Stop using the tools tree for the ssh verb

This allows us to run ssh out of the user namespace which means we
can get rid of the passwd hack to make ssh work. ssh is widespread
enough that we can require users to install it on the host machine
instead of using the tools tree.

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 6792ca7156c85666efa761d54394f26fd60fdea7..0d1ca660995759084ea5ca6542e4bb63e3297ad3 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -50,7 +50,7 @@ from mkosi.installer import clean_package_manager_metadata, package_manager_scri
 from mkosi.kmod import gen_required_kernel_modules, process_kernel_modules
 from mkosi.log import ARG_DEBUG, complete_step, die, log_notice, log_step
 from mkosi.manifest import Manifest
-from mkosi.mounts import mount, mount_overlay, mount_passwd, mount_usr
+from mkosi.mounts import mount, mount_overlay, mount_usr
 from mkosi.pager import page
 from mkosi.partition import Partition, finalize_root, finalize_roothash
 from mkosi.qemu import KernelType, QemuDeviceNode, copy_ephemeral, run_qemu, run_ssh
@@ -3183,14 +3183,13 @@ def run_verb(args: MkosiArgs, images: Sequence[MkosiConfig]) -> None:
     if args.verb == Verb.build:
         return
 
-    if last.tools_tree:
+    if last.tools_tree and args.verb != Verb.ssh:
         become_root()
 
     with contextlib.ExitStack() as stack:
-        if os.getuid() == 0:
+        if os.getuid() == 0 and args.verb != Verb.ssh:
             init_mount_namespace()
             stack.enter_context(mount_usr(last.tools_tree))
-            stack.enter_context(mount_passwd())
 
         stack.enter_context(prepend_to_environ_path(last))
 

diff --git a/mkosi/mounts.py b/mkosi/mounts.py
index c8e6f25cae094da23e8630906e6f370a2c68ea8c..26497b589f8faf57f1e7db576e6a493732ebc2e0 100644 (file)
--- a/mkosi/mounts.py
+++ b/mkosi/mounts.py
@@ -11,7 +11,7 @@ from typing import Optional
 
 from mkosi.run import run
 from mkosi.types import PathString
-from mkosi.util import INVOKING_USER, umask
+from mkosi.util import umask
 from mkosi.versioncomp import GenericVersion
 
 
@@ -145,22 +145,3 @@ def mount_usr(tree: Optional[Path]) -> Iterator[None]:
             yield
     finally:
         os.environ["PATH"] = old
-
-
-@contextlib.contextmanager
-def mount_passwd(root: Path = Path("/")) -> Iterator[None]:
-    """
-    ssh looks up the running user in /etc/passwd and fails if it can't find the running user. To trick it, we
-    mount over /etc/passwd with our own file containing our user in the user namespace.
-    """
-    with tempfile.NamedTemporaryFile(prefix="mkosi.passwd", mode="w") as passwd:
-        passwd.write("root:x:0:0:root:/root:/bin/sh\n")
-        if INVOKING_USER.uid != 0:
-            name = INVOKING_USER.name()
-            home = INVOKING_USER.home()
-            passwd.write(f"{name}:x:{INVOKING_USER.uid}:{INVOKING_USER.gid}:{name}:{home}:/bin/sh\n")
-        passwd.flush()
-        os.fchown(passwd.file.fileno(), INVOKING_USER.uid, INVOKING_USER.gid)
-
-        with mount(passwd.name, root / "etc/passwd", operation="--bind"):
-            yield