Package: debspawn
Version: 0.6.0-1.1
Severity: normal

Hi,

invoking debspawn build unstable foo.dsc runs the build after the
/nonexistent directory has been created. I was able to pin that down to
the call to execute_sdnspawn. It might well be possible that this is a
bug in systemd-nspawn or systemd-run, but probably someone with more
intimate knowledge of systemd-nspawn (you, the maintainer *grins*) has
an easier job to debug this further.

The builder user is created with /nonexistent as the home directory, and
somewhere between the call to dsrun build-prepare and dsrun build-run
one of the calls to systemd-nspawn -u builder creates the home directory
of the user.

This is bad because this disables the security effect of having an
account's home directory point to a nonexistent directory, and also
because adduser's autopkgtests fail in such an environment since
adduser's autopkgtests test whether the special-case of /nonexistent
(which adduser takes care to never create) is handled correctly.

I have changed the call to adduser in dsrun and the setting of
os.environ['HOME'] to /home/builder and was able to successfully run
adduser's autopkgtest after doing a build --interactive. To make the
changes effective, re-creation of the container is necessary (the
account is only created once during container creation).

It would be nice if the underlying bug in systemd could be fixed,
declaring /nonexisting an exception, never creating it, or at least if
the builder account in debspawn could be created with a different home
directory to mitigate the painful results of systemd creating the
directory.

Greetings
Marc



-- System Information:
Debian Release: bookworm/sid
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'unstable'), (500, 'testing'), 
(500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.7-zgsrv20080 (SMP w/6 CPU threads; PREEMPT)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages debspawn depends on:
ii  debootstrap        1.0.128+nmu2
ii  python3            3.10.6-1
ii  python3-tomlkit    0.11.6-1
ii  systemd-container  252-3
ii  zstd               1.5.2+dfsg-1

Versions of packages debspawn recommends:
ii  build-essential  12.9
ii  devscripts       2.22.2

Versions of packages debspawn suggests:
ii  sudo  1.9.11p3-2

-- no debconf information

-- debsums errors found:
debsums: changed file /usr/lib/python3/dist-packages/debspawn/dsrun (from 
debspawn package)
debsums: changed file /usr/lib/python3/dist-packages/debspawn/osbase.py (from 
debspawn package)

Reply via email to