Selinux and pbuilder

Sandro Mani manisandro at
Thu Dec 11 08:25:08 UTC 2014

On 11.12.2014 01:13, Andrew Lutomirski wrote:
> On Wed, Dec 10, 2014 at 4:03 PM, Sandro Mani <manisandro at> wrote:
>> Hi,
>> Before digging around more, though I'd check here if some debian+selinux
>> experienced person has any ideas... I'm encountering two kinds of failure
>> when using pbuilder which seem selinux related:
>> - When building packages for newer releases (i.e. Ubuntu >= trusty),
>> pbuilder used to fail with
>> [...]
>> dpkg: error processing archive
>> <package_name>.deb (--unpack):
>>   cannot get security labeling handle: No such file or directory
>> [...]
>> This looked like upstream [1], at the end of which it was suggested to
>> bind-mount /sys/fs/selinux into the pbuilder chroot and remount it
>> read-only. Did so, and things worked, horray.
>> - Today I built the package for an older release, and now, with selinux
>> mounted read-only, it fails with
>> [...]
>> I: Extracting source
>> Password: su: Authentication failure
> Hmm.
> Can you run setpriv -d inside your chroot and see what it says?
> You could also try running su directly and confirming that it works.
In an ubuntu precise chroot (i.e. oldish) with selinux mounted 
read-only, su does indeed not work (that is, it asks for a password), 
but mounted read-write it does work (no password asked). setpriv does 
not seem to be available on debian systems.
In an ubuntu utopic chroot, su works with either setting.


More information about the devel mailing list