Repository navigation
fix(build): apply kwin_wayland cap_sys_nice under fakecap, not in the bst sandbox - #356
Merged
Merged
Conversation
… sandbox build_final in run 37069338183 failed integrating oci/kde-linux/filesystem.bst and oci/layers/tromso-runtime.bst on `setcap cap_sys_nice+ep /usr/bin/kwin_wayland` (exit 1). That setcap was a public integration command on oci/kde-linux/stack.bst, and BuildStream's sandbox cannot write security.capability xattrs, so every compose element staging the stack failed. It has been there since May; the build simply never got this far. Drop it from the integration commands and set the capability in the OCI assembly scripts instead, which run with freedesktop-sdk's fakecap LD_PRELOAD (its documented answer for setcap in components/shadow.bst). oci/tromso.bst already did this for the published image; oci/kde-linux/ image.bst now does too. build-oci records fakecap'd xattrs as SCHILY.xattr headers and compares them against the parent, so the cap reaches the layer. build_final now getcap's /usr/bin/kwin_wayland in the exported image and fails if cap_sys_nice is missing. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TexZnEN3jq4jRUi8T3zZuY Signed-off-by: hanthor <hanthor@users.noreply.github.com>
Member
Author
|
Local check of the mechanism (Fedora container, unprivileged uid with an empty bounding set, freedesktop-sdk 25.08.9 |
hanthor
added a commit
that referenced
this pull request
Oct 3, 2026
#359) With #356 in, build_final (run 37102603548) got past the compose integrations; the fakecap setcap in image.bst succeeded. The next command, `glib-compile-schemas /layer/usr/share/glib-2.0/schemas`, then failed with exit 127: the element never build-depended on glib. oci/tromso.bst already does; mirror it. Claude-Session: https://claude.ai/code/session_01TexZnEN3jq4jRUi8T3zZuY Signed-off-by: hanthor <hanthor@users.noreply.github.com> Co-authored-by: hanthor <hanthor@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run 37069338183 got through every chunk, then
build_finalfailed integratingoci/kde-linux/filesystem.bstandoci/layers/tromso-runtime.bst:Cause.
oci/kde-linux/stack.bstran thatsetcapas a public integration command. Integration commands run in BuildStream's sandbox, which cannot writesecurity.capabilityxattrs. Every compose element that stages the stack therefore failed. The command has been there since May (8d1f30e); the build never reached it before #354/#355.Fix. Remove it from the integration commands. Set the capability instead in the OCI assembly scripts, which run under freedesktop-sdk's
fakecapLD_PRELOAD. That is freedesktop-sdk's own documented answer (seecomponents/shadow.bst: "If those fail, please use components/fakecap.bst in LD_PRELOAD").oci/tromso.bst(the published image) already ransetcap cap_sys_nice+ep /layer/usr/bin/kwin_waylandunder fakecap.oci/kde-linux/image.bstnow does the same, so the intermediate KDE Linux image keeps parity.build-ocireads the fakecap'd xattrs and writes them asSCHILY.xattr.*headers. It also compares xattrs against the parent layer, so the file lands in the layer with the cap.Verification.
build_finalnow runsgetcap /usr/bin/kwin_waylandon the exported image. It fails ifcap_sys_niceis missing.xfce-linux has no
setcapin any integration command; it already uses fakecap inoci/xfce-linux.bst.🤖 Generated with Claude Code
https://claude.ai/code/session_01TexZnEN3jq4jRUi8T3zZuY