I am building OS images in a rootless fashing using mkosi. To facility building without root privileges, it utilizes namespaces and makes all files owned by the current user (mapped to root inside the namespace). This makes it impossible to invoke chown related syscalls inside the namespace which mkosi suppresses using a seccomp filter:
https://github.com/septatrix/mkosi/blob/10ccb0b04f5830e41bafa72a1818ce9a195c5799/mkosi/sandbox.py#L218-L225
As a result, useradd bails out while copying the skel direction after trying to chown the first file:
|
|| (fchown_if_needed (ofd, statp, |
Therefore, only a single file is created (with original permissions and filesize of 0) and useradd return with a 0 exit code (success?!). This is very confusing and cause me a lot of pain to discover/troubleshoot. Ideally. it would gracefully degrade if chown failed. This is what e.g. package managers do if they cannot chown a file - it just keeps being owned by root. Alternatively, this could be made opt-in/-out by a flag. In any case, silently failing to copy the skel directory but still returning a success exit code seems very wrong...
I am building OS images in a rootless fashing using mkosi. To facility building without root privileges, it utilizes namespaces and makes all files owned by the current user (mapped to root inside the namespace). This makes it impossible to invoke
chownrelated syscalls inside the namespace which mkosi suppresses using a seccomp filter:https://github.com/septatrix/mkosi/blob/10ccb0b04f5830e41bafa72a1818ce9a195c5799/mkosi/sandbox.py#L218-L225
As a result, useradd bails out while copying the skel direction after trying to chown the first file:
shadow/lib/copydir.c
Line 663 in a58a0dc
Therefore, only a single file is created (with original permissions and filesize of 0) and useradd return with a 0 exit code (success?!). This is very confusing and cause me a lot of pain to discover/troubleshoot. Ideally. it would gracefully degrade if chown failed. This is what e.g. package managers do if they cannot chown a file - it just keeps being owned by root. Alternatively, this could be made opt-in/-out by a flag. In any case, silently failing to copy the skel directory but still returning a success exit code seems very wrong...