On 11.12.2014 01:13, Andrew Lutomirski wrote:
On Wed, Dec 10, 2014 at 4:03 PM, Sandro Mani
> Before digging around more, though I'd check here if some debian+selinux
> experienced person has any ideas... I'm encountering two kinds of failure
> when using pbuilder which seem selinux related:
> - When building packages for newer releases (i.e. Ubuntu >= trusty),
> pbuilder used to fail with
> dpkg: error processing archive
> <package_name>.deb (--unpack):
> cannot get security labeling handle: No such file or directory
> This looked like upstream , at the end of which it was suggested to
> bind-mount /sys/fs/selinux into the pbuilder chroot and remount it
> read-only. Did so, and things worked, horray.
> - Today I built the package for an older release, and now, with selinux
> mounted read-only, it fails with
> I: Extracting source
> Password: su: Authentication failure
Can you run setpriv -d inside your chroot and see what it says?
You could also try running su directly and confirming that it works.
In an ubuntu precise chroot (i.e. oldish) with selinux mounted
read-only, su does indeed not work (that is, it asks for a password),
but mounted read-write it does work (no password asked). setpriv does
not seem to be available on debian systems.
In an ubuntu utopic chroot, su works with either setting.