4 ms·

But isn't the article about building initramfs bottom-up, presenting the most basic tools? I did not see anything special that would make it rootless. That see

But isn't the article about building initramfs bottom-up, presenting the most basic tools? I did not see anything special that would make it rootless. That seemed to be a point made by the submitter.

Retr0id 3y ago
The article itself says: >Note this is rootless, we don't need to re-create the filesystem tree locally or use fakeroot to create special file in the archive.
- usr1106 3y ago
  Sure it does. But that's not because the article shows us any new trick, it's just because they use the original and most basic tool to generate an initramfs.
  - Retr0id 3y ago
    gen_init_cpio is not the original cpio archiver utility. It's only obvious to know to use it if you already know about it. The Linux kernel docs cover it, sure, but the whole point of the OP is a more approachable introduction to the same information.
nonameiguess 3y ago
The article says it is but that is potentially misleading. Building an initramfs is very simple. Copy all the files you want in it and make a cpio archive. Arch's tool for doing it is just a 80 line or so bash script. In principle, it doesn't matter what user does this but only if all the files you need are readable by a non-root user.
- oasisaimlessly 3y ago
  You can't make device nodes as non-root.
  - Brian_K_White 3y ago
    You can create any data as non-root, including the description of a device node in a cpio.
    - mikepurvis 3y ago
      But the point is that the tooling to do this is non-obvious. The same issue exists for all these kinds of archives— container image layers, ISOs, VMDKs, debootstrap outputs, etc. All of them are things that should be possible to just emit directly into a user-owned archive, but often require mounts, overlays, chown, and who knows what else. Another related one is about installing grub into an archived filesystem or disk image. Should be trivial, right? But most instructions for this require mounting it, which immediately means you need SYS_ADMIN and therefore a privileged container in your CI setup.
  - zygology 3y ago
    You can't make them on the filesystem itself, gen_init_cpio lets you specify device nodes to be created within the archive, but they are not actually created on the live system and do not require privileges. I made my own CPIO library: https://github.com/desultory/pycpio https://github.com/desultory/pycpio and one of the main goals was this behavior, so I could create CPIO archives with device nodes without privileges. It's really as simple as writing some bytes to a file saying "when you extract this, create this device node". It's not like any archive actually has a device node, just instructions for where to put them, and what properties they have. Certainly, you can't extract these archives as non-root, but you have to go out of your way to make an initramfs have non-root privileges.

But isn't the article about building initramfs bottom-up, presenting the most basic tools? I did not see anything special that would make it rootless. That seemed to be a point made by the submitter.

Retr0id 3y ago

The article itself says: >Note this is rootless, we don't need to re-create the filesystem tree locally or use fakeroot to create special file in the archive.

usr1106 3y ago
Sure it does. But that's not because the article shows us any new trick, it's just because they use the original and most basic tool to generate an initramfs.
- Retr0id 3y ago
  gen_init_cpio is not the original cpio archiver utility. It's only obvious to know to use it if you already know about it. The Linux kernel docs cover it, sure, but the whole point of the OP is a more approachable introduction to the same information.

nonameiguess 3y ago

The article says it is but that is potentially misleading. Building an initramfs is very simple. Copy all the files you want in it and make a cpio archive. Arch's tool for doing it is just a 80 line or so bash script. In principle, it doesn't matter what user does this but only if all the files you need are readable by a non-root user.

oasisaimlessly 3y ago
You can't make device nodes as non-root.
- Brian_K_White 3y ago
  You can create any data as non-root, including the description of a device node in a cpio.
  - mikepurvis 3y ago
    But the point is that the tooling to do this is non-obvious. The same issue exists for all these kinds of archives— container image layers, ISOs, VMDKs, debootstrap outputs, etc. All of them are things that should be possible to just emit directly into a user-owned archive, but often require mounts, overlays, chown, and who knows what else. Another related one is about installing grub into an archived filesystem or disk image. Should be trivial, right? But most instructions for this require mounting it, which immediately means you need SYS_ADMIN and therefore a privileged container in your CI setup.
- zygology 3y ago
  You can't make them on the filesystem itself, gen_init_cpio lets you specify device nodes to be created within the archive, but they are not actually created on the live system and do not require privileges. I made my own CPIO library: https://github.com/desultory/pycpio https://github.com/desultory/pycpio and one of the main goals was this behavior, so I could create CPIO archives with device nodes without privileges. It's really as simple as writing some bytes to a file saying "when you extract this, create this device node". It's not like any archive actually has a device node, just instructions for where to put them, and what properties they have. Certainly, you can't extract these archives as non-root, but you have to go out of your way to make an initramfs have non-root privileges.