From eae52044e75c0dfef5c3901a08590943e12db434 Mon Sep 17 00:00:00 2001 From: Pavel Zhukov Date: Aug 03 2021 16:13:59 +0000 Subject: Make the /proc and /sys %ghost When working in rootless container environment with user namespaces, those directories are pre-populated by the container runtime as bind-mounts from host. Such bind-mounts though naturally inherit ownership/permissions from the host's filesystem.rpm, and non-privileged "root" inside container can not be allowed to touch files owned by host's UID=0. Those directories are then shown as owned by 'nobody:nobody'. When filesystem.rpm holds those /proc and /sys in payload, rpm tries to re-chown the file to root:root on every package update transaction. This operation can not succeed because 'root:root' inside container maps to some large UID/GID on host -- and so the RPM transaction fails. As a workaround (there's no better way currently), remove /proc and /sys from the packaged payload, mark those directories %ghost and create them by scriptlet. Resolves: rhbz#1548403 Version: 3.16 Signed-off-by: Pavel Raiskup --- diff --git a/filesystem.spec b/filesystem.spec index 33c1a7f..6772d3a 100644 --- a/filesystem.spec +++ b/filesystem.spec @@ -1,6 +1,6 @@ Summary: The basic directory layout for a Linux system Name: filesystem -Version: 3.15 +Version: 3.16 Release: 1%{?dist} License: Public Domain URL: https://pagure.io/filesystem @@ -44,7 +44,7 @@ cd %{buildroot} mkdir -p afs boot dev \ etc/{X11/{applnk,fontpath.d,xinit/{xinitrc,xinput}.d},xdg/autostart,opt,pm/{config.d,power.d,sleep.d},skel,sysconfig,pki,bash_completion.d,rwtab.d,statetab.d} \ - home media mnt opt proc root run srv sys tmp \ + home media mnt opt root run srv tmp \ usr/{bin,games,include,%{_lib}/{bpf,games,X11,pm-utils/{module.d,power.d,sleep.d}},lib/{debug/{.dwz,usr},games,locale,modules,sysimage},libexec,local/{bin,etc,games,lib,%{_lib}/bpf,sbin,src,share/{applications,man/man{1,2,3,4,5,6,7,8,9,n,1x,2x,3x,4x,5x,6x,7x,8x,9x},info},libexec,include,},sbin,share/{aclocal,appdata,applications,augeas/lenses,backgrounds,bash-completion{,/completions,/helpers},desktop-directories,dict,doc,empty,games,gnome,help,icons,idl,info,licenses,man/man{1,2,3,4,5,6,7,8,9,n,1x,2x,3x,4x,5x,6x,7x,8x,9x,0p,1p,3p},metainfo,mime-info,misc,omf,pixmaps,sounds,themes,xsessions,X11,wayland-sessions},src,src/kernels,src/debug} \ var/{adm,empty,ftp,lib/{games,misc,rpm-state},local,log,nis,preserve,spool/{mail,lpd},tmp,db,cache/bpf,opt,games,yp} @@ -152,6 +152,10 @@ posix.symlink("../.dwz", "/usr/lib/debug/usr/.dwz") posix.symlink("usr/sbin", "/usr/lib/debug/sbin") posix.symlink("usr/%{_lib}", "/%{_lib}") posix.mkdir("/run") +posix.mkdir("/proc") +posix.mkdir("/sys") +posix.chmod("/proc", 0555) +posix.chmod("/sys", 0555) st = posix.stat("/media") if st and st.type == "link" then os.remove("/media") @@ -205,12 +209,12 @@ restorecon /afs 2>/dev/null >/dev/null || : /media %dir /mnt %dir /opt -%attr(555,root,root) /proc +%ghost %attr(555,root,root) /proc %attr(550,root,root) /root /run /sbin /srv -%attr(555,root,root) /sys +%ghost %attr(555,root,root) /sys %attr(1777,root,root) /tmp %dir /usr %attr(555,root,root) /usr/bin @@ -304,6 +308,10 @@ restorecon /afs 2>/dev/null >/dev/null || : * Tue Aug 3 2021 Pavel Zhukov - 3.15-1 - Move /afs into main package +* Fri Aug 07 2020 Pavel Raiskup - 3.14-4 +- /proc and /sys made %%ghost to allow filesystem package updates in rootless + container environments (rhbz#1548403) + * Mon Jan 27 2020 Ondrej Vasik - 3.14-1 - do not restore context of /proc (#1722766)