Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

We should do shadow-utils (e.g. useradd) with --root, not --prefix #1285

Open
praiskup opened this issue Jan 12, 2024 · 4 comments · May be fixed by #1313
Open

We should do shadow-utils (e.g. useradd) with --root, not --prefix #1285

praiskup opened this issue Jan 12, 2024 · 4 comments · May be fixed by #1313
Assignees
@praiskup

Comments

@praiskup
Copy link
Member

But it currently fails with a weird error:

$ sudo dnf-3 diff mock
Updating Subscription Management repositories.
Last metadata expiration check: 1:25:41 ago on Pá 12. ledna 2024, 15:23:00.
Binary files ./usr/lib/python3.12/site-packages/mockbuild/__pycache__/config.cpython-312.pyc and /usr/lib/python3.12/site-packages/mockbuild/__pycache__/config.cpython-312.pyc differ
Binary files ./usr/lib/python3.12/site-packages/mockbuild/__pycache__/shadow_utils.cpython-312.pyc and /usr/lib/python3.12/site-packages/mockbuild/__pycache__/shadow_utils.cpython-312.pyc differ
--- /usr/lib/python3.12/site-packages/mockbuild/config.py       2023-12-13 01:00:00.000000000 +0100
+++ /usr/lib/python3.12/site-packages/mockbuild/config.py       2024-01-12 15:58:14.890989945 +0100
@@ -313,7 +313,7 @@
     config_opts['dnf_command'] = '/usr/bin/dnf-3'
     config_opts['system_dnf_command'] = '/usr/bin/dnf-3'
     config_opts['dnf_common_opts'] = ['--setopt=deltarpm=False', '--setopt=allow_vendor_change=yes', '--allowerasing']
-    config_opts['dnf_install_command'] = 'install python3-dnf python3-dnf-plugins-core'
+    config_opts['dnf_install_command'] = 'install python3-dnf python3-dnf-plugins-core strace'
     config_opts['dnf_disable_plugins'] = ['local', 'spacewalk', 'versionlock']
     config_opts["dnf_avoid_opts"] = {}
 
--- /usr/lib/python3.12/site-packages/mockbuild/shadow_utils.py 2023-12-13 01:00:00.000000000 +0100
+++ /usr/lib/python3.12/site-packages/mockbuild/shadow_utils.py 2024-01-12 16:48:35.631059155 +0100
@@ -16,7 +16,7 @@
 
     @property
     def _chroot_opts(self):
-        return ["--prefix", self.root.make_chroot_path()]
+        return ["--root", self.root.make_chroot_path()]
 
     def _execute_command(self, command, can_fail=False):
         with self.root.uid_manager.elevated_privileges():
@@ -42,7 +42,7 @@
         """
         Create group in self.root (/etc/group modified)
         """
-        command = ["groupadd", groupname]
+        command = ["strace", "groupadd", groupname]
         if gid is not None:
             command += ["-g", str(gid)]
         self._execute_command(command)

The failure looks like (filtered):

DEBUG: openat(AT_FDCWD, "/etc/group-", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 7
DEBUG: umask(002)                              = 0777
DEBUG: fchown(7, 0, 0)                         = 0
DEBUG: fchmod(7, 0644)                         = 0
DEBUG: newfstatat(7, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
DEBUG: write(7, "root:x:0:\nbin:x:1:\ndaemon:x:2:\ns"..., 290) = 290
DEBUG: fsync(7)                                = 0
DEBUG: close(7)                                = 0
DEBUG: utimensat(AT_FDCWD, "/etc/group-", [{tv_sec=1705072132, tv_nsec=0} /* 2024-01-12T16:08:52+0100 */, {tv_sec=1705072132, tv_nsec=0} /* 2024-01-12T16:08:52+0100 */], 0) = 0
...
DEBUG: futex(0x7fb58fc12500, FUTEX_WAKE_PRIVATE, 2147483647) = 0
DEBUG: openat(AT_FDCWD, "/proc/thread-self/attr/fscreate", O_RDWR|O_CLOEXEC) = -1 ENOENT (No such file or directory)
DEBUG: gettid()                                = 2838902
DEBUG: openat(AT_FDCWD, "/proc/self/task/2838902/attr/fscreate", O_RDWR|O_CLOEXEC) = -1 ENOENT (No such file or directory)
DEBUG: openat(AT_FDCWD, "/sys/fs/selinux/enforce", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
DEBUG: openat(AT_FDCWD, "/usr/share/locale/C.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
DEBUG: openat(AT_FDCWD, "/usr/share/locale/C.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
DEBUG: openat(AT_FDCWD, "/usr/share/locale/C/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
DEBUG: write(2, "groupadd: failure while writing "..., 54groupadd: failure while writing changes to /etc/group
DEBUG: ) = 54

This needs a bit more closer observation, and report against shadow-utils project.
@github-project-automation github-project-automation bot moved this to Needs triage in CPT Kanban Jan 12, 2024
@praiskup praiskup mentioned this issue Jan 12, 2024
Open
@praiskup praiskup self-assigned this Jan 17, 2024
@praiskup praiskup moved this from Needs triage to In 3 months in CPT Kanban Jan 17, 2024
@praiskup praiskup moved this from In 3 months to In Progress in CPT Kanban Feb 5, 2024
@praiskup praiskup mentioned this issue Feb 7, 2024
Open
praiskup added a commit to praiskup/mock that referenced this issue Feb 7, 2024
@praiskup
shadow_utils: make shadow --root work by fake permissive mode
7e9d5c1 
Fixes: rpm-software-management#1285
@praiskup praiskup linked a pull request Feb 7, 2024 that will close this issue
Draft
@nikromen nikromen moved this from In Progress to In 3 months in CPT Kanban Feb 12, 2024
@praiskup
Copy link
Member Author

Work-around patch prepared (opened PR). We are just waiting till the shadow-utils/libselinux upstreams tell us what's the best way forward.

@ikerexxe
Copy link

What do you mean by workaround?

@praiskup
Copy link
Member Author

praiskup commented Feb 20, 2024 •
edited
Loading

By work-around I mean #1313 (faking <chroot>/sys/fs/selinux to avoid libselinux's "enforcing/permissive" value to shadow-utils caller).

@praiskup
Copy link
Member Author

@ikerexxe the thing is; in-chroot there's no SELinux, neither enforcing nor permissive.

@nikromen nikromen moved this from In 3 months to In 2 years in CPT Kanban Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@praiskup praiskup

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

shadow_utils: make shadow --root work by fake permissive mode praiskup/mock
2 participants
@ikerexxe @praiskup