Hello, The problem is that Fedora-Review checks for current user being in mock group and if that's not true it fails with "No mock group". I have already reported this issue some time ago in ticket #78 [1], but the solution (improved message) doesn't really satisfy me. Mock uses PAM for user authentication. It's configuration file is /etc/pam.d/mock and users are allowed to customize it. PAM supports many authentication schemes (password, hardware keys, group presence and much, *much* more). PAM is much more flexible and secure that checking group membership. If a user is member of mock group then it's trivial to gain root access. $ cat foo.cfg uidManager._becomeUser(0,0) os.execv("/bin/bash",["bash"]) $ mock -r ../..$PWD/foo # Here we go! We have root prompt now! Therefore adding my user to mock group opens a local security hole. Anyone gaining access to my account can have root access immediately. For this reason I don't want to add my user account to mock group and use PAM authentication instead. Because of the above I have two choices: compromise mu system security by adding myself to mock group or maintain private patchset for Fedora-Review and rebase it with every upstream release. None of the above is perfect. Because of the above I would like you to reconsider the possibility of disabling the check for mock group (by default or if some command-line option is given). Thank you. [1] https://fedorahosted.org/FedoraReview/ticket/78 -- Mikolaj Izdebski _______________________________________________ fedorareview mailing list fedorareview(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/fedorareview

I've implemented the mock --shell 'echo foo' test in ticket-78-test-fix branch. Would be nice if we could verify that is what we want to do. But it seems to work pretty fine with my testing.

>> I've implemented the mock --shell 'echo foo' test in >> ticket-78-test-fix branch. >> Would be nice if we could verify that is what we want to do. But it >> seems to >> work pretty fine with my testing. > This approach won't work. If mock root is clean then mock shell will > fail. There is a trivial, self-explanatory, non-disruptive, easily testable solution I already proposed: skip mock check if a command line option is given. This is quite common in design of many CLI tools to have some kind