Details

Reviewers

jlduran
jrm
ashish

Summary

NanoBSD images should retain file flags set by the installation process (such as the schg flag on /var/empty) to match a standard FreeBSD installation. Unconditionally stripping system flags with chflags -R noschg after installworld removes these expected security flags.

clean_world() already takes care of clearing noschg when wiping NANO_WORLDDIR and NANO_OBJ during clean builds.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 76297
Build 73180: arc lint + arc unit

Event Timeline

senguptaangshuman17_gmail.com created this revision.Wed, Aug 19, 10:19 AM

Herald added a subscriber: imp. · View Herald TranscriptWed, Aug 19, 10:19 AM

senguptaangshuman17_gmail.com requested review of this revision.Wed, Aug 19, 10:19 AM

Harbormaster completed remote builds in B75710: Diff 184322.Wed, Aug 19, 10:19 AM

senguptaangshuman17_gmail.com added a parent revision: D58956: nanobsd: Use local repository cache for precompiled package base builds.Wed, Aug 19, 10:19 AM

senguptaangshuman17_gmail.com added a child revision: D58958: nanobsd: Fix pkg audit.

I would recommend squashing the majority of this commit with D58931, as the changes are mostly NFC (the leftovers).

tools/tools/nanobsd/defaults.sh
1046–1047	This is a "functional" change and should be submitted separately.

senguptaangshuman17_gmail.com updated this revision to Diff 184457.Thu, Aug 20, 10:10 AM

Harbormaster completed remote builds in B75791: Diff 184457.Thu, Aug 20, 10:10 AM

senguptaangshuman17_gmail.com updated this revision to Diff 184505.Thu, Aug 20, 12:22 PM

Harbormaster completed remote builds in B75834: Diff 184505.Thu, Aug 20, 12:22 PM

Isolate functional change (disable chflags in install_world) and normalize comments

Herald added a reviewer: scheduler. · View Herald TranscriptThu, Aug 20, 7:02 PM

Harbormaster completed remote builds in B75912: Diff 184598.Thu, Aug 20, 7:02 PM

senguptaangshuman17_gmail.com retitled this revision from nanobsd: Cleanup common functions to nanobsd: Disable chflags call in install_world().Thu, Aug 20, 7:04 PM

senguptaangshuman17_gmail.com added a child revision: D58959: nanobsd: Disable pkg repositories on target image.Thu, Aug 20, 7:16 PM

lwhsu removed a reviewer: scheduler.Thu, Aug 20, 8:15 PM

senguptaangshuman17_gmail.com updated this revision to Diff 184832.Sun, Aug 23, 11:02 PM

Harbormaster completed remote builds in B76018: Diff 184832.Sun, Aug 23, 11:02 PM

Commit message needs a why.

senguptaangshuman17_gmail.com updated this revision to Diff 184967.Tue, Aug 25, 6:11 AM

Harbormaster completed remote builds in B76090: Diff 184967.Tue, Aug 25, 6:11 AM

senguptaangshuman17_gmail.com retitled this revision from nanobsd: Disable chflags call in install_world() to nanobsd: Remove chflags call in install_world().Tue, Aug 25, 6:13 AM

senguptaangshuman17_gmail.com edited the summary of this revision. (Show Details)Tue, Aug 25, 6:25 AM

Rebase stack on top of D59043 update

Harbormaster completed remote builds in B76118: Diff 184995.Tue, Aug 25, 7:59 AM

While I do agree with the change, I do not fully agree with the commit message.
For me, the reason we want to remove this step is because we want to ship a NanoBSD image with the flags set just like a normal FreeBSD installation (/var/empty for instance).

In D58957#1357961, @jlduran wrote:

While I do agree with the change, I do not fully agree with the commit message.
For me, the reason we want to remove this step is because we want to ship a NanoBSD image with the flags set just like a normal FreeBSD installation (/var/empty for instance).

will this work?

nanobsd: Remove chflags call in install_world()
     
NanoBSD images should retain file flags set by the installation process
(such as the schg flag on /var/empty) to match a standard FreeBSD
installation. Unconditionally stripping system flags with chflags -R noschg
after installworld removes these expected security flags.
    
clean_world() already takes care of clearing noschg when wiping
NANO_WORLDDIR and NANO_OBJ during clean builds.
     
Sponsored by:   Google LLC (GSoC 2026)
Differential Revision:  https://reviews.freebsd.org/D58957

In D58957#1357973, @senguptaangshuman17_gmail.com wrote:
In D58957#1357961, @jlduran wrote:

While I do agree with the change, I do not fully agree with the commit message.
For me, the reason we want to remove this step is because we want to ship a NanoBSD image with the flags set just like a normal FreeBSD installation (/var/empty for instance).

will this work?
nanobsd: Remove chflags call in install_world()
     
NanoBSD images should retain file flags set by the installation process
(such as the schg flag on /var/empty) to match a standard FreeBSD
installation. Unconditionally stripping system flags with chflags -R noschg
after installworld removes these expected security flags.
    
clean_world() already takes care of clearing noschg when wiping
NANO_WORLDDIR and NANO_OBJ during clean builds.
     
Sponsored by:   Google LLC (GSoC 2026)
Differential Revision:  https://reviews.freebsd.org/D58957