rockdrilla/mmdebstrap
1
0
Fork 0
forked from josch/mmdebstrap
Code Issues Pull requests Projects Releases Wiki Activity
1090 commits 2 branches 0 tags 17 MiB
Commit graph

1090 commits

This branch
This branch
All branches
Author SHA1 Message Date
Johannes Schauer Marin Rodrigues
7d472ca116
document on how to use mmdebstrap with podman 2021-08-27 11:53:32 +02:00
Johannes Schauer Marin Rodrigues
047619967e
also check whether CAP_SYS_ADMIN is in the bounding set 2021-08-27 11:53:11 +02:00
Johannes Schauer Marin Rodrigues
5a5f57b404
Automatically skip using mount if that's not possible 
- instead of throwing an error, just print a warning
 - can now run as root without cap_sys_admin
 - can now run without mount installed
 - --skip=check/canmount is not needed anymore
 2021-08-26 15:40:27 +02:00
Johannes Schauer Marin Rodrigues
7ab770267c
README.md: document chroots without apt as a feature 2021-08-26 11:24:18 +02:00
Johannes Schauer Marin Rodrigues
1a18160fe8
document that apt-transport-https, ca-certificates and apt-transport-tor are no longer installed automatically 2021-08-26 11:17:13 +02:00
Johannes Schauer Marin Rodrigues
e53d246a3b
also test minbase buildd important standard with --dry-run/--simulate 2021-08-26 08:34:30 +02:00
Johannes Schauer Marin Rodrigues
91d8be5f9c
Do not use gpg --trust-model=always 
- gpg will not create a trustdb when running with --update-trustdb with
   --trust-model=always:
       gpg: no need for a trustdb update with 'always' trust model
 - subsequent gpg calls will fail because there is no trustdb in GPGHOME
 2021-08-26 07:58:27 +02:00
Johannes Schauer Marin Rodrigues
850eeb24d5
more code comments 2021-08-25 05:21:57 +02:00
Johannes Schauer Marin Rodrigues
8b12375de3
add more references to #808203 2021-08-25 05:15:44 +02:00
Johannes Schauer Marin Rodrigues
c627606110
document copy:// vs. file:// 2021-08-23 10:41:44 +02:00
Johannes Schauer Marin Rodrigues
dddccd5e55
tarfilter: expand description text 2021-08-23 10:33:31 +02:00
Johannes Schauer Marin Rodrigues
60dba1c19e
fixup read_subuid_subgid 
- use $REAL_USER_ID from English instead of $<
 - use getgrgid $REAL_GROUP_ID to get the group name instead of assuming
   the group name to be equal to the user name
 - also check whether /etc/subgid exists and is readable
 2021-08-19 13:02:44 +02:00
Joe Groocock
15029c1c3b
improve error message for missing /etc/subuid entry (closes: #9) 2021-08-19 11:18:53 +02:00
Johannes Schauer Marin Rodrigues
3c37d692a0
write 'uninitialized' to /etc/machine-id to support systemd ConditionFirstBoot (closes: #10) 2021-08-19 07:18:21 +02:00
Nicolas Vigier
5283d74dfe
Remove files inside the auxfiles directory 
This is fixing the error:
  cannot rmdir /var/lib/apt/lists/auxfiles: Directory not empty at ./mmdebstrap/mmdebstrap line 3084.
which happens when using apt-transport-mirror.
 2021-08-19 07:18:21 +02:00
Johannes Schauer Marin Rodrigues
ea82b267c9
only run test_unshare_userns() if not root user 2021-08-18 22:06:16 +02:00
Johannes Schauer Marin Rodrigues
dfbf9cdcef
several fixes to chrootless mode 2021-08-17 23:39:20 +02:00
Johannes Schauer Marin Rodrigues
f868073b6e
add --skip=setup, --skip=update and --skip=cleanup 2021-08-17 11:11:00 +02:00
Johannes Schauer Marin Rodrigues
d62c5b7a91
README.md: add more docs 2021-08-17 11:07:48 +02:00
Johannes Schauer Marin Rodrigues
b354502b7c
README.md: add missing contributors 2021-08-17 11:06:55 +02:00
Johannes Schauer Marin Rodrigues
98f1f0abde
use apt pattern to select essential set 2021-08-17 10:30:06 +02:00
Johannes Schauer Marin Rodrigues
aae47da9ab
coverage.sh: fix test that was wrongly installing outside the chroot and download-only 2021-08-16 23:14:18 +02:00
Johannes Schauer Marin Rodrigues
3e488dd1dd
use apt from the outside by setting DPkg::Chroot-Directory 2021-08-16 22:33:39 +02:00
Johannes Schauer Marin Rodrigues
3e61382763
README.md: fix my name 2021-08-16 13:12:55 +02:00
Johannes Schauer Marin Rodrigues
c63ad87310
changes for release of Debian 11 Buster 2021-08-16 13:11:42 +02:00
Johannes Schauer Marin Rodrigues
594ea3c72e
improve busybox and --hook-dir examples in man page -- thanks Jochen Sprickerhof! 2021-05-31 16:33:34 +02:00
Johannes Schauer Marin Rodrigues
3f79c18a0d
since apt 2.1.16 we can use --error-on=any and do not anymore need to error out on all W: lines (closes: #6) 2021-05-31 11:17:45 +02:00
Benjamin Drung
0378c101bb
Pass extended attributes (excluding system) to tar2sqfs 
/bin/ping (from iputils-ping) uses the security capabilities to allow
users to use the program:

```
$ getcap /bin/ping
/bin/ping cap_net_raw=ep
```

Debian testing/unstable images (variant important) contain security and
system attributes:

```
$ mmdebstrap --variant=important bullseye root.tar
$ tar --xattrs --xattrs-include='*' -vv -tf root.tar | grep -B 1 '^ '
-rwxr-xr-x* 0/0           77432 2021-02-02 18:49 ./bin/ping
  x: 20 security.capability
--
drwxr-sr-x* 0/102             0 2021-05-07 15:10 ./var/log/journal/
  x: 44 system.posix_acl_access
  x: 44 system.posix_acl_default
```

When generating a squashfs image with mmdebstrap 0.7.5-2, these security
capabilities are lost. Example for building a squashfs image in a
minimal Debian unstable schroot:

```
$ apt install -y mmdebstrap squashfs-tools-ng
$ mmdebstrap --variant=important buster root.squashfs
$ rdsquashfs -x /bin/ping root.squashfs
$
```

tar2sqfs from squashfs-tools-ng 1.0.4-1 supports encoding extended
attributes from the namespace `user`, `trusted`, and `security` (see
`include/sqfs/xattr.h`). GNU tar (version 1.34) supports these three
namespaces plus the namespace `system`.

Passing extended attributes from the `system` namespace to tar2sqfs will
produce an error:

```
ERROR: squashfs does not support xattr prefix of system.posix_acl_default
```

So pass the extended attributes to tar2sqfs, but exclude the `system`
namespace. Then ping will keep its security attributes:

```
$ rdsquashfs -x /bin/ping root.squashfs
security.capability=0x0100000200200000000000000000000000000000
```

Closes: #988100
Signed-off-by: Benjamin Drung <benjamin.drung@ionos.com>
 2021-05-17 21:43:10 +02:00
Johannes Schauer Marin Rodrigues
88a031477a
add --skip=cleanup/apt/lists and --skip=cleanup/apt/cache 2021-05-09 20:44:02 +02:00
Vagrant Cascadian
c51fb24c7b
Use all cores when compressing with zstd. 2021-05-09 17:32:04 +02:00
Johannes Schauer Marin Rodrigues
236b84a486
tarfilter: add --pax-exclude and --pax-include to strip extended attributes because tar2sqfs only supports user.*, trusted.* and security.* 2021-05-07 09:39:40 +02:00
Johannes Schauer Marin Rodrigues
bd5d3c3dab
tarfilter: remove leftover debugging statement 2021-05-07 09:20:36 +02:00
Johannes Schauer Marin Rodrigues
ebfac91738
also choose null format if stdout is /dev/null and check whether major and minor number of /dev/null are as expected to avoid false positives 2021-05-04 15:01:53 +02:00
Konstantin Demin
ccd4b5c163
gpg: handle ASCII-armored keyrings as well 
gpg command "--list-keys" requires input files to be passed with
option "--keyring" and each file must match type "public keyring v4"
while gpg command "--show-keys" doesn't require extra options and
handles also ASCII-armored public keyrings as well.

Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
 2021-04-25 22:33:37 +03:00
Helmut Grohne
2767b051bc
implement --format=null 2021-03-25 07:04:14 +01:00
Johannes Schauer Marin Rodrigues
4c17f36072
better document the TMPDIR env var 2021-03-08 19:33:51 +01:00
Johannes Schauer Marin Rodrigues
4cd69d444a
coverage.sh: let cover output to stderr to prevent wrong message output order 2021-03-08 19:33:24 +01:00
Johannes Schauer Marin Rodrigues
4cd547286c
coverage.sh: sysvinit-utils also works with chrootless 2021-03-08 19:32:53 +01:00
Johannes Schauer Marin Rodrigues
65070e23da
coverage.sh: add more docs for chrootless essential test 2021-03-08 19:32:19 +01:00
Johannes Schauer Marin Rodrigues
5a3d1ab5c4
Rework /dev, /sys, /proc mounting 
- assume all entries in @devfiles to be in /dev
 - allow for /dev, /sys and /proc not to exist in the target and print warning
 - allow for /dev entries as well as /sys and /proc not to exist on the outside
 - simplify umount by storing special options in @umountopts
 - remove superfluous checks for root and unshare mode
 - make sure /dev entries are less than 100 chars in size for tar
 2021-03-08 08:04:35 +01:00
Johannes Schauer Marin Rodrigues
d52eaa4814
instead of checking for defined-ness and then comparing with the empty string, we can just use 'length' which returns undef if its argument is undef 2021-03-08 07:54:04 +01:00
Johannes Schauer Marin Rodrigues
270fd09b43
update copyright information 2021-03-08 07:52:14 +01:00
Johannes Schauer Marin Rodrigues
d5c8a85ace
document problems with chrootless mode in man page 2021-02-23 12:50:18 +01:00
Johannes Schauer Marin Rodrigues
ecbc10794c
warn if --dpkgopt is used in chrootless mode because of #808203 2021-02-23 12:49:46 +01:00
Johannes Schauer Marin Rodrigues
49f464e7da
create /etc/dpkg/dpkg.cfg.d/ if --dpkgopt is used 2021-02-23 12:49:26 +01:00
Johannes Schauer Marin Rodrigues
bbf12c221d
tarfilter: fixup last commit by formatting with black 2021-02-22 13:45:55 +01:00
Benjamin Drung
043ab3bbf0
tarfilter: Compile prefix pattern only once 
According to Debian bug #978742, mmtarfilter has a slow performance with
many path exclusions. The execution can be speed up if the regular
expression is only compiled once instead of every time in the hot loop.

Signed-off-by: Benjamin Drung <benjamin.drung@cloud.ionos.com>
 2021-02-22 13:15:16 +01:00
Johannes Schauer Marin Rodrigues
5fd1ca62d9
coverage.sh: don't attempt deleting non-existant directory 2021-02-19 14:40:20 +01:00
Johannes Schauer Marin Rodrigues
067daaf4c2
also run unshare with --propagation unchanged in root mode 2021-02-19 12:53:14 +01:00
Josh Triplett
f8fc7d9bbf
Fix typo in hook directory example 2021-02-06 18:58:30 +01:00