Bug 1641252 - Use of nspawn blocks a socket mock needs for its pm_request plugin
Summary: Use of nspawn blocks a socket mock needs for its pm_request plugin
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1641187 1641191
TreeView+ depends on / blocked
 
Reported: 2018-10-20 13:49 UTC by Nicolas Mailhot
Modified: 2018-11-09 12:48 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1641253 (view as bug list)
Environment:
Last Closed: 2018-11-09 12:48:03 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github rpm-software-management mock issues 218 0 None None None 2018-10-20 13:50:20 UTC

Description Nicolas Mailhot 2018-10-20 13:49:33 UTC 
When activating the nspawn mock extension in EPEL or Fedora mock, the pm request stops working, because the socket the pm request client uses to talk to mock is blocked.

There is probably a bad security rule somewhere.

This is blocking pm request activation in koji and copr
Comment 1 Lukas Vrabec 2018-11-03 12:19:46 UTC 
Hi, 

Could you please reproduce it and attach output of:

# ausearch -m AVC -ts recent 

Thanks,
Lukas.
Comment 2 Nicolas Mailhot 2018-11-09 12:48:03 UTC 
In
https://github.com/rpm-software-management/mock/issues/218

mock upstream seems to think the problem is a bad nspawn configuration. I hoped they would finish the nspawn fix to confirm the selinux part is ok, but it is taking time.

So, I'll tentatively close this to avoid wasting your time while upstream fixes the nspawn conf.
Note You need to log in before you can comment on or make changes to this bug.