Hi,

live-build recently lost the ability to produce working installed
systems (when using the Install option from the boot menu) on Trixie.
The root filesystem is created with mode 0750 instead of 0755, which
in turns prevents most services from starting (dbus, lightdm, many
others), inability to login as a non-root user, etc

I first noticed this when building a custom desktop system, but ended
up removing almost all customizations/packages to make sure they were
not causing the problem.

You can find a minimal example configuration that allows reproducing
the problem here:

$ tree
.
├── auto
│   ├── build
│   ├── clean
│   └── config
└── config
    ├── archives
    │   ├── debian-updates-security-backports.list.binary
    │   └── debian-updates-security-backports.list.chroot
    ├── includes.installer
    │   └── preseed.cfg
    └── package-lists
        ├── 00-important.list.chroot
        └── 00-required.list.chroot

6 directories, 8 files


git clone -b minimal-reproduce-readonly-root-filesystem
https://github.com/nodiscc/debian-live-config/
cd debian-live-config
sudo lb config && sudo lb clean && sudo lb build

Boot the resulting ISO in a VM, select the installer option, go with
the defaults (I kept the installer preseed configuration), finish the
installation and reboot to the installed system.

Trying to login as the non-root user you created during installation
will fail. Logging in as root works but then you can see with ls -ld /
that permissions on the filesystem root are incorrect.

I was unable to track down when this problem started appearing, I was
able to build working Trixie installer images a few months ago.

Hello nodiscc,

This reproducer case does not build, I see:
```
[2025-10-18 09:58:57] lb chroot_install-packages install
P: Begin installing packages (install pass)...
Reading package lists...
Building dependency tree...
Reading state information...
E: Unable to locate package E:
E: Unable to locate package program
E: Unable to locate package grep-aptavail
E: Unable to locate package not
E: Unable to locate package found!
E: Couldn't find any package by glob 'found!'
E: Unable to locate package E:
E: Unable to locate package program
E: Unable to locate package grep-aptavail
E: Unable to locate package not
E: Unable to locate package found!
E: Couldn't find any package by glob 'found!'
E: An unexpected failure occurred, exiting...
```

So I'm currently not able to proceed to booting the ISO to reproduce
this bug report.

With kind regards,
Roland Clobus

Hi Roland,

Thanks for taking the time to look into this.

That's definitely not from my repository, there are only 2 files in there:

```
$ cat config/package-lists/*
! Packages Priority important
! Packages Priority required

$ tree config/package-lists/
config/package-lists/
├── 00-important.list.chroot
└── 00-required.list.chroot
```

I'm not getting this error at build time either,
```
...
[2025-10-24 00:20:54] lb chroot_install-packages install
P: Begin installing packages (install pass)...
Reading package lists...
Building dependency tree...
Reading state information...
adduser is already the newest version (3.152).
apt-utils is already the newest version (3.0.3).
cpio is already the newest version (2.15+dfsg-2).
cron is already the newest version (3.0pl1-197).
...
```

Make sure that your copy is clean and that you are on the same
live-build version as me? (the one from trixie)

I am only using packages from stable repositories. I also thought it
could be a preoblem in debootstrap, since this is the only direct
dependency of live-build:

```
srvadmin@builder-trixie:/var/debian-live-config$ apt policy debootstrap
debootstrap:
  Installed: 1.0.141
  Candidate: 1.0.141
  Version table:
 *** 1.0.141 500
        500 https://deb.debian.org/debian trixie/main amd64 Packages
        500 https://deb.debian.org/debian trixie/main i386 Packages
        100 /var/lib/dpkg/status
```

```
srvadmin@builder-trixie:/var/debian-live-config$ git status --ignored
On branch minimal-reproduce-readonly-root-filesystem
Your branch is up to date with
'origin/minimal-reproduce-readonly-root-filesystem'.

nothing to commit, working tree clean

srvadmin@builder-trixie:/var/debian-live-config$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.1
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

srvadmin@builder-trixie:/var/debian-live-config$ apt policy live-build
live-build:
  Installed: 1:20250505+deb13u1
  Candidate: 1:20250505+deb13u1
  Version table:
 *** 1:20250505+deb13u1 500
        500 https://deb.debian.org/debian trixie/main amd64 Packages
        500 https://deb.debian.org/debian trixie/main i386 Packages
        100 /var/lib/dpkg/status

srvadmin@builder-trixie:/var/debian-live-config$ sudo lb config && sudo lb build
...
```

The build succeeds, the ISO boots, the installer runs without apparent
errors, but the resuting filesystem cannot be traversed by any user
except root.

Can you at least reproduce a successful build using the same version
as me? The error you're getting is definitely strange and not related
to anything in the repository.

Le sam. 18 oct. 2025 à 09:53, Roland Clobus <rclobus@rclobus.nl> a écrit :

Hi,

I found the cause of the issue: I had set UMASK 022 in /etc/login.defs
on the build machine.

After setting it back to the Debian default (027) and rebuilding from
scratch, the resulting system is usable again.

Should it be mentioned in the documentation? A hardened umask value is
quite frequent on generic servers and build boxes. I argue that it
should not break the builds in such unexpected ways (Debian 12 builds
used to work even with the build box umask set to 022), but mentioning
in the live manual that the building with an umask != 022 is not
supported would be the next best thing.

Cheers