#3592 PR `merged`: ISO: mark ISO filesystem labels as write protected¶

Labels: enhancement

lzaoral opened issue at 2026-03-26 09:27:¶

Pull Request Details:¶

Type: Bug Fix / Enhancement
Impact: Normal
Reference to related issue (URL): N/A
How was this pull request tested? aarch64 Fedora Rawhide VM with one disk removed before recovery
Description of the changes in this pull request:

ISO output may be written to a writable medium (e.g. USB stick) which should be protected against overwriting by "rear recover" as well. Otherwise, ReaR would suggest to wipe the backup if at least one of the disks is missing.

The majority of these changes have been written using Claude.

pcahyna commented at 2026-03-27 18:22:¶

How was this pull request tested? aarch64 Fedora Rawhide VM with one disk removed before recovery

Just curious, can you please share the details of the test? Did the VM have the ISO image on a (writable) virtual hard disk? Was the firmware able to boot from an ISO 9660 filesystem on a non-optical drive? (I am asking because while the firmware of "old-style" UNIX RISC hardware (like OpenFirmware) is able to do that, aarch64 has PC (Itanium...)-style UEFI and I thought that this would make a strict distinction between partitioned disks and optical drives.)

lzaoral commented at 2026-03-27 18:35:¶

Sure! The extra disk was added before mkrescue using scsi_debug. After that I applied the produced ISO image with dd to an empty virtio drive (the system drive is virtio as well). After reboot, the OVMF actually sees the device as a CDROM drive:

Shell> map
Mapping table
      FS0: Alias(s):HD0b:;BLK1:
          PciRoot(0x0)/Pci(0x5,0x0)/HD(1,GPT,A06F8786-3EAB-4A4B-B8FE-AAB492D35497,0x800,0x12C000)
      FS1: Alias(s):CD1a:;BLK5:
          PciRoot(0x0)/Pci(0x6,0x0)/CDROM(0x0)
     BLK6: Alias(s):
          VenHw(93E34C7E-B50E-11DF-9223-2443DFD72085,00)
     BLK0: Alias(s):
          PciRoot(0x0)/Pci(0x5,0x0)
     BLK2: Alias(s):
          PciRoot(0x0)/Pci(0x5,0x0)/HD(2,GPT,62BD5C5D-4871-4C9F-8A77-F7589FECD9DC,0x12C800,0x200000)
     BLK3: Alias(s):
          PciRoot(0x0)/Pci(0x5,0x0)/HD(3,GPT,EEC80CF0-88D5-4CFF-8A15-74D2A71DB1E6,0x32C800,0x10D3000)
     BLK4: Alias(s):
          PciRoot(0x0)/Pci(0x6,0x0)

I have also successfully used the same approach on x86_64 OVMF for #3593. It is possible that this UEFI behaviour is OVMF specific, though.

pcahyna commented at 2026-03-27 19:05:¶

Interesting! Looks good to me otherwise. Thank you a lot!

@rear/contributors please have a look if you want. I think it is not controversial (it matches what USB is already doing, except that the implementation is a bit different because the ISOs do not exist yet at this point so we can not query them for their label), so I would like to merge it next week.

(Side note: the RAWDISK implementation is again different: usr/share/rear/prep/RAWDISK/Linux-i386/480_initialize_write_protect_settings.sh )

jsmeix commented at 2026-03-31 12:33:¶

@pcahyna
I dared to assign it to you
because you did a thorough review
so feel free to merge it as you like.

pcahyna commented at 2026-04-01 10:12:¶

Thank you for having had a look - merging!

[Export of Github issue for rear/rear.]

#3592 PR merged: ISO: mark ISO filesystem labels as write protected¶