Bug 1496911

Summary:	schroot not usable by unprivileged users (/bin/schroot not setuid)
Product:	[Fedora] Fedora EPEL	Reporter:	Nathaniel W. Turner <nate>
Component:	schroot	Assignee:	Zach Carter <os>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel7	CC:	agk, os
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	schroot-1.6.10-3.fc28 schroot-1.6.10-3.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-05-21 14:03:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nathaniel W. Turner 2017-09-28 18:25:32 UTC

Description of problem:

The schroot command provides a way for unprivileged users to enter a chroot environment. This does not work. Instead, an unprivileged user gets an error similar to the following:

[someuser@myhost ~]$ schroot -c chroot1
E: chroot1-532f4144-bdfd-4160-b978-56ec27c3c0f9: Failed to lock chroot: /var/lib/schroot/session/chroot1-532f4144-bdfd-4160-b978-56ec27c3c0f9: Failed to write session file: Permission denied
[someuser@myhost ~]$

Version-Release number of selected component (if applicable):

schroot-1.6.5-5.el7.x86_64

How reproducible: 100%

Steps to Reproduce:

1. Create a simple directory chroot; e.g.:

[root@myhost /]# cat /etc/schroot/chroot.d/chroot1.conf 
[chroot1]
type=directory
directory=/root/test-chroot-tree
users=someuser
[root@myhost /]# 

2. Try entering this chroot as both root and as an unprivileged user:

[root@myhost /]# schroot -c chroot1
-bash-4.1# 

(Expected behavior.)

[someuser@myhost ~]$ schroot -c chroot1
E: chroot1-f49d7927-299f-4444-8a28-801b72b996de: Failed to lock chroot: /var/lib/schroot/session/chroot1-f49d7927-299f-4444-8a28-801b72b996de: Failed to write session file: Permission denied
[someuser@myhost ~]$

(Unexpected behavior.) 


Additional info:

This seems to be a packaging error. On Ubuntu, the schroot binary is installed setuid, but in the EPEL package, it is not:

user@ubuntu$ ll `which schroot`
-rwsr-xr-x 1 root root 1371472 Feb  1  2016 /usr/bin/schroot

user@centos7$ ll `which schroot`
-rwxr-xr-x 1 root root 1242984 Jul 18  2014 /bin/schroot

Comment 1 Fedora Update System 2018-05-03 03:45:02 UTC

schroot-1.6.10-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-dce4e36c31

Comment 2 Fedora Update System 2018-05-03 20:23:22 UTC

schroot-1.6.10-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-dce4e36c31

Comment 3 Fedora Update System 2018-05-09 20:04:02 UTC

schroot-1.6.10-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b19a62674

Comment 4 Fedora Update System 2018-05-11 01:59:06 UTC

schroot-1.6.10-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b19a62674

Comment 5 Fedora Update System 2018-05-11 20:01:44 UTC

schroot-1.6.10-3.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-e79bb30016

Comment 6 Fedora Update System 2018-05-11 20:02:40 UTC

schroot-1.6.10-3.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-70339c68b5

Comment 7 Fedora Update System 2018-05-12 19:36:09 UTC

schroot-1.6.10-3.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-e79bb30016

Comment 8 Fedora Update System 2018-05-12 20:23:19 UTC

schroot-1.6.10-3.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-70339c68b5

Comment 9 Fedora Update System 2018-05-21 14:03:19 UTC

schroot-1.6.10-3.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2018-05-31 13:05:25 UTC

schroot-1.6.10-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.