Fedora 42 default minimal buildroot has non-working /bin/su

[praiskup]

INFO: Running in chroot: ["su - mockbuild -c 'set -xe ; cd /workdir ; COPR_OWNER=@cki COPR_PROJECT=kwf COPR_PACKAGE=kwf-config COPR_RESULTDIR=/workdir/results /script'"]
Start: chroot ["su - mockbuild -c 'set -xe ; cd /workdir ; COPR_OWNER=@cki COPR_PROJECT=kwf COPR_PACKAGE=kwf-config COPR_RESULTDIR=/workdir/results /script'"]
su: Permission denied
Finish: chroot ["su - mockbuild -c 'set -xe ; cd /workdir ; COPR_OWNER=@cki COPR_PROJECT=kwf COPR_PACKAGE=kwf-config COPR_RESULTDIR=/workdir/results /script'"]
Finish: run
Traceback (most recent call last):
  File "/usr/bin/copr-sources-custom", line 115, in <module>
    run_cmd(mock + ['--chroot', 'su - {0} -c {1}'.format(user, cmd)])
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/bin/copr-sources-custom", line 64, in run_cmd
    return subprocess.check_call(command, **kwargs)
           ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/subprocess.py", line 419, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['mock', '-r', '/var/lib/copr-rpmbuild/results/mock-config.cfg', '--chroot', "su - mockbuild -c 'set -xe ; cd /workdir ; COPR_OWNER=@cki COPR_PROJECT=kwf COPR_PACKAGE=kwf-config COPR_RESULTDIR=/workdir/results /script'"]' returned non-zero exit status 1.
Copr build error: Build failed

Locally reproducible via:

mock -r fedora-42-x86_64 --scrub=all
mock -r fedora-42-x86_64 --install 'jq' --install 'rpmdevtools'
mock -r fedora-42-x86_64 --shell
# su - mockbuild
su: Permission denied

After installing authselect:

# su - mockbuild
su: Module is unknown

After installing pam, su starts working:

INFO: installing package(s): pam
Updating and loading repositories:
 updates                                100% | 136.3 KiB/s |  24.4 KiB |  00m00s
 fedora                                 100% | 104.7 KiB/s |  22.6 KiB |  00m00s
Repositories loaded.
Package   Arch   Version            Repository      Size
Installing:
 pam      x86_64 1.7.0-4.fc42       fedora       1.6 MiB
Installing dependencies:
 gdbm     x86_64 1:1.23-9.fc42      fedora     460.3 KiB
 libnsl2  x86_64 2.0.1-3.fc42       fedora      57.9 KiB
 libtirpc x86_64 1.3.6-1.rc3.fc42.2 fedora     199.0 KiB

[praiskup]

While su in chroot isn't working in F42 chroot (missing pam), the mock --unpriv is not affected... shall we start using mock --unpriv in copr?

[ReenigneArcher]

This seems like a critical issue, but was added to the "in 3 months" on the kanhan board. Is that accurate? If so, the only fix for copr repo maintainers is to switch to the fedora 41 script chroot?

[praiskup]

"In 3 months" is the most prioritized category.

Mock's main purpose is to build packages, in "as minimal buildroot as possible". Also, we do not allow "normal" rpmbuild to switch from one user/group to another. So while this issue is very inconvenient for some users, the issue is not that severe because it doesn't block normal RPM builds.

We need to realize where the problem is first, asking util-linux maintainers: https://bugzilla.redhat.com/show_bug.cgi?id=2346955

[ReenigneArcher]

Thanks for the response. I don't know what a "normal" rpmbuild is, but we use the "script" option so we can build from our CI/CD pipelines triggered from GitHub events.

[praiskup]

@ReenigneArcher what Copr build method are you using? Can you post a link to the script being used?