Ah. Silly me - it was an SELinux problem. I
was fooled by the fact that the traceback and ‘Permission denied’
error occurred in kojid.log into
thinking that the problem was on the kojid side. After attempting to
trace the code
repo_id,
event_id = self.session.host.repoInit(tinfo['id'], **kwargs)
and finding that session doesn’t have a host method or
attribute and repoInit doesn’t exist anywhere in kojid, I searched every
file on both systems for repoInit and found it in /usr/share/koji-hub/kojihub.py -
with corresponding error messages in /var/log/httpd/error_log.
I also discovered the hub option KojiTraceback = extended,
which helped.
The problem code was
File "/usr/share/koji-hub/kojihub.py", line 2060, in repo_init
os.makedirs(repodir) #should not already exist
and after a setenforce 0 on the hub it started to work. I
was sure I had checked the AVC log, but perhaps that was before I had nfs
working. Now it shows:
[root@kojihub
~] # aureport --avc -ts recent
AVC
Report
========================================================
#
date time comm subj syscall class permission obj event
========================================================
1.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 4 dir getattr
system_u:object_r:nfs_t:s0 denied 494
2.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 4 dir search
system_u:object_r:nfs_t:s0 denied 493
3.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 83 dir write
system_u:object_r:nfs_t:s0 denied 495
4.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 83 dir add_name
system_u:object_r:nfs_t:s0 denied 495
5.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 83 dir create
unconfined_u:object_r:nfs_t:s0 denied 495
6.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 2 file create
unconfined_u:object_r:nfs_t:s0 denied 496
7.
04/13/2012 14:23:36 httpd unconfined_u:system_r:httpd_t:s0 2 file open
system_u:object_r:nfs_t:s0 denied 496
Perhaps Koji/ServerHowTo could have a note for beginners that if
the hub’s /mnt/koji is on nfs you need to beat SELinux into submission.
Unfortunately my current nfs server doesn’t have proper SELinux support.
I may have to rearrange some disk space.
Moray.
“To err is human; to purr, feline.”
From: Andreas Mack
[mailto:andreas.mack@gmail.com]
Sent: 13 April 2012 12:19
To: Discussion of Fedora build system
Subject: Re: newRepo Permission denied: '/mnt/koji/repos'
Hey,
just my two cents: It's possible to run the builders
completely without NFS. I use "topurl=" instead of
"topdir=" in kojid.conf. The URL is http://kojihub.domain.tld/kojimnt
where kojimnt is apache aliased to the /mnt/koji on kojihub. Regen repos has to
be run on kojihub in thatcase. It's the only one in the createrepo channel.
As for the NFS problem: Smells so much like Selinux. Maybe
on the server-side? Do you use NFS4 ?
HTH
Andreas
On Thu, Apr 12, 2012 at 17:40, Moray Henderson <Moray.Henderson@ict-software.org>
wrote:
Is this the right place for questions on local koji
installations?
Fresh setup of koji on CentOS 6.2. I've got hub, web and builder all
talking to each other, external repositories defined for the build tag and
build groups set up.
/mnt/koji is an nfs mount with root squashed to uid 48 (apache). I've
tested that I can write to the subdirectories as root and the owner comes
out as apache. The directory looks like
# ll -R koji
koji:
total 16
drwxr-xr-x 2 apache apache 4096 Apr 12 11:13 packages
drwxr-xr-x 3 apache apache 4096 Apr 12 15:20 repos
drwxr-xr-x 2 apache apache 4096 Apr 12 11:13 scratch
drwxr-xr-x 2 apache apache 4096 Apr 12 11:13 work
koji/packages:
total 0
koji/repos:
total 0
koji/scratch:
total 0
koji/work:
total 0
The Koji/ExternalRepoServerBootstrap document says "Wait for the repo to
regenerate, and you should now be able to run a build successfully."
However, Koji-web lists the newRepo task as failed with result "<type
'exceptions.OSError'>: [Errno 13] Permission denied:
'/mnt/koji/repos'". On
the builder, kojid.log reports:
2012-04-12 14:20:31,067 [INFO] koji.build: Starting up
2012-04-12 14:20:34,363 [INFO] koji.TaskManager: Attempting to take task
176
2012-04-12 14:20:36,275 [INFO] koji.TaskManager: pids: {176: 17925}
2012-04-12 14:20:36,855 [WARNING] koji.TaskManager: FAULT:
Traceback (most recent call last):
File "/usr/lib/python2.6/site-packages/koji/daemon.py",
line 1114, in
runTask
response = (handler.run(),)
File "/usr/lib/python2.6/site-packages/koji/tasks.py",
line 146, in run
return self.handler(*self.params,**self.opts)
File "/usr/sbin/kojid", line 2491, in handler
repo_id, event_id = self.session.host.repoInit(tinfo['id'],
**kwargs)
File "/usr/lib/python2.6/site-packages/koji/__init__.py",
line 1510, in
__call__
return self.__func(self.__name,args,opts)
File
"/usr/lib/python2.6/site-packages/koji/__init__.py", line 1760, in
_callMethod
raise err
Fault: <Fault 1: "<type 'exceptions.OSError'>: [Errno 13]
Permission
denied: '/mnt/koji/repos'">
2012-04-12 14:20:37,110 [INFO] koji.TaskManager: open task: {'waiting':
None, 'id': 176, 'weight': 0.10000000000000001}
I've looked into the code, but my python is not up to debugging that.
It's
not an SELinux problem (I tried permissive mode) and /mnt/koji is mounted
read-write on the builder even though the documentation says that's not
necessary. Can someone point me in the right direction?
Moray.
"To err is human; to purr, feline."
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys