diff --git a/mock/py/mockbuild/buildroot.py b/mock/py/mockbuild/buildroot.py
index becdbaf2e..8c34bb711 100644
--- a/mock/py/mockbuild/buildroot.py
+++ b/mock/py/mockbuild/buildroot.py
@@ -426,6 +426,24 @@ def doChroot(self, command, nosync=False, *args, **kargs):
                 self.uid_manager.restorePrivs()
         return result
 
+    def doChrootPlugin(self, command, cwd=None):
+        """
+        Execute command (specified as array, not a shell command string) in this
+        buildroot  in `cwd`, as a non-privileged user.  Used by plugins.
+        """
+        private_network = not self.config.get('rpmbuild_networking', False)
+        self.doChroot(
+            command,
+            shell=False,
+            cwd=cwd,
+            logger=self.build_log,
+            uid=self.chrootuid,
+            gid=self.chrootgid,
+            user=self.chrootuser,
+            unshare_net=private_network,
+            printOutput=self.config.get('print_main_output', True)
+        )
+
     def all_chroot_packages(self):
         """package set, result of rpm -qa in the buildroot"""
         self.nuke_rpm_db()
diff --git a/mock/py/mockbuild/plugins/rpkg_preprocessor.py b/mock/py/mockbuild/plugins/rpkg_preprocessor.py
index 878a08775..ae7eff53a 100644
--- a/mock/py/mockbuild/plugins/rpkg_preprocessor.py
+++ b/mock/py/mockbuild/plugins/rpkg_preprocessor.py
@@ -104,18 +104,4 @@ def _preprocess(self, host_chroot_spec, host_chroot_sources):
         command_str = self.opts.get('cmd') % {'source_spec': chroot_sources_spec,
                                               'target_spec': chroot_spec}
         command = shlex.split(command_str)
-
-        # determine whether to use private network or not based on rpmbuild_networking
-        private_network = (not self.config.get('rpmbuild_networking', False))
-
-        self.buildroot.doChroot(
-            command,
-            shell=False,
-            cwd=chroot_sources,
-            logger=self.buildroot.build_log,
-            uid=self.buildroot.chrootuid,
-            gid=self.buildroot.chrootgid,
-            user=self.buildroot.chrootuser,
-            unshare_net=private_network,
-            printOutput=self.config.get('print_main_output', True)
-        )
+        self.buildroot.doChrootPlugin(command, cwd=chroot_sources)
diff --git a/mock/py/mockbuild/plugins/rpmautospec.py b/mock/py/mockbuild/plugins/rpmautospec.py
index 3d8fc195f..fd501e9de 100644
--- a/mock/py/mockbuild/plugins/rpmautospec.py
+++ b/mock/py/mockbuild/plugins/rpmautospec.py
@@ -114,14 +114,4 @@ def attempt_process_distgit(
         # bonus, spec files will be processed in the environment they will be
         # built for, reducing the impact of the host system on the outcome,
         # leading to more deterministic results and better repeatable builds.
-        self.buildroot.doChroot(
-            command,
-            shell=False,
-            cwd=chroot_sources,
-            logger=self.buildroot.build_log,
-            uid=self.buildroot.chrootuid,
-            gid=self.buildroot.chrootgid,
-            user=self.buildroot.chrootuser,
-            unshare_net=not self.config.get("rpmbuild_networking", False),
-            printOutput=self.config.get("print_main_output", True),
-        )
+        self.buildroot.doChrootPlugin(command, cwd=chroot_sources)
diff --git a/mock/tests/plugins/test_rpmautospec.py b/mock/tests/plugins/test_rpmautospec.py
index 53be74954..04a816647 100644
--- a/mock/tests/plugins/test_rpmautospec.py
+++ b/mock/tests/plugins/test_rpmautospec.py
@@ -158,19 +158,12 @@ def test_attempt_process_distgit(
 
             expected_command = plugin.opts["cmd_base"] + [chroot_sources_spec, chroot_spec]
 
-            plugin.buildroot.doChroot.assert_called_once_with(
+            plugin.buildroot.doChrootPlugin.assert_called_once_with(
                 expected_command,
-                shell=False,
                 cwd=chroot_sources,
-                logger=plugin.buildroot.build_log,
-                uid=plugin.buildroot.chrootuid,
-                gid=plugin.buildroot.chrootgid,
-                user=plugin.buildroot.chrootuser,
-                unshare_net=not plugin.config.get("rpmbuild_networking", False),
-                printOutput=plugin.config.get("print_main_output", True),
             )
         else:
-            plugin.buildroot.doChroot.assert_not_called()
+            plugin.buildroot.doChrootPlugin.assert_not_called()
             if "broken-requires" not in testcase:
                 if "spec-files-different" in testcase:
                     log_method = log.warning