Hide Forgot
Description of problem: 1. be staff_u 2. make a src.rpm 3. run mock -r fedora-22-x86_64 --rebuild src.rpm SELinux is preventing /usr/bin/python3.4 from 'relabelto' accesses on the file /var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm. ***** Plugin restorecon_source (99.5 confidence) suggests ***************** If you want to fix the label. /usr/bin/python3.4 default label should be bin_t. Then you can run restorecon. Do # /sbin/restorecon -v /usr/bin/python3.4 ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that python3.4 should be allowed relabelto access on the policycoreutils-2.3-17.fc22.src.rpm file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep mock /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context staff_u:staff_r:mock_t:s0-s0:c0.c1023 Target Context staff_u:object_r:user_home_t:s0 Target Objects /var/lib/mock/fedora-22-x86_64/root/builddir/build /originals/policycoreutils-2.3-17.fc22.src.rpm [ file ] Source mock Source Path /usr/bin/python3.4 Port <Unknown> Host (removed) Source RPM Packages python3-3.4.3-5.fc23.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-146.fc23.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.0-0.rc8.git0.1.fc23.x86_64 #1 SMP Mon Aug 24 14:45:39 UTC 2015 x86_64 x86_64 Alert Count 2 First Seen 2015-09-10 16:38:29 CEST Last Seen 2015-09-10 16:39:43 CEST Local ID 437107b3-52e6-4a10-a56f-ca7984b874c8 Raw Audit Messages type=AVC msg=audit(1441895983.82:3139): avc: denied { relabelto } for pid=25976 comm="mock" name="policycoreutils-2.3-17.fc22.src.rpm" dev="dm-2" ino=29306 scontext=staff_u:staff_r:mock_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1441895983.82:3139): arch=x86_64 syscall=setxattr success=no exit=EACCES a0=7f2348cccb78 a1=7f2348cd6210 a2=7f2348cd0830 a3=20 items=1 ppid=25975 pid=25976 auid=13558 uid=13558 gid=135 euid=13558 suid=0 fsuid=13558 egid=135 sgid=135 fsgid=135 tty=pts3 ses=9 comm=mock exe=/usr/bin/python3.4 subj=staff_u:staff_r:mock_t:s0-s0:c0.c1023 key=(null) type=CWD msg=audit(1441895983.82:3139): cwd=/home/plautrba/devel/fedora/policycoreutils/f22 type=PATH msg=audit(1441895983.82:3139): item=0 name=/var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm inode=29306 dev=fd:02 mode=0100664 ouid=13558 ogid=135 rdev=00:00 obj=staff_u:object_r:mock_var_lib_t:s0 nametype=NORMAL Hash: mock,mock_t,user_home_t,file,relabelto Version-Release number of selected component: selinux-policy-3.13.1-146.fc23.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.0-0.rc8.git0.1.fc23.x86_64 type: libreport
What does ls -dZ /var/lib/mock show you?
mock traceback: Traceback (most recent call last): File "/usr/sbin/mock", line 832, in <module> main() File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/sbin/mock", line 649, in main run_command(options, args, config_opts, commands, buildroot, state) File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/sbin/mock", line 729, in run_command do_rebuild(config_opts, commands, buildroot, args) File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/sbin/mock", line 495, in do_rebuild post=post_build, clean=clean) File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/sbin/mock", line 440, in rebuild_generic ret = cmd(item) File "/usr/sbin/mock", line 475, in build check=config_opts['check']) File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/lib/python3.4/site-packages/mockbuild/backend.py", line 207, in build srpm = self.copy_srpm_into_chroot(srpm) File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace result = func(*args, **kw) File "/usr/lib/python3.4/site-packages/mockbuild/backend.py", line 364, in copy_srpm_into_chroot shutil.copy2(srpm_path, dest) File "/usr/lib64/python3.4/shutil.py", line 246, in copy2 copystat(src, dst, follow_symlinks=follow_symlinks) File "/usr/lib64/python3.4/shutil.py", line 213, in copystat _copyxattr(src, dst, follow_symlinks=follow) File "/usr/lib64/python3.4/shutil.py", line 153, in _copyxattr os.setxattr(dst, name, value, follow_symlinks=follow_symlinks) PermissionError: [Errno 13] Permission denied: '/var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm' mock tries to copy src.rpm and preserve all stat info including extended attributes what means that it tries to set SELinux label of a new file to it's origin label, in this case it's user_home_t. I'm not sure if it's really wanted behaviour as it would mean that there'll be files labeled with user_home_t in /var/lib/mock/ Mirek, is this intended?
Yes. Because mock is setting up the chroot environment in /var/lib/mock/fedora-22-x86_64/root/ and ./builddir/ is home (IIRC) of unprivileg user in that chroot. So from POV from inside of that chroot we want to have user_home_t on that file. From POV from outside of that chroot it can look differtn and user_home_t is probably not the best option. But I do not know about better solution (and nobody required it).
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-31d4ea5eb1
selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.