Don't run plugins on src.rpm unpacking

The (current) plugin architecture is designed for transactions, really, so don't run the hooks when we're just unpacking a source package. This also fixes potential unpacking failures on systems with a plugin installed that requires root privileges, such as the ima plugin, since src.rpm unpacking is often done as a regular user (see RhBug:2316785).
dmnks · Nov 26, 2024 · 4b79787 · 4b79787
1 parent fe9a914
commit 4b79787
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 7 deletions.
diff --git a/lib/depends.cc b/lib/depends.cc
@@ -453,14 +453,14 @@ int rpmtsAddInstallElement(rpmts ts, Header h,
 			fnpyKey key, int upgrade, rpmRelocation * relocs)
 {
     int op = (upgrade == 0) ? RPMTE_INSTALL : RPMTE_UPGRADE;
-    if (rpmtsSetupTransactionPlugins(ts) == RPMRC_FAIL)
+    if (rpmtsSetupTransactionPlugins(ts, h) == RPMRC_FAIL)
 	return 1;
     return addPackage(ts, h, key, op, relocs);
 }
 
 int rpmtsAddReinstallElement(rpmts ts, Header h, fnpyKey key)
 {
-    if (rpmtsSetupTransactionPlugins(ts) == RPMRC_FAIL)
+    if (rpmtsSetupTransactionPlugins(ts, h) == RPMRC_FAIL)
 	return 1;
     /* TODO: pull relocations from installed package */
     /* TODO: should reinstall of non-installed package fail? */
@@ -470,7 +470,7 @@ int rpmtsAddReinstallElement(rpmts ts, Header h, fnpyKey key)
 int rpmtsAddRestoreElement(rpmts ts, Header h)
 {
     tsMembers tsmem = rpmtsMembers(ts);
-    if (rpmtsSetupTransactionPlugins(ts) == RPMRC_FAIL)
+    if (rpmtsSetupTransactionPlugins(ts, h) == RPMRC_FAIL)
 	return 1;
 
     rpmte p = rpmteNew(ts, h, TR_RESTORED, NULL, NULL, 0);
@@ -485,7 +485,7 @@ int rpmtsAddRestoreElement(rpmts ts, Header h)
 
 int rpmtsAddEraseElement(rpmts ts, Header h, int dboffset)
 {
-    if (rpmtsSetupTransactionPlugins(ts) == RPMRC_FAIL)
+    if (rpmtsSetupTransactionPlugins(ts, h) == RPMRC_FAIL)
 	return 1;
     return removePackage(ts, h, NULL);
 }

diff --git a/lib/rpmts_internal.hh b/lib/rpmts_internal.hh
@@ -131,7 +131,7 @@ RPM_GNUC_INTERNAL
 int rpmtsSolve(rpmts ts, rpmds key);
 
 RPM_GNUC_INTERNAL
-rpmRC rpmtsSetupTransactionPlugins(rpmts ts);
+rpmRC rpmtsSetupTransactionPlugins(rpmts ts, Header h);
 
 RPM_GNUC_INTERNAL
 rpmRC runScript(rpmts ts, rpmte te, Header h, ARGV_const_t prefixes,

diff --git a/lib/transaction.cc b/lib/transaction.cc
@@ -1590,13 +1590,17 @@ static int rpmtsProcess(rpmts ts)
     return rc;
 }
 
-rpmRC rpmtsSetupTransactionPlugins(rpmts ts)
+rpmRC rpmtsSetupTransactionPlugins(rpmts ts, Header h)
 {
     rpmRC rc = RPMRC_OK;
     ARGV_t files = NULL;
     int nfiles = 0;
     char *dsoPath = NULL;
 
+    /* Source packages aren't really installed, only unpacked */
+    if (headerIsSource(h))
+	return RPMRC_OK;
+
     /*
      * Assume allocated equals initialized. There are some oddball cases
      * (verification of non-installed package) where this is not true

diff --git a/tests/rpmdevel.at b/tests/rpmdevel.at
@@ -43,6 +43,9 @@ runroot rpmbuild --quiet -bb \
 	/data/SPECS/simple.spec \
 	/data/SPECS/fakeshell.spec
 
+runroot rpmbuild --quiet -bs \
+	/data/SPECS/simple.spec
+
 runroot rpm -U /build/RPMS/noarch/fakeshell-1.0-1.noarch.rpm
 
 cmake /data/debugplugin && make && make install DESTDIR=${RPMTEST}
@@ -70,5 +73,12 @@ debug_psm_post: simple-1.0-1.noarch:0
 debug_tsm_post: 0
 debug_cleanup
 ])
-RPMTEST_CLEANUP
 
+RPMTEST_CHECK([
+runroot rpm -i /build/SRPMS/simple-1.0-1.src.rpm
+],
+[0],
+[],
+[])
+
+RPMTEST_CLEANUP