FS#65006 - [mkinitpcio] running as non-root creates non-root files in the cpio

Attached to Project: Arch Linux
Opened by Damjan Georgievski (damjan) - Wednesday, 01 January 2020, 20:35 GMT
Last edited by Antonio Rojas (arojas) - Monday, 27 December 2021, 14:45 GMT
Task Type Bug Report
Category Arch Projects
Status Closed
Assigned To Giancarlo Razzolini (grazzolini)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

When you run mkinitcpio by a non-root user, the files in the archive are also owned by the said non-root user.

Steps to reproduce:

$ id
uid=1000...
$ mkinitcpio -g /tmp/test.img
...
$ lsinitpcio -v -l /tmp/test.img
... shows the files in the archive owned by the 1000 user ...


Looking at the mkinitcpio code, it seems to try to avoid this by enforcing the uid/gid to 0, but for some reason, it needs those options in both invocations of bsdtar. I've attached a patch that fixes the issue for me.



   mkinitcpio.patch (0.5 KiB)
This task depends upon

Closed by  Antonio Rojas (arojas)
Monday, 27 December 2021, 14:45 GMT
Reason for closing:  Fixed
Additional comments about closing:  Reason for request: this has been fixed in 31
Comment by Dave Reisner (falconindy) - Wednesday, 01 January 2020, 20:42 GMT
I have a hunch that --uid/--gid isn't respected by the cpio portion of bsdtar. It's enough to move these options to the first invocation of bsdtar and not repeat them for both.
Comment by Damjan Georgievski (damjan) - Monday, 06 January 2020, 17:03 GMT
Should I update the patch?
Comment by Giancarlo Razzolini (grazzolini) - Monday, 20 January 2020, 19:42 GMT
What is the use case here? (for creating images as regular user). I mean, I'll take a look at the patch, also, it would be very helpful if you send the patch to either the [arch-projects] mailing list (using git send-email) or, if it's easier, create a PR here: https://github.com/archlinux/mkinitcpio
Comment by Damjan Georgievski (damjan) - Monday, 20 January 2020, 20:33 GMT
https://github.com/archlinux/mkinitcpio/pull/15

yes, the use case is to make sure the cpio/initramfs has the proper uid/gid even if created by non-root users.
I personally do create initramfs for tools like firecracker/crosvm, but also I don't see the reason for mkinitcpio to depend on being run as root.
Comment by Giancarlo Razzolini (grazzolini) - Monday, 20 January 2020, 21:40 GMT
Thanks for the PR, I'll take a look at it. I agree mkinitcpio can possibly run as non root, but it does need root to write to /boot.

Loading...