Current API of runroot plugin allows anyone with "runroot" permission
to run any random command on the builder (although it is run in the
chroot environment). This is often considered as unsafe and possible
security issue and prevents granting "runroot" permissions to other
Koji users which might need it to run Pungi.
In fact, the only runroot task which is really needed by Pungi
is execution of "lorax" command to generate buildinstall deliverables.
Other runroot use-cases can be successfully executed on local machine
without "root" user these days.
In this commit, new pungi_buildinstall plugin is introduced which
wraps "runroot" task in a way that only lorax command can be executed
with only predefined set of arguments (So far example "unsafe" --force
Lorax flag is not supported).
To use this new plugin, only new pungi_buildinstall permission is
required. This new permission can be granted to users who should be able
to execute Pungi compose including the buildinstall phase, but who are
not trusted to be granted full "runroot" permission.
Current API of runroot plugin allows anyone with "runroot" permission
to run any random command on the builder (although it is run in the
chroot environment). This is often considered as unsafe and possible
security issue and prevents granting "runroot" permissions to other
Koji users which might need it to run Pungi.
In fact, the only runroot task which is really needed by Pungi
is execution of "lorax" command to generate buildinstall deliverables.
Other runroot use-cases can be successfully executed on local machine
without "root" user these days.
In this commit, new pungi_buildinstall plugin is introduced which
wraps "runroot" task in a way that only
loraxcommand can be executedwith only predefined set of arguments (So far example "unsafe"
--forceLorax flag is not supported).
To use this new plugin, only new
pungi_buildinstallpermission isrequired. This new permission can be granted to users who should be able
to execute Pungi compose including the buildinstall phase, but who are
not trusted to be granted full "runroot" permission.
Fixes: #1940
Signed-off-by: Jan Kaluza jkaluza@redhat.com