On Wed, 15 Mar 2023 19:22:46 +0100 Christian Kastner <[email protected]> wrote: > On 2023-02-06 17:33, Shengjing Zhu wrote: > > +------------------------------------------------------------------------------+ > > | Update chroot > > | > > +------------------------------------------------------------------------------+ > > > > Get:1 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ InRelease > > Ign:1 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ InRelease > > Get:2 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Release [603 B] > > Get:2 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Release [603 B] > > Get:3 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Release.gpg > > Ign:3 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Release.gpg > > Get:4 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Packages [999 B] > > Err:4 > > file:/build/golang-github-coredhcp-coredhcp-xIXI4Z/resolver-dcoFh4/apt_archive > > ./ Packages > > Could not open file > > /var/lib/apt/lists/partial/_build_golang-github-coredhcp-coredhcp-xIXI4Z_resolver-dcoFh4_apt%5farchive_._Packages > > - open (13: Permission denied) > > ... > > Fetched 440 kB in 2s (289 kB/s) > > Reading package lists... > > E: Failed to fetch > > store:/var/lib/apt/lists/partial/_build_golang-github-coredhcp-coredhcp-xIXI4Z_resolver-dcoFh4_apt%5farchive_._Packages > > Could not open file > > /var/lib/apt/lists/partial/_build_golang-github-coredhcp-coredhcp-xIXI4Z_resolver-dcoFh4_apt%5farchive_._Packages > > - open (13: Permission denied) > > E: Some index files failed to download. They have been ignored, or old ones > > used instead. > > Is it possible that you are running with umask 0027? If you, can you try > with umask 0022?
I was having similar struggles with the schroot backend, and I checked my umask in every way/place I could find, and ultimately I found that sbuild itself sets its own process umask to 0022 very early on, so that's not likely it (and no matter how I invoked schroot it seemed to have a sane umask too). After a while, I found that sbuild itself is actually setting the directory permissions for several directories in the chain to have "zero" permissions for "other" - when we combine that with recent versions of APT using an unprivileged "_apt" user to read local repositories, the pieces fall into place and it becomes clear. :) Attached is a patch which changes all the relevant "chmod" expressions in sbuild to allow executability for "other" (because the actual APT repository files already have suitable permissions in my environment) which resolves the problem and lets me past the "apt-get update" blocker. In the interest of both full disclosure *and* having a verified workaround, here's how I'm applying this patch in my environment "the dirty way": | sed -ri -e 's/,o=,/,o=x,/g' /usr/share/perl5/Sbuild/Build.pm | sed -ri -e 's/02770/02771/g' /usr/share/perl5/Sbuild/ChrootSetup.pm | sed -ri -e 's/0770/0771/g' /usr/share/perl5/Sbuild/ResolverBase.pm If it's easier, I'm happy to turn the attached patch into a Merge Request on Salsa. 💖 ♥, - Tianon 4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4
Description: allow the "_apt" user to get into the "build directory" during "apt-get update" (by making all the parent directories "world executable") Author: Tianon Gravi <[email protected]> Forwarded: https://bugs.debian.org/1030704 diff --git a/lib/Sbuild/Build.pm b/lib/Sbuild/Build.pm index 30e2ef96..c7d009f8 100644 --- a/lib/Sbuild/Build.pm +++ b/lib/Sbuild/Build.pm @@ -647,7 +647,7 @@ END ); } $self->check_abort(); - if (!$session->chmod($self->get('Build Dir'), "ug=rwx,o=,a-s")) { + if (!$session->chmod($self->get('Build Dir'), "ug=rwx,o=x,a-s")) { Sbuild::Exception::Build->throw( error => "Failed to set sbuild group ownership on chroot build dir", diff --git a/lib/Sbuild/ChrootSetup.pm b/lib/Sbuild/ChrootSetup.pm index c183b4de..42d04c08 100644 --- a/lib/Sbuild/ChrootSetup.pm +++ b/lib/Sbuild/ChrootSetup.pm @@ -129,12 +129,12 @@ sub basesetup ($$) { } $session->run_command({ - COMMAND => ['chmod', '02770', $build_path], + COMMAND => ['chmod', '02771', $build_path], USER => 'root', DIR => '/' }); if ($?) { - print STDERR "E: Failed to set 0750 permissions on $build_path\n"; + print STDERR "E: Failed to set 02771 permissions on $build_path\n"; return $?; } diff --git a/lib/Sbuild/ResolverBase.pm b/lib/Sbuild/ResolverBase.pm index 46a29ff8..414bf82c 100644 --- a/lib/Sbuild/ResolverBase.pm +++ b/lib/Sbuild/ResolverBase.pm @@ -281,9 +281,9 @@ sub setup { . ":sbuild ownership on extra packages dir\n"); return 0; } - if (!$session->chmod($self->get('Extra packages path'), '0770')) { + if (!$session->chmod($self->get('Extra packages path'), '0771')) { $self->log_error( - "Failed to set 0770 permissions on extra packages dir\n"); + "Failed to set 0771 permissions on extra packages dir\n"); return 0; } my $extra_packages_dir = $self->get('Extra packages path'); @@ -1223,9 +1223,9 @@ sub setup_apt_archive { . ":sbuild ownership on dummy package dir\n"); return 0; } - if (!$session->chmod($self->get('Dummy package path'), '0770')) { + if (!$session->chmod($self->get('Dummy package path'), '0771')) { $self->log_error( - "Failed to set 0770 permissions on dummy package dir\n"); + "Failed to set 0771 permissions on dummy package dir\n"); return 0; } my $dummy_dir = $self->get('Dummy package path');
