I am leaving for OLS 2006 and wont be able to do any review for the next
I just caught up on the rpmlint discussion, and have a few concerns.
-- Security of installing just-built RPM
-- Can rpmlint just be done outside of mock (using mock chroot,
for example)? Why do we have to extend mock for this?
[mailto:email@example.com] On Behalf Of
Sent: Monday, July 17, 2006 10:29 AM
To: Discussion of Fedora build system
Subject: proposed mock changes (diff)
-----BEGIN PGP SIGNED MESSAGE-----
I was poking around in the mock source last week and did some
minor refactoring, a couple of name-changes and tried out the
rpmlint request. Attached below is a CVS diff of my mock.py
with the head of CVS. Please review and comment. A quick
summary of the changes:
1. Changed version to 0.7.
2. Added code to avoid exec'ing mount for proc, sys, and
dev/pts if we've already done it 3. Oh yeah, added /sys to
chroot mount 4. Refactoring: renamed _mount to _mountall,
created _mount routine that is called by _mountall 5. Renamed
_umount_by_file to _umountall 6. Added code to run rpmlint 7.
Added elevate/drop around raw chroot command
I'd especially like some thought on #7, since any time you
elevate and drop you can introduce a security hole and I
freely admit that I'm not always thinking security first.
If I don't get any push-back (or if I do and then get things
resolved), I'll commit these later this week.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----