Discussion summary: Mock security

[Thomas Vander Stichele]

Hi,

> In our case, we're using mock to cross-build RPMs.  Here's how my co-
> worker Clark Williams <williams at redhat.com> described it a few months
> ago when he added the chroot command:
> 
> On Thu, 2006-03-02 at 10:09 -0600, Clark Williams wrote: 
> > When cross-building a root filesystem, you need to bootstrap something
> > we call a "sysroot", which is essentially a software development
> > environment for the target system (headers and libraries mostly). The
> > way we do that is we create an empty "root" and as we build RPMS
> > (starting with GLIBC), we install the -devel packages into that target
> > root (the sysroot). Our cross toolchains know how to access the sysroot,
> > so when you compile hello.c, it gets the correct headers and libraries.
> > 
> > To be able to install rpms into the sysroot (which lives in the mock
> > chroot) I've added a chroot command to my local copy of mock (patch
> > below).

FYI, mach (which was the blueprint from which mock was forked) had
commands like this since the beginning for these reasons.  mock removed
some functionality to basically only implement the build-one-package
case.

Maybe you want to take a look at mach instead if these are the things
you are doing - mach still has a wider focus than mock and possibly may
suit you better.

See http://thomas.apestaart.org/projects/mach/

Thomas