Bug 1168116 - mock has lost multiuser capablity (ccache plugin)
Summary: mock has lost multiuser capablity (ccache plugin)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mock
Version: 21
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Miroslav Suchý
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-26 08:01 UTC by Ralf Corsepius
Modified: 2015-02-20 00:33 UTC (History)
6 users (show)

Fixed In Version: mock-1.2.6-1.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-21 23:08:50 UTC


Attachments (Terms of Use)

Description Ralf Corsepius 2014-11-26 08:01:08 UTC
Description of problem:

Mock on f21 has lost the multiuser capability.

AFAICT, there are permissions issues with ccache.

Version-Release number of selected component (if applicable):
mock-1.1.41-3.fc21.noarch

How reproducible:
Always

Steps to Reproduce:
1. Set up mock. Add a mock group and add 2 users to this group.
2. Let user1 build an arched package which is using a compiler.

E.g. 
# mock -r fedora-rawhide-x86_64 /tmp/zlib-1.2.8-7.fc22.src.rpm

3. Subsequently let user2 the same package.
# mock -r fedora-rawhide-x86_64 /tmp/zlib-1.2.8-7.fc22.src.rpm

Actual results:

Build2 fails.
...
+ ./configure --libdir=/usr/lib64 --includedir=/usr/include --prefix=/usr
Checking for gcc...
Compiler error reporting is too harsh for ./configure (perhaps remove -Werror).
** ./configure aborting.

Checking details (/var/lib/mock/fedora-rawhide-x86_64/root/builddir/build/BUILD/zlib-1.2.8/configure.log) tells: 
...
ccache: FATAL: Error creating /tmp/ccache/tmp/ztest15320.tmp.barnaby.15356.i: Permission denied
...

Expected results:
mock to be multiuser-capable.


Additional info:
AFAIS, the files under /var/cache/mock/fedora-rawhide-x86_64/ccache are generated with a wrong gid. They are generated with the user's actual gid and not with gid "mock", which renders these files unmodifyable to other users with a different "gid".

Comment 1 Miroslav Suchý 2014-11-26 08:13:19 UTC
1) using the same buildroot for two paralel build is not good idea as those builds may affects each other.

2) there is in updates-testing new mock-1.2.2 which has lots of changes, you may want to try that one.

3) I done:
  mock -r fedora-20-i386 --uniqueext=foo zlib-1.2.8-7.fc22.src.rpm && \
  mock -r fedora-20-i386 --uniqueext=bar zlib-1.2.8-7.fc22.src.rpm

And it run without problem.

Comment 2 Ralf Corsepius 2014-11-26 08:38:16 UTC
(In reply to Miroslav Suchý from comment #1)
> 1) using the same buildroot for two paralel build is not good idea as those
> builds may affects each other.

I am not using them in parallel, I am using them sequentially.

That said, 

1. This used to work - Now it's broken => Serious regression.

2. A stateful program, which doesn't take into account a multi-user environments constraints is broken by definition/design.

3. The fact you can work-around this issue is not a solution. It's a work-around around a defect and around this regression.

Comment 3 Miroslav Suchý 2015-01-15 16:33:44 UTC
Fixed in commit 6fd0bca

Note that default ccache path is now:
%(cache_topdir)s/%(root)s/ccache/u%(chrootuid)s/

So every user has its own ccache, which should address security risk raised in past.

Comment 4 Ralf Corsepius 2015-01-15 17:03:34 UTC
(In reply to Miroslav Suchý from comment #3)
> So every user has its own ccache, which should address security risk raised
> in past.
Well, I am not sure if I like this change, because it means mock will gradually fill the file systems.

BTW: I am observing a massive performance regression with rawhide chroots on F21 (Setting up chroots is factor 2-10 slower for rawhide than for f20 and f21). No  idea about the cause, but my gut feeling is caching is not working. I guess, I should file a separate bug on this issue ;)

Comment 5 Fedora Update System 2015-01-16 09:56:30 UTC
mock-1.2.4-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mock-1.2.4-1.fc21

Comment 6 Fedora Update System 2015-01-16 09:57:09 UTC
mock-1.2.4-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mock-1.2.4-1.fc20

Comment 7 Fedora Update System 2015-01-16 10:00:53 UTC
mock-1.2.4-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mock-1.2.4-1.el7

Comment 8 Fedora Update System 2015-01-16 10:01:32 UTC
mock-1.2.4-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/mock-1.2.4-1.el6

Comment 9 Miroslav Suchý 2015-01-16 10:24:42 UTC
BTW you may want to redefine in site-default.cfg the default:
  #config_opts['plugin_conf']['ccache_opts']['dir'] = "%(cache_topdir)s/%(root)s/ccache/u%(chrootuid)s/
to 
  config_opts['plugin_conf']['ccache_opts']['dir'] = "%(cache_topdir)s/%(root)s/ccache/

and then you will have shared ccache as previously and each run of mock the cache is chowned to unprivileg uid of user who run mock. But then you will have that security problem (which was in mock always) and you can not run two mocks in paralell because you may likely hit race condition on that chown.

Comment 10 Miroslav Suchý 2015-01-16 10:27:19 UTC
That security problems are described in bug 432062

Comment 11 Fedora Update System 2015-01-16 19:10:10 UTC
Package mock-1.2.4-1.el7:
* should fix your issue,
* was pushed to the Fedora EPEL 7 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing mock-1.2.4-1.el7'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-0312/mock-1.2.4-1.el7
then log in and leave karma (feedback).

Comment 12 Fedora Update System 2015-01-21 23:08:50 UTC
mock-1.2.4-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2015-01-27 03:04:21 UTC
mock-1.2.4-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2015-01-28 15:19:54 UTC
mock-1.2.5-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mock-1.2.5-1.el7

Comment 15 Fedora Update System 2015-01-28 15:21:15 UTC
mock-1.2.5-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/mock-1.2.5-1.el6

Comment 16 Fedora Update System 2015-01-28 15:22:24 UTC
mock-1.2.5-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mock-1.2.5-1.fc20

Comment 17 Fedora Update System 2015-01-28 15:23:38 UTC
mock-1.2.5-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mock-1.2.5-1.fc21

Comment 18 Fedora Update System 2015-02-02 17:22:15 UTC
mock-1.2.5-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2015-02-03 04:42:11 UTC
mock-1.2.6-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/mock-1.2.6-1.el6

Comment 20 Fedora Update System 2015-02-03 04:42:48 UTC
mock-1.2.6-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/mock-1.2.6-1.el7

Comment 21 Fedora Update System 2015-02-03 04:43:40 UTC
mock-1.2.6-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/mock-1.2.6-1.fc20

Comment 22 Fedora Update System 2015-02-03 04:44:11 UTC
mock-1.2.6-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/mock-1.2.6-1.fc21

Comment 23 Fedora Update System 2015-02-09 05:29:26 UTC
mock-1.2.6-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 24 Fedora Update System 2015-02-15 02:55:48 UTC
mock-1.2.6-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2015-02-20 00:32:33 UTC
mock-1.2.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 26 Fedora Update System 2015-02-20 00:33:32 UTC
mock-1.2.6-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.