openstack/diskimage-builder
Code Issues Proposed changes

Fix manifest element with non-root user

Browse Source 
When building an image with the manifests element as a non-root user,
the image can fail to build. This affects the Ironic Python Agent (IPA)
image.

The issue was permission denied when copying the manifests from the
image build directory due to them being owned by the root user.

This change fixes the issue by copying the files using sudo, and
changing their ownership later.

Change-Id: I5fcdd9d47f97f32a5b4b8246e8b57ead41b0bdd9
Closes-Bug: #2069956
This commit is contained in:
Mark Goddard 2024-06-20 12:03:54 +01:00
parent ac180b9ac6
commit 9767cd564f
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
diskimage_builder/elements/manifests/cleanup.d/01-copy-manifests-dir
View File

@ -34,10 +34,11 @@ echo "$DIB_ARGS" | sudo dd of=${MANIFEST_IMAGE_PATH}/dib_arguments # dib-lint:
# Save the manifests locally to the save dir
mkdir -p ${DIB_MANIFEST_SAVE_DIR}
cp --no-preserve=ownership -rv ${MANIFEST_IMAGE_PATH} ${DIB_MANIFEST_SAVE_DIR}
sudo cp --no-preserve=ownership -rv ${MANIFEST_IMAGE_PATH} ${DIB_MANIFEST_SAVE_DIR} # dib-lint: safe_sudo
sudo chown -R $(whoami): ${DIB_MANIFEST_SAVE_DIR} # dib-lint: safe_sudo
# Lock down permissions on the manifest files inside the image to
# root. We don't want regular users being able to see what might
# contain a password, etc.
find ${MANIFEST_IMAGE_PATH} -type f | xargs sudo chown root:root # dib-lint: safe_sudo
find ${MANIFEST_IMAGE_PATH} -type f | xargs sudo chmod 600 # dib-lint: safe_sudo
sudo find ${MANIFEST_IMAGE_PATH} -type f | xargs sudo chown root:root # dib-lint: safe_sudo
sudo find ${MANIFEST_IMAGE_PATH} -type f | xargs sudo chmod 600 # dib-lint: safe_sudo

6
releasenotes/notes/fix-2069956-396eb9f5fb928e2d.yaml Normal file
View File

@ -0,0 +1,6 @@
---
fixes:
- |
Fixes an issue where an image using the ``manifest`` element could fail to
build when using a non-root user. See `bug 2069956
<https://bugs.launchpad.net/diskimage-builder/+bug/2069956>`__.