[Git-commits] [grml/grml-live] 1a46f0: grml-live: strip xattrs in squashfs

[Chris Hofstaedtler]

  Branch: refs/heads/zeha/strip-xattrs
  Home:   https://github.com/grml/grml-live
  Commit: 1a46f039c6f066ced43c8edcb464add5f54867d1
      https://github.com/grml/grml-live/commit/1a46f039c6f066ced43c8edcb464add5f54867d1
  Author: Chris Hofstaedtler <ch at grml.org>
  Date:   2024-12-10 (Tue, 10 Dec 2024)

  Changed paths:
    M grml-live

  Log Message:
  -----------
  grml-live: strip xattrs in squashfs

Ignore all extended attributes from files in chroot when adding them to the
squashfs.

This avoids:

1) leaking containerization supplied selinux attributes into the squashfs,
which can be seen when building in podman, and in docker.

2) prevents unpacking errors in a later build-only step in containers not
supporting xattrs. Can also be seen in podman.

On a normal machine and also on a normal (booted) Grml system, the only things
having xattrs are:

file: var/log/journal
system.posix_acl_access
system.posix_acl_default

file: var/log/journal/1e77092b16004314a93d779757d513ac
system.posix_acl_access
system.posix_acl_default

Both of these are apparently applied by systemd/journald during boot, even if
the filesystem does not have them.



To unsubscribe from these emails, change your notification settings at https://github.com/grml/grml-live/settings/notifications