From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from dude02.hi.pengutronix.de ([2001:67c:670:100:1d::28] helo=dude02.lab.pengutronix.de) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jnI7G-00070t-N6 for ptxdist@pengutronix.de; Mon, 22 Jun 2020 10:47:46 +0200 Received: from mol by dude02.lab.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1jnI7G-0001RE-Cx for ptxdist@pengutronix.de; Mon, 22 Jun 2020 10:47:46 +0200 Date: Mon, 22 Jun 2020 10:47:46 +0200 From: Michael Olbrich Message-ID: <20200622084746.GA23174@pengutronix.de> References: <202006220955.51237.jbe@pengutronix.de> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <202006220955.51237.jbe@pengutronix.de> Subject: Re: [ptxdist] Root filesystem creation regression List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de On Mon, Jun 22, 2020 at 09:55:51AM +0200, Juergen Borleis wrote: > since commit 9c0ec1da583f32706372d2a6cefa9a05f77ee8d2 > "ptxd_lib_check_dir_permissions: also check parents for directories" > > the "install_tree" macro may create directories which makes this test fail and > I'm unable to create root filesystems anymore. > > The problem pops up if "install_tree" tries to install a file to a directory > which has different permissions than the usual ones (0775, root:root). > > For example: "systemd" sets up the "/usr/share/dbus-1/system-services" with > permissions 0755. If my own package tries to add another file to this directory > the corresponding "install" tool in the install stage creates the whole path > with standard 0755 permissions - because the "filesystem" in the package > directory (e.g. platform-/packages/) is always empty. In a > regular root filesystem it works, because the directory structure already > exists (with the intended permissions), and the "install" tool has to copy the > file only. > > Using "install_tree" in my package in this case creates a conflict for > the "system-services" directory (0755 versus 0775). I guess it will fail at > more locations than only "install_tree", if someone adds more and more accurate > permissions due to security reasons. So the error you got was that systemd tries to create system-services with 0755 and your package tries to create it with 0775, right? This is no longer supported. All packages must create the same directories with the same permissions. The problem is that, in general, when two ipkgs contain the same directory with different permissions then the result was non-deterministic. Either permission could end up in the rootfs. For rootfs images we 'fixed' this by applying all permissions again. However, that is only deterministic if only on package provides explicit permissions for the directory. And that was not checked. And even that case is not without problems: This only works, wenn ptxdist created rootfs images. It does not work when ipkgs are used in any other way. And if the package that provides the permissions is disabled, then the permissions change for the remaining system. That is not something that should happen. So if a directory has non standard permissions, then all packages that install into this directory must created the directory first, with the correct permissions. FYI, this was broken in the last ptxdist release, but it should be fixed in master. 'install_tree' is a bit of a special case here. The problem ist, that it cannot know, which directories are implicit. So it will always create all subdirectories (except the root directory of the tree). So you need to fix the permission in the install stage. Michael -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de