Skip to content

mkosi runs into permission errors even when running as root #4233

@clarfonthey

Description

@clarfonthey

After debugging, most likely change to introduce this was #4160.

Essentially: I run mkosi as root for various reasons, but some time between v26 and the latest git commit caused this to fail. Kind of going mad, actually, trying to debug it, because it boils down to config.build_dir.exists() being false when run via mkosi, but not when I run it via a separate Python terminal referencing the same path.

What appears to be the issue is somehow, the sandboxing called before ensure_directories_exist is preventing access to my home directory, which contains the directory with all the mkosi configurations. This is the only possible explanation I can get, seeing as this is the debug output:

‣ Loading configuration file /home/ltdk/code/codeberg/cfg-system/mkosi.conf.d/0-base.conf
‣ Loading configuration file /home/ltdk/code/codeberg/cfg-system/mkosi.conf.d/1-x86-64.conf
‣ /home/ltdk/code/codeberg/cfg-system/build/incremental.x86-64/arch~rolling~x86-64~main.cache does not exist, not reusing cached images
‣ /home/ltdk/code/codeberg/cfg-system/build/incremental.x86-64/arch~rolling~x86-64~main.cache does not exist, not reusing cached images
‣ Validating certificates and keys
‣ 0.0s for step "Validating certificates and keys"
‣ + tput cnorm
‣ + tput smam
Traceback (most recent call last):
  File "/usr/lib/python3.14/site-packages/mkosi/run.py", line 104, in uncaught_exception_handler
    yield
  File "/usr/lib/python3.14/contextlib.py", line 85, in inner
    return func(*args, **kwds)
  File "/usr/lib/python3.14/site-packages/mkosi/__main__.py", line 44, in main
    run_verb(args, tools, images, resources=resources)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/mkosi/__init__.py", line 5195, in run_verb
    ensure_directories_exist(last)
    ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.14/site-packages/mkosi/__init__.py", line 4787, in ensure_directories_exist
    p.mkdir(parents=True, exist_ok=True)
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/pathlib/__init__.py", line 1011, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/home/ltdk/code/codeberg/cfg-system/build'

When I did more testing, it appeared that the path existence check was failing… at my home directory, which is currently inaccessible to anything but my user. Which should not matter to root, but it does matter in the sandbox, presumably.

I get that running as root is an undesirable situation, but as far as I'm aware, your sandboxing isn't even good enough to run sudo inside the chroot, so, I can't even make the sandbox pretend that it's running as root for the sake of copying a few files. So, it would be nice if the sandboxing didn't totally break here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions