Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 614440 - [PATCH] Get mock to turn off selinux within the chroot
Summary: [PATCH] Get mock to turn off selinux within the chroot
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mock
Version: 14
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Clark Williams
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-07-14 13:51 UTC by Thomas Liu
Modified: 2013-01-10 06:04 UTC (History)
7 users (show)

Fixed In Version: mock-1.1.10-1.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-08-23 21:58:53 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
patch to mock (2.66 KB, text/plain)
2010-07-14 14:53 UTC, Thomas Liu 		no flags Details
mock errors (66.89 KB, text/plain)
2010-08-07 20:49 UTC, Julian Sikorski 		no flags Details
View All

Description Thomas Liu 2010-07-14 13:51:16 UTC 
Hi,

Dan Walsh and I have been working on confining mock builds with SELinux.  As part of this process, we need mock to think selinux is turned off within the chroot.  This patch accomplishes this by remounting /proc/filesystems within the chroot so that SELinux appears to be off.  We also pass RPM the NOCONTEXTS flag so that it won't put down labels.

Thanks,
-Thomas
Comment 1 Clark Williams 2010-07-14 14:31:30 UTC 
Umm, what patch?
Comment 2 Thomas Liu 2010-07-14 14:53:32 UTC 
Created attachment 431803 [details]
patch to mock
Comment 3 Thomas Liu 2010-07-14 14:53:58 UTC 
Sorry, think I forgot to attach the patch the first time.
Comment 4 Clark Williams 2010-07-14 22:01:19 UTC 
I applied your patch but yum failed due to this block of code:

@@ -623,7 +635,7 @@ class Root(object):
     def _yum(self, cmd, returnOutput=0):
         """use yum to install packages/package groups into the chroot"""
         # mock-helper yum --installroot=rootdir cmd
-        cmdOpts = ""
+        cmdOpts = "--setopt=tsflags=nocontexts"
         if not self.online:
             cmdOpts = "-C"


As far as I know, yum does not have a --setopt option.
Comment 5 Daniel Walsh 2010-07-15 12:56:43 UTC 
Thomas, What version of python were you testing with?  I think this all works in F14
Comment 6 Thomas Liu 2010-07-15 19:45:45 UTC 
I have been using yum-3.2.27-16.fc14.noarch, which does have this setopt option.
Comment 7 Bug Zapper 2010-07-30 12:34:31 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 14 development cycle.
Changing version to '14'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 8 Fedora Update System 2010-08-03 22:25:06 UTC 
mock-1.1.3-1.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/mock-1.1.3-1.fc14
Comment 9 Fedora Update System 2010-08-03 22:25:59 UTC 
mock-1.1.3-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/mock-1.1.3-1.fc13
Comment 10 Fedora Update System 2010-08-03 22:28:58 UTC 
mock-1.0.10-1.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/mock-1.0.10-1.el5
Comment 11 Fedora Update System 2010-08-03 22:30:03 UTC 
mock-1.0.10-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/mock-1.0.10-1.fc12
Comment 12 Fedora Update System 2010-08-04 23:04:34 UTC 
mock-1.0.10-1.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mock'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mock-1.0.10-1.el5
Comment 13 Fedora Update System 2010-08-05 14:22:23 UTC 
mock-1.1.3-1.fc14 has been pushed to the Fedora 14 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mock'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mock-1.1.3-1.fc14
Comment 14 Fedora Update System 2010-08-05 23:36:04 UTC 
mock-1.1.3-1.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mock'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mock-1.1.3-1.fc13
Comment 15 Fedora Update System 2010-08-05 23:37:35 UTC 
mock-1.0.10-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mock'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mock-1.0.10-1.fc12
Comment 16 Julian Sikorski 2010-08-07 20:49:42 UTC 
Created attachment 437374 [details]
mock errors

I'm not sure if this is the right place for the bug, but I'm seeing some strange warnings upon finishing a mock job when --resultdir is involved.
Adding "config_opts['plugin_conf']['selinux_enable'] = False" to site-defaults.cfg remedies it. Packages still build, though. I have attached the console output. This is with mock-1.1.3-1.fc13.noarch.
Comment 17 Fedora Update System 2010-08-07 23:23:43 UTC 
mock-1.1.3-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 18 Clark Williams 2010-08-09 14:49:26 UTC 
Julian,

Argggh, I missed the calls to 'chattr' in utils.rmtree(). I'll have to figure out a way to tell that routine whether to do chattr's, so the next update might take a little bit...
Comment 19 Fedora Update System 2010-08-19 17:20:44 UTC 
mock-1.1.4-1.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/mock-1.1.4-1.fc14
Comment 20 Fedora Update System 2010-08-19 17:21:51 UTC 
mock-1.1.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/mock-1.1.4-1.fc13
Comment 21 Fedora Update System 2010-08-19 17:32:37 UTC 
mock-1.0.11-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/mock-1.0.11-1.fc12
Comment 22 Fedora Update System 2010-08-19 17:33:57 UTC 
mock-1.0.11-1.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/mock-1.0.11-1.el5
Comment 23 Fedora Update System 2010-08-19 21:59:59 UTC 
mock-1.0.11-1.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mock'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mock-1.0.11-1.el5
Comment 24 Paul Howarth 2010-08-20 15:43:46 UTC 
I guess this bug supersedes Bug #573111 ?
Comment 25 Clark Williams 2010-08-21 12:55:48 UTC 
No, that one is telling yum/rpm not to lay down labels. That operation is not affected by the selinux plugin since that "turns off" selinux when running inside the chroot and all yum/rpm operations happen outside the chroot (they just operation *on* the chroot files).
Comment 26 Fedora Update System 2010-08-23 21:57:22 UTC 
mock-1.1.4-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 27 Fedora Update System 2010-08-24 01:28:03 UTC 
mock-1.1.4-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2010-08-26 01:02:47 UTC 
mock-1.0.11-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 29 Fedora Update System 2010-09-20 14:42:48 UTC 
mock-1.0.12-1.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/mock-1.0.12-1.fc12
Comment 30 Fedora Update System 2010-09-20 14:44:22 UTC 
mock-1.0.12-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.12-1.el5
Comment 31 Fedora Update System 2010-10-20 15:44:34 UTC 
mock-1.0.13-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.13-1.el5
Comment 32 Fedora Update System 2010-10-20 15:46:53 UTC 
mock-1.0.13-1.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/mock-1.0.13-1.fc12
Comment 33 Fedora Update System 2010-12-14 16:14:47 UTC 
mock-1.0.14-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.14-1.el5
Comment 34 Fedora Update System 2011-01-18 20:05:00 UTC 
mock-1.0.15-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.15-1.el5
Comment 35 Fedora Update System 2011-02-20 02:27:10 UTC 
mock-1.1.9-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/mock-1.1.9-1.fc13
Comment 36 Fedora Update System 2011-02-20 02:30:11 UTC 
mock-1.0.16-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.16-1.el5
Comment 37 Fedora Update System 2011-02-20 02:33:02 UTC 
mock-1.1.9-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/mock-1.1.9-1.el6
Comment 38 Fedora Update System 2011-02-20 02:35:54 UTC 
mock-1.1.9-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/mock-1.1.9-1.fc14
Comment 39 Fedora Update System 2011-03-03 08:25:54 UTC 
mock-1.1.9-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 40 Fedora Update System 2011-03-03 08:34:35 UTC 
mock-1.1.9-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 41 Fedora Update System 2011-05-13 20:34:58 UTC 
mock-1.1.10-1.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/mock-1.1.10-1.fc15
Comment 42 Fedora Update System 2011-05-13 20:39:24 UTC 
mock-1.1.10-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/mock-1.1.10-1.fc14
Comment 43 Fedora Update System 2011-05-13 20:43:39 UTC 
mock-1.0.17-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/mock-1.0.17-1.el5
Comment 44 Fedora Update System 2011-05-13 20:47:58 UTC 
mock-1.1.10-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/mock-1.1.10-1.fc13
Comment 45 Fedora Update System 2011-05-13 20:52:21 UTC 
mock-1.1.10-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/mock-1.1.10-1.el6
Comment 46 Fedora Update System 2011-05-19 04:36:18 UTC 
mock-1.1.10-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 47 Fedora Update System 2011-05-25 02:43:38 UTC 
mock-1.1.10-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 48 Fedora Update System 2011-05-25 03:17:51 UTC 
mock-1.1.10-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 49 Fedora Update System 2011-06-02 19:07:46 UTC 
mock-1.0.17-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 50 Fedora Update System 2011-06-02 19:17:37 UTC 
mock-1.1.10-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.