nss/tst-nss-db-endgrent - selinux required?

nss/tst-nss-db-endgrent - selinux required?

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 573 bytes --]

Hi, 

I'm recently seeing these

FAIL: nss/tst-nss-db-endgrent
FAIL: nss/tst-nss-db-endpwent

both with (tip of release branch) 2.29 and 2.30. 

The log message where the tests were committed says:
> The test case runs "makedb" inside the testroot, so needs selinux
> DSOs installed.

Now, my system definitely doesnt have any selinux installed... but shouldnt 
the tests then be unsupported or expected to fail?

Cheers, 
Andreas

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: nss/tst-nss-db-endgrent - selinux required?

[Florian Weimer]

* Andreas K. Huettel:

> I'm recently seeing these
>
> FAIL: nss/tst-nss-db-endgrent
> FAIL: nss/tst-nss-db-endpwent
>
> both with (tip of release branch) 2.29 and 2.30. 

What's in the .out files?

> The log message where the tests were committed says:
>> The test case runs "makedb" inside the testroot, so needs selinux
>> DSOs installed.
>
> Now, my system definitely doesnt have any selinux installed... but shouldnt 
> the tests then be unsupported or expected to fail?

The chroot setup code has been updated to copy libselinux into the
croot if it is needed.  If the SELinux detection were incorrect, it
wouldn't be possible to compile support/links-dso-program-c.c or
support/links-dso-program.cc, so I'm pretty sure your problem is
something else.

Re: nss/tst-nss-db-endgrent - selinux required?

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 944 bytes --]

> The chroot setup code has been updated to copy libselinux into the
> croot if it is needed.  If the SELinux detection were incorrect, it
> wouldn't be possible to compile support/links-dso-program-c.c or
> support/links-dso-program.cc, so I'm pretty sure your problem is
> something else.

OK thanks, then the commit message led me in the wrong direction.

> > I'm recently seeing these
> > 
> > FAIL: nss/tst-nss-db-endgrent
> > FAIL: nss/tst-nss-db-endpwent
> > 
> > both with (tip of release branch) 2.29 and 2.30.
> 
> What's in the .out files?
> 

In both cases

error: xmkdir.c:27: mkdir ("/proc", 0777): Permission denied

I suspect that's somehow Gentoo's build sandbox / namespacing at work once 
more; too many moving parts. Will have a closer look. Tentatively only our 
problem.

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: nss/tst-nss-db-endgrent - selinux required?

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 402 bytes --]

> I suspect that's somehow Gentoo's build sandbox / namespacing at work once
> more; too many moving parts. Will have a closer look. Tentatively only our
> problem.

Confirmed, this is our build system. (It affects tst-nss-test3 tst-nss-db-
endpwent tst-nss-db-endgrent).

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: nss/tst-nss-db-endgrent - selinux required?

[Carlos O'Donell]

On 11/27/19 5:22 PM, Andreas K. Huettel wrote:
>> I suspect that's somehow Gentoo's build sandbox / namespacing at work once
>> more; too many moving parts. Will have a closer look. Tentatively only our
>> problem.
> 
> Confirmed, this is our build system. (It affects tst-nss-test3 tst-nss-db-
> endpwent tst-nss-db-endgrent).
> 

You're not the only one with problems like that. We have similar problems
with our own infrastructure. This is relatively new tech and we need to
sort out these issues one-by-one.

If you run into anything that is unfixable, please come back and talk to
us about this.

-- 
Cheers,
Carlos.