Hacker News Reader

Hacker News

Comment by usr1106 | Hacker News Reader

Parent Full thread

usr1106

Editorialized title.

View on HN

Kind of necessary, a post simply titled Initramfs wouldn't be useful.

But isn't the article about building initramfs bottom-up, presenting the most basic tools?

I did not see anything special that would make it rootless. That seemed to be a point made by the submitter.

The article says it is but that is potentially misleading. Building an initramfs is very simple. Copy all the files you want in it and make a cpio archive. Arch's tool for doing it is just a 80 line or so bash script. In principle, it doesn't matter what user does this but only if all the files you need are readable by a non-root user.

You can't make device nodes as non-root.

You can't make them on the filesystem itself, gen_init_cpio lets you specify device nodes to be created within the archive, but they are not actually created on the live system and do not require privileges.

I made my own CPIO library: https://github.com/desultory/pycpio and one of the main goals was this behavior, so I could create CPIO archives with device nodes without privileges. It's really as simple as writing some bytes to a file saying "when you extract this, create this device node". It's not like any archive actually has a device node, just instructions for where to put them, and what properties they have.

Certainly, you can't extract these archives as non-root, but you have to go out of your way to make an initramfs have non-root privileges.

You can create any data as non-root, including the description of a device node in a cpio.

But the point is that the tooling to do this is non-obvious. The same issue exists for all these kinds of archives— container image layers, ISOs, VMDKs, debootstrap outputs, etc. All of them are things that should be possible to just emit directly into a user-owned archive, but often require mounts, overlays, chown, and who knows what else.

Another related one is about installing grub into an archived filesystem or disk image. Should be trivial, right? But most instructions for this require mounting it, which immediately means you need SYS_ADMIN and therefore a privileged container in your CI setup.

The article itself says:

>Note this is rootless, we don't need to re-create the filesystem tree locally or use fakeroot to create special file in the archive.

Sure it does. But that's not because the article shows us any new trick, it's just because they use the original and most basic tool to generate an initramfs.

gen_init_cpio is not the original cpio archiver utility. It's only obvious to know to use it if you already know about it. The Linux kernel docs cover it, sure, but the whole point of the OP is a more approachable introduction to the same information.

Reply on news.ycombinator.com