Bug 1496911 - schroot not usable by unprivileged users (/bin/schroot not setuid)
Summary: schroot not usable by unprivileged users (/bin/schroot not setuid)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: schroot
Version: epel7
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Zach Carter
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-09-28 18:25 UTC by Nathaniel W. Turner
Modified: 2018-05-31 13:05 UTC (History)
2 users (show)

Fixed In Version: schroot-1.6.10-3.fc28 schroot-1.6.10-3.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-05-21 14:03:19 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Nathaniel W. Turner 2017-09-28 18:25:32 UTC
Description of problem:

The schroot command provides a way for unprivileged users to enter a chroot environment. This does not work. Instead, an unprivileged user gets an error similar to the following:

[someuser@myhost ~]$ schroot -c chroot1
E: chroot1-532f4144-bdfd-4160-b978-56ec27c3c0f9: Failed to lock chroot: /var/lib/schroot/session/chroot1-532f4144-bdfd-4160-b978-56ec27c3c0f9: Failed to write session file: Permission denied
[someuser@myhost ~]$

Version-Release number of selected component (if applicable):

schroot-1.6.5-5.el7.x86_64

How reproducible: 100%

Steps to Reproduce:

1. Create a simple directory chroot; e.g.:

[root@myhost /]# cat /etc/schroot/chroot.d/chroot1.conf 
[chroot1]
type=directory
directory=/root/test-chroot-tree
users=someuser
[root@myhost /]# 

2. Try entering this chroot as both root and as an unprivileged user:

[root@myhost /]# schroot -c chroot1
-bash-4.1# 

(Expected behavior.)

[someuser@myhost ~]$ schroot -c chroot1
E: chroot1-f49d7927-299f-4444-8a28-801b72b996de: Failed to lock chroot: /var/lib/schroot/session/chroot1-f49d7927-299f-4444-8a28-801b72b996de: Failed to write session file: Permission denied
[someuser@myhost ~]$

(Unexpected behavior.) 


Additional info:

This seems to be a packaging error. On Ubuntu, the schroot binary is installed setuid, but in the EPEL package, it is not:

user@ubuntu$ ll `which schroot`
-rwsr-xr-x 1 root root 1371472 Feb  1  2016 /usr/bin/schroot

user@centos7$ ll `which schroot`
-rwxr-xr-x 1 root root 1242984 Jul 18  2014 /bin/schroot

Comment 1 Fedora Update System 2018-05-03 03:45:02 UTC
schroot-1.6.10-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-dce4e36c31

Comment 2 Fedora Update System 2018-05-03 20:23:22 UTC
schroot-1.6.10-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-dce4e36c31

Comment 3 Fedora Update System 2018-05-09 20:04:02 UTC
schroot-1.6.10-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b19a62674

Comment 4 Fedora Update System 2018-05-11 01:59:06 UTC
schroot-1.6.10-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b19a62674

Comment 5 Fedora Update System 2018-05-11 20:01:44 UTC
schroot-1.6.10-3.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-e79bb30016

Comment 6 Fedora Update System 2018-05-11 20:02:40 UTC
schroot-1.6.10-3.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-70339c68b5

Comment 7 Fedora Update System 2018-05-12 19:36:09 UTC
schroot-1.6.10-3.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-e79bb30016

Comment 8 Fedora Update System 2018-05-12 20:23:19 UTC
schroot-1.6.10-3.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-70339c68b5

Comment 9 Fedora Update System 2018-05-21 14:03:19 UTC
schroot-1.6.10-3.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2018-05-31 13:05:25 UTC
schroot-1.6.10-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.