Repository: systemd/mkosi

Issue:
/ perms are 0444
Using main branch on Debian Sid.

```
$ mkosi -d debian -r bullseye --bootable no --use-subvolumes no -t tar -p systemd -p dbus
$ machinectl import-tar image.tar foobar
$ machinectl start foobar
$ machinectl shell foobar /usr/bin/stat /
Connected to machine foobar. Press ^] three times within 1s to exit session.
  File: /
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: fe04h/65028d    Inode: 2490369     Links: 18
Access: (0444/dr--r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-05-08 21:36:28.641538987 +0300
Modify: 2023-05-08 21:36:08.589483369 +0300
Change: 2023-05-08 21:36:21.045517921 +0300
 Birth: 2023-05-08 21:36:20.629516767 +0300
Connection to machine foobar terminated.
```

Import part is `Access: (0444/dr--r--r--)`. This must be `0755`, otherwise weird things start to happen.

For example:
```
root@foobar:~# journalctl -u systemd-networkd.service
-- Journal begins at Mon 2023-05-08 21:36:23 EEST, ends at Mon 2023-05-08 21:38:16 EEST. --
May 08 21:36:23 foobar systemd[1]: systemd-networkd.service: Main process exited, code=exited, status=200/CHDIR
May 08 21:36:23 foobar systemd[1]: systemd-networkd.service: Failed with result 'exit-code'.
...
```
and
```
root@foobar:~# journalctl -u systemd-resolved.service
-- Journal begins at Mon 2023-05-08 21:36:23 EEST, ends at Mon 2023-05-08 21:38:16 EEST. --
May 08 21:36:23 foobar systemd[32]: systemd-resolved.service: Failed to connect stdout to the journal socket, ignoring: Permission denied
May 08 21:36:23 foobar systemd[1]: Starting Network Name Resolution...
May 08 21:36:23 foobar systemd[1]: systemd-resolved.service: Main process exited, code=exited, status=200/CHDIR
May 08 21:36:23 foobar systemd[1]: systemd-resolved.service: Failed with result 'exit-code'.
...
```

Workaround: add `chmod 755 /` to `mkosi.postinst`.


Discussion:

Resolving patch:
diff --git a/mkosi/__init__.py b/mkosi/__init__.py
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -1735,10 +1735,13 @@ def acl_maybe_toggle(config: MkosiConfig, root: Path, uid: int, *, always: bool)
         return
 
     # getfacl complains about absolute paths so make sure we pass a relative one.
-    has_acl = f"user:{uid}:rwx" in run(["getfacl", "-n", root.relative_to(Path.cwd())], stdout=subprocess.PIPE, text=True).stdout
-    if not has_acl and not always:
-        yield
-        return
+    if root.exists():
+        has_acl = f"user:{uid}:rwx" in run(["getfacl", "-n", root.relative_to(Path.cwd())], stdout=subprocess.PIPE, text=True).stdout
+        if not has_acl and not always:
+            yield
+            return
+    else:
+        has_acl = False
 
     try:
         if has_acl:
@@ -1747,7 +1750,9 @@ def acl_maybe_toggle(config: MkosiConfig, root: Path, uid: int, *, always: bool)
 
         yield
     finally:
-        setfacl(root, uid, allow=True)
+        if has_acl or always:
+            with complete_step(f"Adding ACLs to {root}"):
+                setfacl(root, uid, allow=True)
 
 
 @contextlib.contextmanager
@@ -1765,7 +1770,7 @@ def acl_toggle_build(state: MkosiState) -> Iterator[None]:
                 stack.enter_context(acl_maybe_toggle(state.config, p, state.uid, always=False))
 
         for p in (state.config.cache_dir, state.config.output_dir / state.config.output):
-            if p and p.is_dir():
+            if p:
                 stack.enter_context(acl_maybe_toggle(state.config, p, state.uid, always=True))
 
         yield
diff --git a/mkosi/run.py b/mkosi/run.py
--- a/mkosi/run.py
+++ b/mkosi/run.py
@@ -286,10 +286,10 @@ def bwrap(
     ]
 
     if apivfs:
-        if not apivfs.joinpath("etc/machine-id").exists():
+        if not (apivfs / "etc/machine-id").exists():
             # Uninitialized means we want it to get initialized on first boot.
-            apivfs.joinpath("etc/machine-id").write_text("uninitialized\n")
-            apivfs.chmod(0o0444)
+            (apivfs / "etc/machine-id").write_text("uninitialized\n")
+            (apivfs / "etc/machine-id").chmod(0o0444)
 
         cmdline += [
             "--tmpfs", apivfs / "run",


Test patch: