* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-01-27 17:27 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-01-27 17:27 UTC (permalink / raw
To: gentoo-commits
vapier 13/01/27 17:27:10
Added: fcaps.eclass
Log:
initial file capabilities support
Revision Changes Path
1.1 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.1&content-type=text/plain
Index: fcaps.eclass
===================================================================
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.1 2013/01/27 17:27:10 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
# Constanze Hausner <constanze@gentoo.org>
# base-system@gentoo.org
# @BLURB: function to set POSIX file-based capabilities
# @DESCRIPTION:
# This eclass provides a function to set file-based capabilities on binaries.
#
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst-phase (at least for now).
#
# @EXAMPLE:
# You can manually set the caps on ping and ping6 by doing:
# @CODE
# pkg_postinst() {
# fcaps cap_net_raw bin/ping bin/ping6
# }
# @CODE
#
# Or set it via the global ebuild var FILECAPS:
# @CODE
# FILECAPS=(
# cap_net_raw bin/ping bin/ping6
# )
# @CODE
if [[ ${___ECLASS_ONCE_FCAPS} != "recur -_+^+_- spank" ]] ; then
___ECLASS_ONCE_FCAPS="recur -_+^+_- spank"
IUSE="+filecaps"
DEPEND="filecaps? ( sys-libs/libcap )"
# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
# @DESCRIPTION:
# An array of fcap arguments to use to automatically execute fcaps. See that
# function for more details.
#
# All args are consumed until the '--' marker is found. So if you have:
# @CODE
# FILECAPS=( moo cow -- fat cat -- chubby penguin )
# @CODE
#
# This will end up executing:
# @CODE
# fcaps moo cow
# fcaps fat cat
# fcaps chubby penguin
# @CODE
#
# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
# @FUNCTION: fcaps
# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] <capabilities> <file[s]>
# @DESCRIPTION:
# Sets the specified capabilities on the specified files.
#
# The caps option takes the form as expected by the cap_from_text(3) man page.
# If no action is specified, then "=ep" will be used as a default.
#
# If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
# ebuild phase.
#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id). The defaults there
# are root:root and 4711. Otherwise, the ownership and permissions will be
# unchanged.
fcaps() {
debug-print-function ${FUNCNAME} "$@"
# Process the user options first.
local owner='root'
local group='root'
local mode='4711'
while [[ $# -gt 0 ]] ; do
case $1 in
-o) owner=$2; shift;;
-g) group=$2; shift;;
-m) mode=$2; shift;;
*) break;;
esac
shift
done
[[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"
local caps=$1
[[ ${caps} == *[-=+]* ]] || caps+="=ep"
shift
local root
case ${EBUILD_PHASE} in
compile|install|preinst)
root=${ED:-${D}}
;;
postinst)
root=${EROOT:-${ROOT}}
;;
esac
# Process every file!
local file out
for file ; do
[[ ${file} != /* ]] && file="${root}${file}"
if use filecaps ; then
# Try to set capabilities. Ignore errors when the
# fs doesn't support it, but abort on all others.
debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
if [[ ${out} != *"Operation not supported"* ]] ; then
eerror "Setting caps '${caps}' on file '${file}' failed:"
eerror "${out}"
die "could not set caps"
else
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support."
ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
fi
else
# Sanity check that everything took.
setcap -v "${caps}" "${file}" >/dev/null \
|| die "Checking caps '${caps}' on '${file}' failed"
# Everything worked. Move on to the next file.
continue
fi
fi
# If we're still here, setcaps failed.
debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
chown "${owner}:${group}" "${file}" || die
chmod ${mode} "${file}" || die
done
}
# @FUNCTION: fcaps_pkg_postinst
# @DESCRIPTION:
# Process the FILECAPS array.
fcaps_pkg_postinst() {
local arg args=()
for arg in "${FILECAPS[@]}" "--" ; do
if [[ ${arg} == "--" ]] ; then
fcaps "${args[@]}"
args=()
else
args+=( "${arg}" )
fi
done
}
EXPORT_FUNCTIONS pkg_postinst
fi
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-01-27 17:47 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-01-27 17:47 UTC (permalink / raw
To: gentoo-commits
vapier 13/01/27 17:47:10
Modified: fcaps.eclass
Log:
add a flag for setting the permission of the file when using capabilities
Revision Changes Path
1.2 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.2&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.2&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.1&r2=1.2
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- fcaps.eclass 27 Jan 2013 17:27:10 -0000 1.1
+++ fcaps.eclass 27 Jan 2013 17:47:10 -0000 1.2
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.1 2013/01/27 17:27:10 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.2 2013/01/27 17:47:10 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -56,7 +56,7 @@
# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
# @FUNCTION: fcaps
-# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] <capabilities> <file[s]>
+# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
# @DESCRIPTION:
# Sets the specified capabilities on the specified files.
#
@@ -67,6 +67,9 @@
# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
# ebuild phase.
#
+# The caps mode (default 711) is used to set the permission on the file if
+# capabilities were properly set on the file.
+#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id). The defaults there
# are root:root and 4711. Otherwise, the ownership and permissions will be
@@ -78,12 +81,14 @@
local owner='root'
local group='root'
local mode='4711'
+ local caps_mode='711'
while [[ $# -gt 0 ]] ; do
case $1 in
-o) owner=$2; shift;;
-g) group=$2; shift;;
-m) mode=$2; shift;;
+ -M) caps_mode=$2; shift;;
*) break;;
esac
shift
@@ -115,6 +120,10 @@
# fs doesn't support it, but abort on all others.
debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
+ # If everything goes well, we don't want the file to be readable
+ # by people.
+ chmod ${caps_mode} "${file}" || die
+
if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
if [[ ${out} != *"Operation not supported"* ]] ; then
eerror "Setting caps '${caps}' on file '${file}' failed:"
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-01-30 7:15 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-01-30 7:15 UTC (permalink / raw
To: gentoo-commits
vapier 13/01/30 07:15:49
Modified: fcaps.eclass
Log:
also warn about CONFIG_EXT{2,3,4}_FS_SECURITY options #454440
Revision Changes Path
1.3 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.3&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.3&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.2&r2=1.3
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- fcaps.eclass 27 Jan 2013 17:47:10 -0000 1.2
+++ fcaps.eclass 30 Jan 2013 07:15:49 -0000 1.3
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.2 2013/01/27 17:47:10 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.3 2013/01/30 07:15:49 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -133,6 +133,7 @@
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support."
ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
+ ewarn "You might also have to enable the relevant FS_SECURITY option."
fi
else
# Sanity check that everything took.
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-04-28 3:11 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-04-28 3:11 UTC (permalink / raw
To: gentoo-commits
vapier 13/04/28 03:11:47
Modified: fcaps.eclass
Log:
only warn if setcap is not found rather than be fatal #458518
Revision Changes Path
1.4 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.4&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.4&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.3&r2=1.4
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- fcaps.eclass 30 Jan 2013 07:15:49 -0000 1.3
+++ fcaps.eclass 28 Apr 2013 03:11:47 -0000 1.4
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.3 2013/01/30 07:15:49 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.4 2013/04/28 03:11:47 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -125,16 +125,25 @@
chmod ${caps_mode} "${file}" || die
if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
- if [[ ${out} != *"Operation not supported"* ]] ; then
- eerror "Setting caps '${caps}' on file '${file}' failed:"
- eerror "${out}"
- die "could not set caps"
- else
+ case ${out} in
+ *"command not found"*)
+ if [[ -z ${__FCAPS_WARNED} ]] ; then
+ __FCAPS_WARNED="true"
+ ewarn "Could not find cap utils. Please make sure libcap is available."
+ fi
+ ;;
+ *"Operation not supported"*)
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support."
ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
ewarn "You might also have to enable the relevant FS_SECURITY option."
- fi
+ ;;
+ *)
+ eerror "Setting caps '${caps}' on file '${file}' failed:"
+ eerror "${out}"
+ die "could not set caps"
+ ;;
+ esac
else
# Sanity check that everything took.
setcap -v "${caps}" "${file}" >/dev/null \
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-04-28 4:24 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-04-28 4:24 UTC (permalink / raw
To: gentoo-commits
vapier 13/04/28 04:24:59
Modified: fcaps.eclass
Log:
add support for setting/checking caps via libcap-ng #454908
Revision Changes Path
1.5 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.5&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.5&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.4&r2=1.5
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- fcaps.eclass 28 Apr 2013 03:11:47 -0000 1.4
+++ fcaps.eclass 28 Apr 2013 04:24:59 -0000 1.5
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.4 2013/04/28 03:11:47 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.5 2013/04/28 04:24:59 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -33,7 +33,7 @@
IUSE="+filecaps"
-DEPEND="filecaps? ( sys-libs/libcap )"
+DEPEND="filecaps? ( || ( sys-libs/libcap sys-libs/libcap-ng ) )"
# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
@@ -111,7 +111,7 @@
esac
# Process every file!
- local file out
+ local file
for file ; do
[[ ${file} != /* ]] && file="${root}${file}"
@@ -124,33 +124,64 @@
# by people.
chmod ${caps_mode} "${file}" || die
- if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
- case ${out} in
- *"command not found"*)
- if [[ -z ${__FCAPS_WARNED} ]] ; then
- __FCAPS_WARNED="true"
- ewarn "Could not find cap utils. Please make sure libcap is available."
- fi
- ;;
- *"Operation not supported"*)
- local fstype=$(stat -f -c %T "${file}")
- ewarn "Could not set caps on '${file}' due to missing filesystem support."
- ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
- ewarn "You might also have to enable the relevant FS_SECURITY option."
- ;;
- *)
- eerror "Setting caps '${caps}' on file '${file}' failed:"
- eerror "${out}"
- die "could not set caps"
- ;;
- esac
- else
- # Sanity check that everything took.
- setcap -v "${caps}" "${file}" >/dev/null \
- || die "Checking caps '${caps}' on '${file}' failed"
-
- # Everything worked. Move on to the next file.
- continue
+ # Set/verify funcs for sys-libs/libcap.
+ _libcap() { setcap "${caps}" "${file}" ; }
+ _libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }
+
+ # Set/verify funcs for sys-libs/libcap-ng.
+ # Note: filecap only supports =ep mode.
+ # It also expects a different form:
+ # setcap cap_foo,cap_bar
+ # filecap foo bar
+ _libcap_ng() {
+ local caps=",${caps%=ep}"
+ filecap "${file}" "${caps//,cap_}"
+ }
+ _libcap_ng_verify() {
+ # libcap-ng has a crappy interface
+ local rcaps icaps caps=",${caps%=ep}"
+ rcaps=$(filecap "${file}" | \
+ sed -nr \
+ -e "s:^.{${#file}} +::" \
+ -e 's:, +:\n:g' \
+ -e 2p | \
+ LC_ALL=C sort) || return 1
+ icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
+ [[ ${rcaps} == ${icaps} ]]
+ }
+
+ local out cmd notfound=0
+ for cmd in _libcap _libcap_ng ; do
+ if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
+ case ${out} in
+ *"command not found"*)
+ : $(( ++notfound ))
+ continue
+ ;;
+ *"Operation not supported"*)
+ local fstype=$(stat -f -c %T "${file}")
+ ewarn "Could not set caps on '${file}' due to missing filesystem support."
+ ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
+ ewarn "You might also have to enable the relevant FS_SECURITY option."
+ break
+ ;;
+ *)
+ eerror "Setting caps '${caps}' on file '${file}' failed:"
+ eerror "${out}"
+ die "could not set caps"
+ ;;
+ esac
+ else
+ # Sanity check that everything took.
+ ${cmd}_verify || die "Checking caps '${caps}' on '${file}' failed"
+
+ # Everything worked. Move on to the next file.
+ continue 2
+ fi
+ done
+ if [[ ${notfound} -eq 2 ]] && [[ -z ${__FCAPS_WARNED} ]] ; then
+ __FCAPS_WARNED="true"
+ ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
fi
fi
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-06-01 2:29 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-06-01 2:29 UTC (permalink / raw
To: gentoo-commits
vapier 13/06/01 02:29:49
Modified: fcaps.eclass
Log:
fcaps: _libcap_ng_verify: check the exit code of filecap in the pipeline and not the sed/sort commands
Revision Changes Path
1.6 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.6&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.6&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.5&r2=1.6
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- fcaps.eclass 28 Apr 2013 04:24:59 -0000 1.5
+++ fcaps.eclass 1 Jun 2013 02:29:49 -0000 1.6
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.5 2013/04/28 04:24:59 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.6 2013/06/01 02:29:49 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -145,7 +145,8 @@
-e "s:^.{${#file}} +::" \
-e 's:, +:\n:g' \
-e 2p | \
- LC_ALL=C sort) || return 1
+ LC_ALL=C sort)
+ [[ ${PIPESTATUS[0]} -eq 0 ]] || return 1
icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
[[ ${rcaps} == ${icaps} ]]
}
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-06-02 15:21 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-06-02 15:21 UTC (permalink / raw
To: gentoo-commits
vapier 13/06/02 15:21:04
Modified: fcaps.eclass
Log:
force libcap until the libcap-ng bugs can get sorted out #471414
Revision Changes Path
1.7 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.7&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.7&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.6&r2=1.7
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- fcaps.eclass 1 Jun 2013 02:29:49 -0000 1.6
+++ fcaps.eclass 2 Jun 2013 15:21:04 -0000 1.7
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.6 2013/06/01 02:29:49 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.7 2013/06/02 15:21:04 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -33,7 +33,8 @@
IUSE="+filecaps"
-DEPEND="filecaps? ( || ( sys-libs/libcap sys-libs/libcap-ng ) )"
+# We can't use libcap-ng atm due to #471414.
+DEPEND="filecaps? ( sys-libs/libcap )"
# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2013-06-27 1:18 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2013-06-27 1:18 UTC (permalink / raw
To: gentoo-commits
vapier 13/06/27 01:18:57
Modified: fcaps.eclass
Log:
fcaps: also mention user_xattr mount option #473246 by BT
Revision Changes Path
1.8 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.8&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.8&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.7&r2=1.8
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- fcaps.eclass 2 Jun 2013 15:21:04 -0000 1.7
+++ fcaps.eclass 27 Jun 2013 01:18:57 -0000 1.8
@@ -1,6 +1,6 @@
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.7 2013/06/02 15:21:04 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.8 2013/06/27 01:18:57 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -162,9 +162,10 @@
;;
*"Operation not supported"*)
local fstype=$(stat -f -c %T "${file}")
- ewarn "Could not set caps on '${file}' due to missing filesystem support."
- ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
- ewarn "You might also have to enable the relevant FS_SECURITY option."
+ ewarn "Could not set caps on '${file}' due to missing filesystem support:"
+ ewarn "* enable XATTR support for '${fstype}' in your kernel (if configurable)"
+ ewarn "* mount the fs with the user_xattr option (if not the default)"
+ ewarn "* enable the relevant FS_SECURITY option (if configurable)"
break
;;
*)
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2014-07-31 10:21 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2014-07-31 10:21 UTC (permalink / raw
To: gentoo-commits
vapier 14/07/31 10:21:05
Modified: fcaps.eclass
Log:
use 0 for the fallback group rather than "root" to avoid portability issues (e.g. BSDs that do not have a root group)
Revision Changes Path
1.10 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.10&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.10&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.9&r2=1.10
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- fcaps.eclass 11 Jul 2014 08:21:58 -0000 1.9
+++ fcaps.eclass 31 Jul 2014 10:21:05 -0000 1.10
@@ -1,6 +1,6 @@
# Copyright 1999-2014 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.9 2014/07/11 08:21:58 ulm Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.10 2014/07/31 10:21:05 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -73,14 +73,14 @@
#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id). The defaults there
-# are root:root and 4711. Otherwise, the ownership and permissions will be
+# are root:0 and 4711. Otherwise, the ownership and permissions will be
# unchanged.
fcaps() {
debug-print-function ${FUNCNAME} "$@"
# Process the user options first.
local owner='root'
- local group='root'
+ local group='0'
local mode='4711'
local caps_mode='711'
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass
@ 2015-02-18 16:11 Mike Frysinger (vapier)
0 siblings, 0 replies; 10+ messages in thread
From: Mike Frysinger (vapier) @ 2015-02-18 16:11 UTC (permalink / raw
To: gentoo-commits
vapier 15/02/18 16:11:53
Modified: fcaps.eclass
Log:
clarify USE=filecaps intention #540430
Revision Changes Path
1.11 eclass/fcaps.eclass
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.11&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?rev=1.11&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/eclass/fcaps.eclass?r1=1.10&r2=1.11
Index: fcaps.eclass
===================================================================
RCS file: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- fcaps.eclass 31 Jul 2014 10:21:05 -0000 1.10
+++ fcaps.eclass 18 Feb 2015 16:11:53 -0000 1.11
@@ -1,6 +1,6 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.10 2014/07/31 10:21:05 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.11 2015/02/18 16:11:53 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
@@ -9,6 +9,8 @@
# @BLURB: function to set POSIX file-based capabilities
# @DESCRIPTION:
# This eclass provides a function to set file-based capabilities on binaries.
+# This is not the same as USE=caps which controls runtime capability changes,
+# often via packages like libcap.
#
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst-phase (at least for now).
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2015-02-18 16:11 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-28 3:11 [gentoo-commits] gentoo-x86 commit in eclass: fcaps.eclass Mike Frysinger (vapier)
-- strict thread matches above, loose matches on Subject: below --
2015-02-18 16:11 Mike Frysinger (vapier)
2014-07-31 10:21 Mike Frysinger (vapier)
2013-06-27 1:18 Mike Frysinger (vapier)
2013-06-02 15:21 Mike Frysinger (vapier)
2013-06-01 2:29 Mike Frysinger (vapier)
2013-04-28 4:24 Mike Frysinger (vapier)
2013-01-30 7:15 Mike Frysinger (vapier)
2013-01-27 17:47 Mike Frysinger (vapier)
2013-01-27 17:27 Mike Frysinger (vapier)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox