Bug 2372865
| Summary: | After updating mock to version 6.2-2.fc43, mock operations fail with “operation not permitted”, even though the user is still in the mock group. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikhail <mikhail.v.gavrilov> |
| Component: | mock | Assignee: | Copr Team <copr-team> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | copr-team, edpil02, kevin, msuchy, praiskup, rxguy, tflink, williams |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | mock-6.3-1.fc42 mock-6.3-1.fc41 mock-6.3-1.el10_1 mock-6.3-1.el9 mock-6.3-1.el8 mock-6.3-1.el10_0 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2025-06-21 01:27:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Mikhail
2025-06-14 20:27:42 UTC
Seeing this too here. *** Bug 2372847 has been marked as a duplicate of this bug. *** I am able to reproduce it too. Even without the group thing: ``` [mirek@vm-10-0-184-190 ~]$ mock You are not in the `mock` group. See https://rpm-software-management.github.io/mock/#setup Authenticating as "root" Password: ERROR: [Errno 1] Operation not permitted ERROR: The most common cause for this error is trying to run /usr/libexec/mock/mock as an unprivileged user. ERROR: You should not run /usr/libexec/mock/mock directly. ``` I did not find any issue with selinux (the same issue with selinux disabled). Nothing in journalctl. I suspect consolehelper. But the version is the same as in F42 where it works correctly. Not sure how to debug the consolehelper. No. Consolehelper is not in fault.
When I removed try/except that mask the error when calling main() I got:
```
concurrent.futures.process._RemoteTraceback:
"""
Traceback (most recent call last):
File "/usr/lib64/python3.14/concurrent/futures/process.py", line 254, in _process_worker
r = call_item.fn(*call_item.args, **call_item.kwargs)
File "/usr/lib/python3.14/site-packages/mockbuild/uid.py", line 170, in drop_privs_forever_and_execute
self.dropPrivsForever()
~~~~~~~~~~~~~~~~~~~~~^^
File "/usr/lib/python3.14/site-packages/mockbuild/trace_decorator.py", line 93, in trace
result = func(*args, **kw)
File "/usr/lib/python3.14/site-packages/mockbuild/uid.py", line 99, in dropPrivsForever
self._elevatePrivs()
~~~~~~~~~~~~~~~~~~^^
File "/usr/lib/python3.14/site-packages/mockbuild/trace_decorator.py", line 93, in trace
result = func(*args, **kw)
File "/usr/lib/python3.14/site-packages/mockbuild/uid.py", line 117, in _elevatePrivs
setresuid(0, 0, 0)
~~~~~~~~~^^^^^^^^^
File "/usr/lib/python3.14/site-packages/mockbuild/uid.py", line 201, in setresuid
raise OSError(ctypes.get_errno(), os.strerror(ctypes.get_errno()))
PermissionError: [Errno 1] Operation not permitted
"""
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/usr/libexec/mock/mock", line 1140, in <module>
main()
~~~~^^
File "/usr/lib/python3.14/site-packages/mockbuild/trace_decorator.py", line 93, in trace
result = func(*args, **kw)
File "/usr/libexec/mock/mock", line 718, in main
config_opts = uidManager.run_in_subprocess_without_privileges(
config.load_config, config_path, options.chroot)
File "/usr/lib/python3.14/site-packages/mockbuild/uid.py", line 183, in run_in_subprocess_without_privileges
return future.result()
~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 450, in result
return self.__get_result()
~~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 395, in __get_result
raise self._exception
PermissionError: [Errno 1] Operation not permitted
```
This is the relevant code: https://github.com/rpm-software-management/mock/blob/main/mock/py/mockbuild/uid.py#L183 Hmm. https://docs.python.org/3/library/concurrent.futures.html#concurrent.futures.ProcessPoolExecutor state: ``` Note The default multiprocessing start method (see Contexts and start methods) will change away from fork in Python 3.14. Code that requires fork be used for their ProcessPoolExecutor should explicitly specify that by passing a mp_context=multiprocessing.get_context("fork") parameter. ``` When I change the line to: with ProcessPoolExecutor(max_workers=1, mp_context=multiprocessing.get_context("fork")) as executor: It will start working. Now I have to dive into the doc and find what the change actually means. I moved upstream https://github.com/rpm-software-management/mock/issues/1594 (and came to the same conclusion) FEDORA-2025-a4de1f5844 (distribution-gpg-keys-1.113-1.fc42, mock-6.3-1.fc42, and 1 more) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-a4de1f5844 FEDORA-EPEL-2025-c1f17cc8d8 (distribution-gpg-keys-1.113-1.el9, mock-6.3-1.el9, and 1 more) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-c1f17cc8d8 FEDORA-EPEL-2025-501d68cc93 (distribution-gpg-keys-1.113-1.el10_0, mock-6.3-1.el10_0, and 1 more) has been submitted as an update to Fedora EPEL 10.0. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-501d68cc93 FEDORA-EPEL-2025-f1c7ec0cd1 (distribution-gpg-keys-1.113-1.el10_1, mock-6.3-1.el10_1, and 1 more) has been submitted as an update to Fedora EPEL 10.1. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-f1c7ec0cd1 FEDORA-2025-d6977f4688 (distribution-gpg-keys-1.113-1.fc41, mock-6.3-1.fc41, and 1 more) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-d6977f4688 FEDORA-2025-a4de1f5844 has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-a4de1f5844` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-a4de1f5844 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-EPEL-2025-501d68cc93 has been pushed to the Fedora EPEL 10.0 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-501d68cc93 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-EPEL-2025-c1f17cc8d8 has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-c1f17cc8d8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-EPEL-2025-f1c7ec0cd1 has been pushed to the Fedora EPEL 10.1 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-f1c7ec0cd1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-EPEL-2025-37d3a04300 has been pushed to the Fedora EPEL 8 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-37d3a04300 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2025-d6977f4688 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-d6977f4688` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-d6977f4688 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2025-a4de1f5844 (distribution-gpg-keys-1.113-1.fc42, mock-6.3-1.fc42, and 1 more) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2025-d6977f4688 (distribution-gpg-keys-1.113-1.fc41, mock-6.3-1.fc41, and 1 more) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-EPEL-2025-f1c7ec0cd1 (distribution-gpg-keys-1.113-1.el10_1, mock-6.3-1.el10_1, and 1 more) has been pushed to the Fedora EPEL 10.1 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-EPEL-2025-c1f17cc8d8 (distribution-gpg-keys-1.113-1.el9, mock-6.3-1.el9, and 1 more) has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-EPEL-2025-37d3a04300 (distribution-gpg-keys-1.113-1.el8, mock-6.3-1.el8, and 1 more) has been pushed to the Fedora EPEL 8 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-EPEL-2025-501d68cc93 (distribution-gpg-keys-1.113-1.el10_0, mock-6.3-1.el10_0, and 1 more) has been pushed to the Fedora EPEL 10.0 stable repository. If problem still persists, please make note of it in this bug report. |