[Bug 2150431] [NEW] netboot tarball ships kernel with mode 0600

[Michael Hudson-Doyle]

Public bug reported:

[Impact]

The netboot tarball produced by livecd-rootfs
(livecd.ubuntu-server.netboot.tar.gz) contains the kernel and initrd with
mode 0600, owned by root:

  $ tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/linux
  -rw------- root/root  17275272 2026-04-27 21:41 ./amd64/linux

The contents of this tarball are extracted and published directly on
releases.ubuntu.com, and as the sync script between them runs as an 
unprivileged user, this blocks publication of the netboot artifacts.

The root cause is that the kernel package installs /boot/vmlinuz-*
with mode 0600. livecd-rootfs copies the kernel into the ISO casper 
directory using plain `cp`, which preserves the source mode, and the 
netboot tarball hook then copies it again the same way, so the
restrictive permission propagates all the way into the published tarball.

[Test Plan]

1. Build an ubuntu-server netboot tarball using the new livecd-rootfs

2. Inspect the kernel and initrd permissions inside the tarball:

     tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/linux
     tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/initrd

   Without the fix, both files are -rw------- root/root.
   With the fix, both files are -rw-r--r-- root/root.

3. Optionally, extract the tarball as an unprivileged user and confirm
   the files can be read.

[Where problems could occur]

The change forces mode 0644 on the kernel and initrd as they are staged
into the ISO's casper directory (in the iso_install_kernel helper). The
files are produced by the build, never installed onto a running system,
so relaxing their permissions has no effect on the host being built on.

The casper kernel/initrd inside the resulting ISO will also be 0644
rather than 0600, but in practice ISO9660 file modes are overridden at
mount time by the kernel's iso9660 driver (mode= mount option) and are
not consulted by bootloaders, so this is not expected to be observable.

If a downstream consumer was relying on the kernel being 0600 inside the
casper directory or netboot tarball (e.g. a custom build script that
inspects modes), they would see the new 0644 mode instead. This seems very
unlikely to be a proble,.

[Other Info]

The fix is a one-line change in live-build/functions, replacing `cp` with
`install -m 0644` in iso_install_kernel so every consumer of the casper
kernel/initrd (the ISO itself, the netboot tarball, and any other hook
that reads from $CASPER_DIR) gets a world-readable kernel.

** Affects: livecd-rootfs (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2150431

Title:
  netboot tarball ships kernel with mode 0600

Status in livecd-rootfs package in Ubuntu:
  New

Bug description:
  [Impact]

  The netboot tarball produced by livecd-rootfs
  (livecd.ubuntu-server.netboot.tar.gz) contains the kernel and initrd with
  mode 0600, owned by root:

    $ tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/linux
    -rw------- root/root  17275272 2026-04-27 21:41 ./amd64/linux

  The contents of this tarball are extracted and published directly on
  releases.ubuntu.com, and as the sync script between them runs as an 
  unprivileged user, this blocks publication of the netboot artifacts.

  The root cause is that the kernel package installs /boot/vmlinuz-*
  with mode 0600. livecd-rootfs copies the kernel into the ISO casper 
  directory using plain `cp`, which preserves the source mode, and the 
  netboot tarball hook then copies it again the same way, so the
  restrictive permission propagates all the way into the published tarball.

  [Test Plan]

  1. Build an ubuntu-server netboot tarball using the new livecd-rootfs

  2. Inspect the kernel and initrd permissions inside the tarball:

       tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/linux
       tar tvfz livecd.ubuntu-server.netboot.tar.gz ./amd64/initrd

     Without the fix, both files are -rw------- root/root.
     With the fix, both files are -rw-r--r-- root/root.

  3. Optionally, extract the tarball as an unprivileged user and confirm
     the files can be read.

  [Where problems could occur]

  The change forces mode 0644 on the kernel and initrd as they are staged
  into the ISO's casper directory (in the iso_install_kernel helper). The
  files are produced by the build, never installed onto a running system,
  so relaxing their permissions has no effect on the host being built on.

  The casper kernel/initrd inside the resulting ISO will also be 0644
  rather than 0600, but in practice ISO9660 file modes are overridden at
  mount time by the kernel's iso9660 driver (mode= mount option) and are
  not consulted by bootloaders, so this is not expected to be observable.

  If a downstream consumer was relying on the kernel being 0600 inside the
  casper directory or netboot tarball (e.g. a custom build script that
  inspects modes), they would see the new 0644 mode instead. This seems very
  unlikely to be a proble,.

  [Other Info]

  The fix is a one-line change in live-build/functions, replacing `cp` with
  `install -m 0644` in iso_install_kernel so every consumer of the casper
  kernel/initrd (the ISO itself, the netboot tarball, and any other hook
  that reads from $CASPER_DIR) gets a world-readable kernel.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2150431/+subscriptions