Description of problem:

I run fedora-review in a dedicated user account for a little extra isolation:

> $ id reviewer
> uid=1001(reviewer) gid=1001(reviewer) groups=1001(reviewer),135(mock)
> $ getent passwd reviewer
> reviewer:x:1001:1001::/home/reviewer:/sbin/nologin

I usually access it like this:

> $ sudo -u reviewer -s screen

Inside the screen session:

> $ id
> uid=1001(reviewer) gid=1001(reviewer) groups=1001(reviewer),135(mock) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Historically, this has worked great. Since fedora-review 0.8.0 and mock 3, I am unable to straightforwardly run fedora-review in this environment. More details and a workaround follow.

Version-Release number of selected component (if applicable): fedora-review-0.8.0-1.fc35, mock-3.0-1.fc35


How reproducible:


Steps to Reproduce:
1. Use sudo to change to a non-root user.
2. fedora-review -b 2027121

Actual results:

> INFO: Processing bugzilla bug: 2027121
> INFO: Getting .spec and .srpm Urls from : 2027121
> INFO:   --> SRPM url: https://music.fedorapeople.org/20220228/casc-1.0.5-1.fc35.src.rpm
> INFO:   --> Spec url: https://music.fedorapeople.org/20220228/casc.spec
> INFO: Using review directory: /home/reviewer/2027121-casc
> INFO: Downloading .spec and .srpm files
> INFO: Downloading (Source0): https://github.com/ctlee/casc/archive/v1.0.5/casc-1.0.5.tar.gz
> INFO: Running checks and generating report
> INFO: Results and/or logs in: /home/reviewer/2027121-casc/results
> ERROR: Exception down the road... (logs in /home/reviewer/.cache/fedora-review.log)

From /home/reviewer/.cache/fedora-review.log:

> Traceback (most recent call last):
>   File "/usr/lib/python3.10/site-packages/FedoraReview/review_helper.py", line 236, in run
>     self._do_run(outfile)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/review_helper.py", line 226, in _do_run
>     self._do_report(outfile)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/review_helper.py", line 99, in _do_report
>     self._run_checks(self.bug.spec_file, self.bug.srpm_file, outfile)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/review_helper.py", line 117, in _run_checks
>     self.checks.run_checks(output=output, writedown=not Settings.no_report)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/checks.py", line 382, in run_checks
>     run_check(name)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/checks.py", line 357, in run_check
>     check.run()
>   File "/usr/lib/python3.10/site-packages/FedoraReview/plugins/generic_build.py", line 203, in run
>     Mock.build(self.srpm.filename)
>   File "/usr/lib/python3.10/site-packages/FedoraReview/mock.py", line 449, in build
>     self.builddir_cleanup()
>   File "/usr/lib/python3.10/site-packages/FedoraReview/mock.py", line 576, in builddir_cleanup
>     paths = glob(os.path.join(self.get_builddir("BUILD"), "*"))
>   File "/usr/lib/python3.10/site-packages/FedoraReview/mock.py", line 352, in get_builddir
>     p = self._get_dir(os.path.join("root", self._topdir[1:]))
>   File "/usr/lib/python3.10/site-packages/FedoraReview/mock.py", line 193, in _get_dir
>     self._get_root()
>   File "/usr/lib/python3.10/site-packages/FedoraReview/mock.py", line 176, in _get_root
>     config_opts = mockbuild.config.simple_load_config(config)
>   File "/usr/lib/python3.10/site-packages/mockbuild/trace_decorator.py", line 93, in trace
>     result = func(*args, **kw)
>   File "/usr/lib/python3.10/site-packages/mockbuild/config.py", line 790, in simple_load_config
>     uidManager = setup_uid_manager()
>   File "/usr/lib/python3.10/site-packages/mockbuild/trace_decorator.py", line 93, in trace
>     result = func(*args, **kw)
>   File "/usr/lib/python3.10/site-packages/mockbuild/uid.py", line 27, in setup_uid_manager
>     os.setgroups((mockgid,))
> PermissionError: [Errno 1] Operation not permitted

Expected results:

Successful fedora-review invocation.

Additional info:

In the setup_uid_manager() function in mockbuild.uid, there is an assumption that if the SUDO_UID environment variable is set (as it is in this environment), then os.setgroups() should be called to set the supplementary groups to include (only) the mock group. If the user is not root, this won’t be possible.

Based on that, this may be a mock issue instead. I filed it on fedora-review because mock builds like

> mock -r fedora-rawhide-x86_64 --rebuild 2027121-casc/srpm/casc-1.0.5-1.fc35.src.rpm

still work just fine in the same environment.

As a workaround, I can

> $ unset SUDO_UID

and fedora-review works just fine.