/build}
+ fi
KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
DL_DIR="$(check_and_expand DL_DIR createrec)"

@@ -291,8 +302,9 @@ forward_dir()

eval _varval=\"\$"$1"\"
[ -z "$_varval" ] && return
FW_DIR_REL=$(realpath -q --relative-base="${KAS_WORK_DIR}" "$_varval")
- if [ "${FW_DIR_REL}" = "$_varval" ]; then
- KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -v ${FW_DIR_REL}:$2:$3 -e $1=$2"

+ if [ "${FW_DIR_REL}" = "$_varval" ] || [ "${KAS_WORK_DIR_HAS_S_IXOTH}" = "0" ]; then

+ # varval always contains an absolute path, which ensures podman uses a bind-mount

+ KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -v ${_varval}:$2:$3 -e $1=$2"

else
KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e $1=/work/${FW_DIR_REL}"
fi

--
2.55.0

[Clara Kowalsky]

This version works for me, thanks.

Tested-by: Clara Kowalsky <clara.k...@siemens.com>

[Jan Kiszka]

Ack, now it's clear.

[Jan Kiszka]

Thanks, applied.