Adjust buildroot creation to work inside a user namespace.

mock/py/mockbuild/buildroot.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # vim: noai:ts=4:sw=4:expandtab
 
+import errno
 import fcntl
 import glob
 import grp
@@ -368,6 +369,21 @@ def _init_aux_files(self):
                 with open(p, 'w+') as fo:
                     fo.write(chroot_file_contents[key])
 
+    @traceLog()
+    def ensure_rpm_config_home(self):
+        """Create a fake home directory with an appropriate .rpmmacros"""
+
+        rpm_config_home = os.path.join(self.basedir, 'rpmconfig')
+        util.mkdirIfAbsent(rpm_config_home)
+
+        # Since /proc and /sys are mounted special filesystems when RPM is running
+        # to install the buildroot, it doesn't make sense for RPM to try and
+        # set the permissions on them - and that might fail with permission errors.
+        with open(os.path.join(rpm_config_home, ".rpmmacros"), "w") as f:
+            f.write("%_netsharedpath /proc:/sys\n")
+
+        return rpm_config_home
+
     @traceLog()
     def nuke_rpm_db(self):
         """remove rpm DB lock files from the chroot"""
@@ -486,15 +502,40 @@ def _setup_devices(self):
             kver = os.uname()[2]
             self.root_log.debug("kernel version == %s", kver)
             for i in devFiles:
+                src_path = "/" + i[2]
+                chroot_path = self.make_chroot_path(i[2])
+
+                if util.cmpKernelVer(kver, '2.6.18') >= 0 and src_path == '/dev/ptmx':
+                    continue
+
                 # create node, but only if it exist on host too
                 # except for loop devices, which only show up on the host after they are first used
-                if os.path.exists("/" + i[2]) or "loop" in i[2]:
-                    os.mknod(self.make_chroot_path(i[2]), i[0], i[1])
+                if os.path.exists(src_path) or "loop" in src_path:
+                    try:
+                        os.mknod(chroot_path, i[0], i[1])
+                    except OSError as e:
+                        # If mknod gives us a permission error, fall back to a different
+                        # strategy of using a bind mount from root to host. This won't
+                        # work for the loop devices, so just skip them in this case.
+                        if e.errno == errno.EPERM:
+                            if os.path.exists(src_path):
+                                self.mounts.add_device_bindmount(src_path)
+                            continue
+                        else:
+                            raise
+
+                    # Further adjustments if we created a new node instead of bind-mounting
+                    # an existing one:
+
                     # set context. (only necessary if host running selinux enabled.)
                     # fails gracefully if chcon not installed.
                     if self.selinux:
-                        util.do(["chcon", "--reference=/" + i[2], self.make_chroot_path(i[2])],
+                        util.do(["chcon", "--reference=" + src_path, chroot_path],
                                 raiseExc=0, shell=False, env=self.env)
+
+                    if src_path in ('/dev/tty', '/dev/ptmx'):
+                        os.chown(chroot_path, pwd.getpwnam('root')[2], grp.getgrnam('tty')[2])
+
             os.symlink("/proc/self/fd/0", self.make_chroot_path("dev/stdin"))
             os.symlink("/proc/self/fd/1", self.make_chroot_path("dev/stdout"))
             os.symlink("/proc/self/fd/2", self.make_chroot_path("dev/stderr"))
@@ -504,17 +545,12 @@ def _setup_devices(self):
                 os.remove(self.make_chroot_path('etc', 'mtab'))
             os.symlink("../proc/self/mounts", self.make_chroot_path('etc', 'mtab'))
 
-            os.chown(self.make_chroot_path('dev/tty'), pwd.getpwnam('root')[2], grp.getgrnam('tty')[2])
-            os.chown(self.make_chroot_path('dev/ptmx'), pwd.getpwnam('root')[2], grp.getgrnam('tty')[2])
-
             # symlink /dev/fd in the chroot for everything except RHEL4
             if util.cmpKernelVer(kver, '2.6.9') > 0:
                 os.symlink("/proc/self/fd", self.make_chroot_path("dev/fd"))
 
             os.umask(prevMask)
 
-            if util.cmpKernelVer(kver, '2.6.18') >= 0:
-                os.unlink(self.make_chroot_path('/dev/ptmx'))
             os.symlink("pts/ptmx", self.make_chroot_path('/dev/ptmx'))
 
     @traceLog()

mock/py/mockbuild/mounts.py

@@ -85,17 +85,29 @@ def __repr__(self):
 class BindMountPoint(MountPoint):
     '''class for managing bind-mounts in the chroot'''
     @traceLog()
-    def __init__(self, srcpath, bindpath):
+    def __init__(self, srcpath, bindpath, recursive=False, options=None):
         MountPoint.__init__(self, mountsource=srcpath, mountpath=bindpath)
         self.srcpath = srcpath
         self.bindpath = bindpath
+        self.recursive = recursive
+        self.options = options
         self.mounted = self.ismounted()
 
     @traceLog()
     def mount(self):
         if not self.mounted:
-            util.mkdirIfAbsent(self.bindpath)
-            cmd = ['/bin/mount', '-n', '--bind', self.srcpath, self.bindpath]
+            if os.path.isdir(self.srcpath):
+                util.mkdirIfAbsent(self.bindpath)
+            elif not os.path.exists(self.bindpath):
+                util.touch(self.bindpath)
+            cmd = ['/bin/mount', '-n']
+            if self.recursive:
+                cmd.append('--rbind')
+            else:
+                cmd.append('--bind')
+            if self.options:
+                cmd += ['-o', self.options]
+            cmd += [self.srcpath, self.bindpath]
             util.do(cmd)
         self.mounted = True
         return True
@@ -104,7 +116,13 @@ def mount(self):
     def umount(self):
         if not self.mounted:
             return None
-        cmd = ['/bin/umount', '-n', self.bindpath]
+        cmd = ['/bin/umount', '-n']
+        if self.recursive:
+            # The mount is busy because of the submounts - a lazy unmount
+            # implies a recursive unmount, so takes care of that.
+            # (-R also works, but is implemented in userspace, and thus racy)
+            cmd += ['-l']
+        cmd.append(self.bindpath)
         try:
             util.do(cmd)
         except exception.Error:
@@ -125,12 +143,20 @@ def __init__(self, rootObj):
         self.managed_mounts = []  # mounts owned by mock
         self.user_mounts = []  # mounts injected by user
         self.essential_mounts = [
-            FileSystemMountPoint(filetype='proc',
-                                 device='mock_chroot_proc',
-                                 path=rootObj.make_chroot_path('/proc')),
-            FileSystemMountPoint(filetype='sysfs',
-                                 device='mock_chroot_sys',
-                                 path=rootObj.make_chroot_path('/sys')),
+            # Instead of mounting a fresh procfs and sysfs, we bind mount /proc
+            # and /sys. This avoids problems with kernel restrictions if running
+            # within a user namespace, and is pretty much identical otherwise.
+            # The bind mount additionally needs to be recursive, because the
+            # kernel forbids mounts that might reveal parts of the filesystem
+            # that a container runtime overmounted to hide from the container.
+            BindMountPoint(srcpath='/proc',
+                           bindpath=rootObj.make_chroot_path('/proc'),
+                           recursive=True,
+                           options="nodev,noexec,nosuid,readonly"),
+            BindMountPoint(srcpath='/sys',
+                           bindpath=rootObj.make_chroot_path('/sys'),
+                           recursive=True,
+                           options="nodev,noexec,nosuid,readonly"),
         ]
         if rootObj.config['internal_dev_setup']:
             self.essential_mounts.append(
@@ -157,6 +183,13 @@ def __init__(self, rootObj):
     def add(self, mount):
         self.managed_mounts.append(mount)
 
+    @traceLog()
+    def add_device_bindmount(self, path):
+        mount = BindMountPoint(path,
+                               self.rootObj.make_chroot_path(path),
+                               options="noexec,nosuid,readonly")
+        self.essential_mounts.append(mount)
+
     @traceLog()
     def add_user_mount(self, mount):
         self.user_mounts.append(mount)

mock/py/mockbuild/package_manager.py

@@ -114,6 +114,8 @@ def execute(self, *args, **kwargs):
         # intentionally we do not call bootstrap hook here - it does not have sense
         env = self.config['environment'].copy()
         env.update(util.get_proxy_environment(self.config))
+        # use a special home directory with only our desired RPM configuration
+        env['HOME'] = self.buildroot.ensure_rpm_config_home()
         env['LC_MESSAGES'] = 'C.UTF-8'
         if self.buildroot.nosync_path:
             env['LD_PRELOAD'] = self.buildroot.nosync_path

mock/py/mockbuild/util.py

@@ -425,6 +425,13 @@ def unshare(flags):
     except AttributeError:
         pass
 
+    if flags & CLONE_NEWNS:
+        # Unsharing the mount namespace isn't immediately effective if the
+        # source mount propagation status is 'shared' - changes to the mounts
+        # will still propagate back to the parent namespace. Do the same
+        # thing as unshare(1) and make all mounts private.
+        do(['mount', '--make-rprivate', '/'])
+
 
 def sethostname(hostname):
     getLog().info("Setting hostname: %s", hostname)