Selinux and pbuilder

[Sandro Mani]

On 11.12.2014 01:13, Andrew Lutomirski wrote:
> On Wed, Dec 10, 2014 at 4:03 PM, Sandro Mani <manisandro at gmail.com> wrote:
>> Hi,
>>
>> Before digging around more, though I'd check here if some debian+selinux
>> experienced person has any ideas... I'm encountering two kinds of failure
>> when using pbuilder which seem selinux related:
>>
>> - When building packages for newer releases (i.e. Ubuntu >= trusty),
>> pbuilder used to fail with
>>
>> [...]
>> dpkg: error processing archive
>> <package_name>.deb (--unpack):
>>   cannot get security labeling handle: No such file or directory
>> [...]
>>
>> This looked like upstream [1], at the end of which it was suggested to
>> bind-mount /sys/fs/selinux into the pbuilder chroot and remount it
>> read-only. Did so, and things worked, horray.
>>
>> - Today I built the package for an older release, and now, with selinux
>> mounted read-only, it fails with
>> [...]
>> I: Extracting source
>> Password: su: Authentication failure
> Hmm.
>
> Can you run setpriv -d inside your chroot and see what it says?
>
> You could also try running su directly and confirming that it works.
>
In an ubuntu precise chroot (i.e. oldish) with selinux mounted 
read-only, su does indeed not work (that is, it asks for a password), 
but mounted read-write it does work (no password asked). setpriv does 
not seem to be available on debian systems.
In an ubuntu utopic chroot, su works with either setting.

Thanks,
Sandro