From 5169c8e302854750a2c572c80a490dfcc31f3fa0 Mon Sep 17 00:00:00 2001
From: Nick Anderson <nick@cmdln.org>
Date: Tue, 11 Aug 2026 17:08:49 -0500
Subject: [PATCH 1/2] Excluded the rootless container store from chown of
 jenkins home

chown(2) clears setuid bits even when the owner is unchanged, so the pre-build
chown -R stripped /usr/bin/sudo inside stored image layers and broke every
container build that reused an image.

Ticket: CFE-90
Changelog: none
---
 ci/setup-cfengine-build-host.sh | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh
index 2b2c84f10..40b0e2a74 100755
--- a/ci/setup-cfengine-build-host.sh
+++ b/ci/setup-cfengine-build-host.sh
@@ -14,6 +14,19 @@ if [ "$(id -u)" != "0" ]; then
     exit 1
 fi
 
+# chown(2) clears setuid bits even when the owner does not change, and the
+# rootless container store lives under /home/jenkins, so a blanket chown -R
+# strips /usr/bin/sudo inside stored images and breaks the next container build.
+function chown-jenkins-home()
+{
+    if [ -f /etc/cfengine-containers-host.flag ]; then
+        find /home/jenkins -path /home/jenkins/.local/share/containers -prune \
+            -o ! -user jenkins -exec chown jenkins {} +
+    else
+        chown -R jenkins /home/jenkins
+    fi
+}
+
 ls -la /home/
 if ! id -u jenkins; then
     useradd jenkins -p jenkins
@@ -27,8 +40,8 @@ fuser -k "$CHROOT_ROOT" >/dev/null 2>&1 || true
 umount "${CHROOT_ROOT}proc" >/dev/null 2>&1 || true
 
 # ENT-14386 often it seems we are experiencing a race condition with this script and something else causing trouble
-if ! chown -R jenkins /home/jenkins; then
-  echo "ENT-14386 some trouble chown -R jenkins /home/jenkins, current processes are:"
+if ! chown-jenkins-home; then
+  echo "ENT-14386 some trouble chowning /home/jenkins, current processes are:"
   ps -efl
 fi
 
@@ -78,7 +91,7 @@ function cleanup() {
         ps -efl | grep cf
     fi
     ls -l /home
-    chown -R jenkins /home/jenkins
+    chown-jenkins-home
     echo "Done with cleanup()"
 }
 

From 48beb18ecdcfe0a959b31b94ce377aca232f79a1 Mon Sep 17 00:00:00 2001
From: Nick Anderson <nick@cmdln.org>
Date: Tue, 11 Aug 2026 17:11:25 -0500
Subject: [PATCH 2/2] Revert "Added subordinate id ranges for jenkins on CI
 container hosts"

This reverts commit e19e32401b6f13e26ea01ff7d113d0729e03d420. The range was
already correct on the CI hosts; setuid bits were lost to chown, not to the id
mapping.

Ticket: CFE-90
Changelog: none
---
 ci/setup-ci-host.sh | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/ci/setup-ci-host.sh b/ci/setup-ci-host.sh
index 7cca756ba..626c886f6 100755
--- a/ci/setup-ci-host.sh
+++ b/ci/setup-ci-host.sh
@@ -25,28 +25,6 @@ function file-line()
   fi
 }
 
-# Replaces an existing range for the user rather than appending a second one.
-subids_changed=0
-function subid-range()
-{
-  local file=$1
-  local user=$2
-  local range=$3
-
-  touch "$file"
-  if grep -q "^$user:$range\$" "$file"; then
-    return
-  fi
-  if grep -q "^$user:" "$file"; then
-    echo "Correcting $user range in $file to $range"
-    sed -i "s|^$user:.*|$user:$range|" "$file"
-  else
-    echo "Adding $user:$range to $file"
-    echo "$user:$range" >> "$file"
-  fi
-  subids_changed=1
-}
-
 function github-known-hosts()
 {
   echo "ensuring github hostkeys are added to /home/jenkins/.ssh/known_hosts"
@@ -129,17 +107,6 @@ jenkins ALL=NOPASSWD: /usr/bin/podman
 EOF
         chmod 400 /etc/sudoers.d/999-local
         chown root:root /etc/sudoers.d/999-local
-
-        # Without a subordinate id range, rootless container storage runs single-uid
-        # and drops setuid bits while extracting layers, breaking sudo in the image.
-        subid-range /etc/subuid jenkins 100000:65536
-        subid-range /etc/subgid jenkins 100000:65536
-        if [ "$subids_changed" = 1 ]; then
-            # Remap storage and discard images extracted under the previous mapping:
-            # migrate cannot restore setuid bits, so those images must be rebuilt.
-            su - jenkins -c 'podman system migrate'
-            su - jenkins -c 'buildah rmi --all --force'
-        fi
     fi
     exit 0
 fi