[PATCH 01/20] scripts/make-erofs.sh: Ensure that / is world-readable

Demi Marie Obenour
2025-09-04T23:47:48Z

Previously it had 0700 permissions, which was hidden because everything
ran as root anyway. However, dbus-broker fails to start in this case
because it always drops privileges. Also set umask to 0022 to ensure
that the permissions of other directories are correct.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
scripts/make-erofs.sh | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh
index b47048ad747bd7dfcc28e0f1dfd75ec090fa7e09..88e3885e578a6fd85a61c6f2993a9addb7f44c37 100755
--- a/scripts/make-erofs.sh
+++ b/scripts/make-erofs.sh
@@ -8,6 +8,7 @@
# single directory structure, and could generate an EROFS image
# based on source:dest mappings directly.

+umask 0022 # for permissions
ex_usage() {
echo "Usage: make-erofs.sh [options]... img < srcdest.txt" >&2
exit 1
@@ -18,8 +19,12 @@ if [ -z "${img-}" ]; then
ex_usage
fi

-root="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")"
-trap 'chmod -R +w -- "$root" && rm -rf -- "$root"' EXIT
+superroot="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")"
+trap 'chmod -R +w -- "$root" && rm -rf -- "$superroot"' EXIT
+# $superroot has 0700 permissions, so create a subdirectory
+# with correct (0755) permissions and do all work there.
+root=$superroot/real_root
+mkdir -- "$root"

while read -r arg1; do
read -r arg2 || ex_usage

--
2.51.0