Block builds from creating/deleting users/groups about haikuporter HOT 6 OPEN

Also from @mmlr:

we should also generally disable extracting with other uids by means of filters
and probably heed the python tarfile docs warning about using data filter to prevent tars from writing anywhere in the system...

from haikuporter.

I wonder why we use Python's tar handling support anyway. It appears all the things we do with it can be done via tar command line arguments, and we already use command line tools for extracting other types of archives. That'd be a lot simpler than all the code we have for filters and info-handling.

from haikuporter.

It appears tar can only duplicate hardlinked files, though, not turn them into symlinks as our filtering code does. I think that should be fine?

from haikuporter.

I suppose, that, when cross-building, the provided tar version can be very different.

from haikuporter.

I think that should be fine?

Probably not, if the build modifies any of these files. It's difficult to say if some recipes would hit that specific problem.

In 2019, some build (@mmlr believes it to be https://build.haiku-os.org/buildmaster/master/x86_64/?buildrunDir=2953&viewMode=expanded) created a user named root. As the root user on Haiku is just called user, the new root user had a UID greater than 1000, not 0.

How did that even affect the builder? Creating a user should change the /etc/passwd file inside the chroot, but not the one used by the OS, right? So once the build is done, that user disappears? Otherwise, it is a chroot leak and that is a problem that should be solved on Haiku side?

from haikuporter.

Otherwise, it is a chroot leak and that is a problem that should be solved on Haiku side?

The useradd command does not modify /etc/passwd but contacts Registrar to ask it to make the change. And registrar only checks that the application making the request is running as root (UID 0) and nothing else, which it is inside the chroot. Yes, we should probably fix this on the Haiku side, but I'm not quite sure about how.

from haikuporter.