Bug#1092384: krb5: FTBFS: make[1]: *** [debian/rules:111: override_dh_install-arch] Error 1

[Lucas Nussbaum]

Source: krb5
Version: 1.21.3-3
Severity: serious
Justification: FTBFS
Tags: trixie sid ftbfs
User: ***@debian.org
Usertags: ftbfs-20250106 ftbfs-trixie

Hi,

During a rebuild of all packages in sid, your package failed to build
on amd64.

make[1]: Entering directory '/<<PKGBUILDDIR>>'
dh_install -Xtmac.doc -Xexamples/krb5 -Xgnats/mit -Xkrb5-send-pr -Xsserver -Xsim_server -Xuuserver -Xsclient -Xsim_client -Xuuclient -Xpreauth/test.so --sourcedir=.
set -e ; find debian/krb5-multidev/usr/lib/x86_64-linux-gnu/mit-krb5 -type l -name \*.so -print |\
while read linkname; do \
ln -s -f ../`readlink $linkname` \
$linkname; \
done
rm debian/krb5-multidev/usr/include/mit-krb5/krad.h debian/krb5-multidev/usr/lib/*/mit-krb5/libkrad.so
for dir in include lib/x86_64-linux-gnu lib/x86_64-linux-gnu/pkgconfig; do \
(cd debian/krb5-multidev/usr/$dir/mit-krb5 && \
find . -type d -print ) | (cd debian/libkrb5-dev/usr/$dir && \
xargs mkdir -p); \
(cd debian/krb5-multidev/usr/$dir/mit-krb5 && find . \( -type f -o -type l \) -print ) | \
(cd debian/libkrb5-dev/usr/$dir && xargs -I+ ln -s /usr/$dir/mit-krb5/+ +) ; \
done
# however we will handle libkadm5{srv,clnt.so} in dh_link
rm -f debian/krb5-multidev/usr/lib/x86_64-linux-gnu/mit-krb5/libkadm5{clnt,srv}.so
docbook-to-man debian/krb5_newrealm.sgml \

debian/krb5-admin-server/usr/share/man/man8/krb5_newrealm.8

install -o root -g root -m 755 debian/krb5_newrealm \
debian/krb5-admin-server/usr/sbin
install: cannot change ownership of 'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted
make[1]: *** [debian/rules:111: override_dh_install-arch] Error 1

The full build log is available from:
http://qa-logs.debian.net/2025/01/06/krb5_1.21.3-3_unstable.log

All bugs filed during this archive rebuild are listed at:
https://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=ftbfs-20250106;users=***@debian.org
or:
https://udd.debian.org/bugs/?release=na&merged=ign&fnewerval=7&flastmodval=7&fusertag=only&fusertagtag=ftbfs-20250106&fusertaguser=***@debian.org&allbugs=1&cseverity=1&ctags=1&caffected=1#results

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

If you reassign this bug to another package, please mark it as 'affects'-ing
this package. See https://www.debian.org/Bugs/server-control#affects

If you fail to reproduce this, please provide a build log and diff it with mine
so that we can identify if something relevant changed in the meantime.

[Sam Hartman]

install: cannot change ownership of
'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted

It looks like this is a result of defaulting to rules-requires-root: no
(was that change in your rebuild?)

I think that I need to set rules-requires-root to binary-targets to deal
with the setuid bit on ksu. Is that still correct?

[Lucas Nussbaum]

Hi,

Post by Sam Hartman

install: cannot change ownership of
'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted

It looks like this is a result of defaulting to rules-requires-root: no
(was that change in your rebuild?)

dpkg 1.22.13 (now in unstable) made that switch

Post by Sam Hartman
I think that I need to set rules-requires-root to binary-targets to deal
with the setuid bit on ksu. Is that still correct?

I think so

Lucas

[Guillem Jover]

Control: tags -1 patch

Hi!

Post by Sam Hartman

install: cannot change ownership of
'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted

It looks like this is a result of defaulting to rules-requires-root: no
(was that change in your rebuild?)

Yes.

Post by Sam Hartman
I think that I need to set rules-requires-root to binary-targets to deal
with the setuid bit on ksu. Is that still correct?

Setting the set-user-ID bit should not be a privileged operation, the only
problem should be with the chown:s. The attached patch seems to work for me
with a local build, but just to make sure we still have the set-user-ID
bit, I checked the .deb:

$ dpkg-deb -c krb5-user_1.21.3-3_amd64.deb | grep bin/ksu
-rwsr-xr-x root/root 56520 2024-07-05 19:25 ./usr/bin/ksu.mit

But perhaps you want to do two builds with the different
Rules-Requires-Root values and debdiff/diffoscope them to make extra sure.

The patch should work with the old binary-targets default, as the
files will then get installed via fakeroot, and with the new default
as the .deb will be built using dpkg-deb --root-owner-group, which
forces the user:group to be root:root, w/o any need to set the
Rules-Requires-Root field.

Thanks,
Guillem

[Benjamin Kaduk]

install: cannot change ownership of 'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted

Hmm, I wonder if that's some unshare fallout -- I know I haven't done any
krb5 builds with the unshare backend, myself.

-Ben

[Lucas Nussbaum]

Hi,

Post by Benjamin Kaduk

install: cannot change ownership of 'debian/krb5-admin-server/usr/sbin/krb5_newrealm': Operation not permitted

Hmm, I wonder if that's some unshare fallout -- I know I haven't done any
krb5 builds with the unshare backend, myself.

Most likely https://lists.debian.org/debian-devel/2025/01/msg00022.html

Lucas

[Debian Bug Tracking System]

Post by Guillem Jover
tags -1 patch

Bug #1092384 [src:krb5] krb5: FTBFS: make[1]: *** [debian/rules:111: override_dh_install-arch] Error 1
Added tag(s) patch.

[Debian Bug Tracking System]

Post by Guillem Jover
tags -1 patch

Bug #1092384 [src:krb5] krb5: FTBFS: make[1]: *** [debian/rules:111: override_dh_install-arch] Error 1
Ignoring request to alter tags of bug #1092384 to the same tags previously set

[Adrian Bunk]

Post by Guillem Jover
Control: tags -1 patch
...

That said, the simplest solution is to set `Rules-Requires-Root: binary-
targets`, which will push krb5 back to the previous default. So if you
are pressed for time/spoons, then pick that route and come back to
Guillem's patch later. The primary goal of the MBF was to flip the
default; migrating individual packages are nice but secondary.
[...]

This statement is still true. A `Rules-Requires-Root: binary-targets` now is
better than a `Rules-Requires-Root: no` that you are uncertain about
regardless of the reason for the said (hypothetical) uncertainty. We can
always answer lingering questions at a later stage such as post Trixie and
migrate krb5 to a fully rootless at that time if relevant.

Sam, could you make a maintainer upload with this change?

krb5 is quite central in the OpenLDAP transition that just started.

Post by Guillem Jover
Best regards,
Niels

Thanks
Adrian

[Debian Bug Tracking System]

Your message dated Thu, 16 Jan 2025 19:37:50 +0000
with message-id <E1tYVgc-00ElC0-***@fasolo.debian.org>
and subject line Bug#1092384: fixed in krb5 1.21.3-4
has caused the Debian Bug report #1092384,
regarding krb5: FTBFS: make[1]: *** [debian/rules:111: override_dh_install-arch] Error 1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)