New Mock release

[Miroslav Suchý]

Hi,
I just released new version of Mock.

https://fedoraproject.org/wiki/Mock/1.2.19

Copy from the above url:
Mock version 1.2.19 has those changes:

* plugin Mock/Plugin/PackageState is now enabled by default and it
has new options. By default this plugin now generate list of installed
packages. List of available packages is disabled by default.
* Fedora 25 configs has been added
* GPG keys in configs are now used from package
``distribution-gpg-keys``. Keys in /etc/pki/mock will be still shipped
for some time, so we do not break old user config. But new one will not
be added and users are encouraged to migrate their paths to GPG keys.
* you can include some other config using:

include('/path/to/config/to/be/included/include.cfg')

* there is new option available which will install additional
package to minimal chroot. This is extension of already existing option
``chroot_setup_cmd``. It was added to easy automated changed of minimal
buildroot in Copr.:

config_opts['chroot_additional_packages'] = 'some_package other_package'

* And it resolves those bugs: RHBZ#1272381, RHBZ#1358397,
RHBZ#1362478, RHBZ#1277187, RHBZ#1298220, RHBZ#1264508.

And few notes about future release:

* in next release will be very likely resolved RHBZ#1246810. I.e.
/usr/sbin/mock will be moved to /usr/libexec/mock/mock. Since this is
very big change, next release will likely be 1.3.0
* Development and documentation will likely move to Github or
Pagure. Please follow buildsys mailing list.

[Ken Dreyer]

Post by Miroslav Suchý
* in next release will be very likely resolved RHBZ#1246810. I.e.
/usr/sbin/mock will be moved to /usr/libexec/mock/mock. Since this is very
big change, next release will likely be 1.3.0

I was surprised to hear about this. Is mock no longer going to be in my $PATH?

- Ken

[Troy Dawson]

Post by Ken Dreyer

Post by Miroslav Suchý
* in next release will be very likely resolved RHBZ#1246810. I.e.
/usr/sbin/mock will be moved to /usr/libexec/mock/mock. Since this is

very

Post by Miroslav Suchý
big change, next release will likely be 1.3.0

I was surprised to hear about this. Is mock no longer going to be in my $PATH?

I was surprised to hear this as well, and then I looked.
There was a mock in both /usr/bin/ and /usr/sbin/
Not the same mock, two different mock's.
Youch.
I have to agree, that's a problem waiting to happen, and from the looks of
things, it's bitten several people. I'm glad it's being fixed.

Troy

[Kevin Fenzi]

On Sat, 27 Aug 2016 22:34:49 -0500

Post by Troy Dawson

Post by Ken Dreyer

Post by Miroslav Suchý
* in next release will be very likely resolved RHBZ#1246810.
I.e. /usr/sbin/mock will be moved to /usr/libexec/mock/mock.
Since this is

very

Post by Miroslav Suchý
big change, next release will likely be 1.3.0

I was surprised to hear about this. Is mock no longer going to be in my $PATH?

I was surprised to hear this as well, and then I looked.
There was a mock in both /usr/bin/ and /usr/sbin/
Not the same mock, two different mock's.
Youch.
I have to agree, that's a problem waiting to happen, and from the
looks of things, it's bitten several people. I'm glad it's being
fixed.

There's a historical reason for this, it's to support consolehelper.

ie, if you run /usr/bin/mock you would (optionally, depending on how
the machine is setup) get prompted for higher privs to run mock.

consolehelper should long be deprecated these days, so it definitely
makes sense to drop the duplicates here (and /etc/pam.d/mock probibly).

kevin

[Miroslav Suchý]

Post by Kevin Fenzi
consolehelper should long be deprecated these days, so it definitely
makes sense to drop the duplicates here (and /etc/pam.d/mock probibly).

My initial plan is to not deprecate use of consolehelper. Just move
/usr/sbin/mock to /usr/libexec/mock/mock. While /usr/bin/mock will still
be consolehelper.

This will resolve the issue for people who have /usr/sbin in their path
on first place.

Moving to some up-to-date technology (pam.d) can be next step. But just
changing the path is quite disruptive. At least from SELinux POV.

But to sum it up - /usr/bin/mock will stay on it place. We are moving
just that sbin part.

[Dustin C. Hatch]

Post by Kevin Fenzi
consolehelper should long be deprecated these days

Out of curiosity, what is the preferred method for self-elevating
programs written in an interpreted language, then?

[Kevin Fenzi]

On Fri, 9 Sep 2016 14:21:33 -0500

Post by Dustin C. Hatch

Post by Kevin Fenzi
consolehelper should long be deprecated these days

Out of curiosity, what is the preferred method for self-elevating
programs written in an interpreted language, then?

PolicyKit.

Looks like there was an attempt in ~f20 to replace all the old
consolehelper/usermode packages with polkit, but I guess it didn't get
done.

http://fedoraproject.org/wiki/Features/UsermodeMigration

kevin

[Miroslav Suchý]

Post by Kevin Fenzi
On Fri, 9 Sep 2016 14:21:33 -0500

Post by Dustin C. Hatch

Post by Kevin Fenzi
consolehelper should long be deprecated these days

Out of curiosity, what is the preferred method for self-elevating
programs written in an interpreted language, then?

PolicyKit.
Looks like there was an attempt in ~f20 to replace all the old
consolehelper/usermode packages with polkit, but I guess it didn't get
done.
http://fedoraproject.org/wiki/Features/UsermodeMigration

I tried to convert mock to use pkexec. Here it is:
https://github.com/xsuchy/mock-1/commit/4276ef488ac2d134504173d88a8a58fc0a232eaf

However I experienced several issues, which I am unable to resolve due the lack of documentation around pkexec. Maybe
somebody will know:

* it seems that it works only in GUI. In plain VT (without display manager) I get
polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No
session for cookie
and followed by "Not authorized"

* in GUI I am able to proceed, but the code will stop at:
https://github.com/xsuchy/mock-1/blob/devel/py/mock.py#L543
because neither SUDO_UID nor USERHELPER_UID.
Is there any way to recognize that I'm running inside of pkexec and that I'm able to drop privileges?

[Miroslav Suchý]

Post by Miroslav Suchý

Post by Kevin Fenzi
On Fri, 9 Sep 2016 14:21:33 -0500

Post by Dustin C. Hatch

Post by Kevin Fenzi
consolehelper should long be deprecated these days

Out of curiosity, what is the preferred method for self-elevating
programs written in an interpreted language, then?

PolicyKit.
Looks like there was an attempt in ~f20 to replace all the old
consolehelper/usermode packages with polkit, but I guess it didn't get
done.
http://fedoraproject.org/wiki/Features/UsermodeMigration

https://github.com/xsuchy/mock-1/commit/4276ef488ac2d134504173d88a8a58fc0a232eaf

After discussion with Mitr (most active developer of polkit) I am giving up on this work.
Pkexec does not have priority and it is unlikely that those problem I faced up will be resolved. So the migration of
Mock will likely break user experience. Therefore I will rather stay with consolehelper, which may be old, but it works.

[Neal Gompa]

Post by Miroslav Suchý

Post by Miroslav Suchý

Post by Kevin Fenzi
On Fri, 9 Sep 2016 14:21:33 -0500

Post by Dustin C. Hatch

Post by Kevin Fenzi
consolehelper should long be deprecated these days

Out of curiosity, what is the preferred method for self-elevating
programs written in an interpreted language, then?

PolicyKit.
Looks like there was an attempt in ~f20 to replace all the old
consolehelper/usermode packages with polkit, but I guess it didn't get
done.
http://fedoraproject.org/wiki/Features/UsermodeMigration

https://github.com/xsuchy/mock-1/commit/4276ef488ac2d134504173d88a8a58fc0a232eaf

After discussion with Mitr (most active developer of polkit) I am giving up on this work.
Pkexec does not have priority and it is unlikely that those problem I faced up will be resolved. So the migration of
Mock will likely break user experience. Therefore I will rather stay with consolehelper, which may be old, but it works.

Can that path issue still be fixed even with consolehelper?

[Miroslav Suchý]

Post by Neal Gompa
Can that path issue still be fixed even with consolehelper?

Yes.