fix: add tmpfiles for faillock dirs

[89luca89]

Ref VMS-231

[octo-sts]

🌐 Build Failed: Environment

chgrp: /home/build/melange-out/linux-pam/bin/unix_chkpwd: No such file or directory

Build Details

Category	Details
Build System	meson/ninja
Failure Point	chgrp command during installation phase

Root Cause Analysis 🔍

The chgrp command is trying to change group ownership of unix_chkpwd at /home/build/melange-out/linux-pam/bin/unix_chkpwd, but this file does not exist at that path. The file was actually installed to /home/build/melange-out/linux-pam/usr/bin/unix_chkpwd according to the installation logs, indicating a path mismatch in the post-installation script or configuration.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Suggested Changes

File: melange.yaml

• modification at line around line 50-51 (pipeline runs section)
  Original:

      # make "unix_chkpwd" shadow group and enable g+s
      chgrp shadow ${{targets.destdir}}/bin/unix_chkpwd \
        && chmod g+s ${{targets.destdir}}/bin/unix_chkpwd

Replacement:

      # make "unix_chkpwd" shadow group and enable g+s
      chgrp shadow ${{targets.destdir}}/usr/bin/unix_chkpwd \
        && chmod g+s ${{targets.destdir}}/usr/bin/unix_chkpwd

Content:

Change the path from /bin/unix_chkpwd to /usr/bin/unix_chkpwd to match where meson actually installs the binary

Click to expand fix analysis

Analysis

No similar build failures were provided for analysis. However, analyzing the current failure: The error occurs because the chgrp command is looking for unix_chkpwd at /home/build/melange-out/linux-pam/bin/unix_chkpwd but the file was actually installed to /home/build/melange-out/linux-pam/usr/bin/unix_chkpwd. This is a path mismatch issue where the meson configuration specified -Dsbindir=/usr/bin which affects the installation path, but the post-installation script assumes the binary is in /bin.

Click to expand fix explanation

Explanation

The fix addresses the root cause of the build failure by correcting the path mismatch. The meson build system was configured with -Dsbindir=/usr/bin, which means executables that would normally go to /sbin are instead installed to /usr/bin. The unix_chkpwd binary is one such executable. However, the post-installation script was still trying to access it at the old path /bin/unix_chkpwd. By updating the script to use /usr/bin/unix_chkpwd, we align the script with the actual installation path determined by the meson configuration. This ensures that the chgrp and chmod commands can find the file and properly set its permissions.

Click to expand alternative approaches

Alternative Approaches

• Remove the -Dsbindir=/usr/bin option from meson configuration to let unix_chkpwd install to its default location, but this would conflict with the merged-usrsbin dependency which expects binaries in /usr/bin
• Use a find command to locate unix_chkpwd dynamically before applying chgrp/chmod, but this adds unnecessary complexity when the path can be determined from the meson configuration

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[egibs]

The ci-diff-report changes are expected:

usr/bin/unix_chkpwd
+ NOTE: permissions changed for usr/bin/unix_chkpwd: 755 -> 2755
+ WARNING: usr/bin/unix_chkpwd now has special permissions: setgid
- -rwxr-xr-x 91792 2025-10-16 12:19:44 unix_chkpwd
-   APK-TOOLS.checksum.SHA1: "a8b870aa360a77e09f1f922c5e510b4774218d95"
+ grwxr-xr-x 91840 2025-12-02 17:21:44 unix_chkpwd
+   APK-TOOLS.checksum.SHA1: "3441e675a0f35770434a2eda1437a3c8c50bac3a"

due to:

chgrp shadow ${{targets.destdir}}/usr/bin/unix_chkpwd \
  && chmod g+s ${{targets.destdir}}/usr/bin/unix_chkpwd

[89luca89]

The ci-diff-report changes are expected:

usr/bin/unix_chkpwd
+ NOTE: permissions changed for usr/bin/unix_chkpwd: 755 -> 2755
+ WARNING: usr/bin/unix_chkpwd now has special permissions: setgid
- -rwxr-xr-x 91792 2025-10-16 12:19:44 unix_chkpwd
-   APK-TOOLS.checksum.SHA1: "a8b870aa360a77e09f1f922c5e510b4774218d95"
+ grwxr-xr-x 91840 2025-12-02 17:21:44 unix_chkpwd
+   APK-TOOLS.checksum.SHA1: "3441e675a0f35770434a2eda1437a3c8c50bac3a"

due to:

chgrp shadow ${{targets.destdir}}/usr/bin/unix_chkpwd \
  && chmod g+s ${{targets.destdir}}/usr/bin/unix_chkpwd

Yea I think before the chgrp whas silently failing I guess

[a-crate]

Out of curiosity, why is this a tmpfiles.d snippet instead of just mkdir -p ${{targets.destdir}}/var/log/faillock in the package build script?

[sergiodj]

Out of curiosity, why is this a tmpfiles.d snippet instead of just mkdir -p ${{targets.destdir}}/var/log/faillock in the package build script?

I believe it's because of the SELinux context thing, although it should be possible to use mkdir -pZ .... I'll wait for a reply before approving this PR.