| Summary: | Latest mock breaks usage of yum in buildroot | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mathieu Bridon <bochecha> | ||||||
| Component: | mock | Assignee: | Clark Williams <williams> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 14 | CC: | mebrown, susi.lehtola, williams | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | |||||||||
| : | 749979 (view as bug list) | Environment: | |||||||
| Last Closed: | 2012-06-21 17:28:54 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 749979 | ||||||||
| Attachments: |
|
||||||||
|
Description
Mathieu Bridon
2011-10-28 03:37:08 UTC
*** Bug 749979 has been marked as a duplicate of this bug. *** I appreciate the BZ's :) When I reworked the shell/chroot logic I must have broken the uid/gid setting logic, so I'll look at it and see if I can bring us back to the previous behavior. I also need to look at the implications of someone running a root-shell inside the chroot. I personally don't have a problem with someone doing this on their own box, but I suspect the security folks would have a problem with interactive root shells on the Fedora builders. Maybe I'll add a config that disables root shells while I'm at it... Created attachment 530795 [details]
Patch to make uid/gid handling with --shell similar to previous behavior
This patch makes the default uid/gid inside a --shell chroot be root/root. This behavior may be changed by two mechanisms:
1. The --unpriv option, meaning the uid/gid will be mockbuild/mockbuild
2. The config option 'no_root_shells' which disallows any interactive root shells inside the chroot.
Please try this patch and let me know if it fixes your issues.
Since this isn't a patch that can be run on a vanilla system, please provide a koji scratch built rpm... I just applied the patch on the latest mock for Fedora 14 and have verified that: - by default, uid/gid are root inside the shell, so I could run a yum install without any issue, as I coul previously. - the --unpriv option works as advertised: uid/gid are mockbuild and I can't run a yum install command. About the --no_root_shells, is it supposed to be a "always --unpriv" option (i.e when running a --shell even without --unpriv, it is implied)? That's what I had understood from your comment, but it seems like it plainly refuses to run a shell if you don't also specify --unpriv. If that's expected then the patch works great. Thanks for being so quick! :) (In reply to comment #5) > I just applied the patch on the latest mock for Fedora 14 and have verified > that: > - by default, uid/gid are root inside the shell, so I could run a yum install > without any issue, as I coul previously. > - the --unpriv option works as advertised: uid/gid are mockbuild and I can't > run a yum install command. Good! > > About the --no_root_shells, is it supposed to be a "always --unpriv" option > (i.e when running a --shell even without --unpriv, it is implied)? > > That's what I had understood from your comment, but it seems like it plainly > refuses to run a shell if you don't also specify --unpriv. > > If that's expected then the patch works great. Thanks for being so quick! :) Sigh, no if you set no_root_shells then it should imply --nopriv. Lemme see what I did wrong there... Created attachment 530978 [details]
Patch to make uid/gid handling with --shell similar to previous behavior
Fix unintended behavior from previous patch. Using the 'no_root_shells' config should imply the --unpriv behavior (i.e. uid's are forced to mockbuild id's).
|