From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 487D9138694 for ; Fri, 25 Jan 2013 23:51:49 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9D4DB21C00B; Fri, 25 Jan 2013 23:51:45 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 80CD8E039A for ; Fri, 25 Jan 2013 23:51:44 +0000 (UTC) Received: from vapier.localnet (localhost [127.0.0.1]) by smtp.gentoo.org (Postfix) with ESMTP id 603A933DCAA; Fri, 25 Jan 2013 23:51:43 +0000 (UTC) From: Mike Frysinger Organization: wh0rd.org To: gentoo-dev@lists.gentoo.org Subject: [gentoo-dev] fcaps.eclass: bringing filesystem capabilities to the tree Date: Fri, 25 Jan 2013 18:51:44 -0500 User-Agent: KMail/1.13.7 (Linux/3.7.1; KDE/4.6.5; x86_64; ; ) Cc: constanze@gentoo.org Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2744396.t0NHatUnnn"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <201301251851.45021.vapier@gentoo.org> X-Archives-Salt: c5827a00-3126-41ed-8399-44e4799d80a0 X-Archives-Hash: 0b365856e21cba8db82ac8b593c8f033 --nextPart2744396.t0NHatUnnn Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit i've taken Constanze' work and rewritten it a bit to be easier to use (imo) as most settings are now defaults -mike # Copyright 1999-2013 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: $ # @ECLASS: fcaps.eclass # @MAINTAINER: # Constanze Hausner # base-system@gentoo.org # @BLURB: function to set POSIX file-based capabilities # @DESCRIPTION: # This eclass provides a function to set file-based capabilities on binaries. # # Due to probable capability-loss on moving or copying, this happens in # pkg_postinst-phase (at least for now). # # @EXAMPLE: # You can manually set the caps on ping and ping6 by doing: # @CODE # pkg_postinst() { # fcaps cap_net_raw bin/ping bin/ping6 # } # @CODE # # Or set it via the global ebuild var FILECAPS: # @CODE # FILECAPS=( # cap_net_raw bin/ping bin/ping6 # ) # @CODE if [[ ${___ECLASS_ONCE_FCAPS} != "recur -_+^+_- spank" ]] ; then ___ECLASS_ONCE_FCAPS="recur -_+^+_- spank" IUSE="+filecaps" DEPEND="filecaps? ( sys-libs/libcap )" # @ECLASS-VARIABLE: FILECAPS # @DEFAULT_UNSET # @DESCRIPTION: # An array of fcap arguments to use to automatically execute fcaps. See that # function for more details. # # All args are consumed until the '--' marker is found. So if you have: # @CODE # FILECAPS=( moo cow -- fat cat -- chubby penguin ) # @CODE # # This will end up executing: # @CODE # fcaps moo cow # fcaps fat cat # fcaps chubby penguin # @CODE # # Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself. # @FUNCTION: fcaps # @USAGE: [-o ] [-g ] [-m ] # @DESCRIPTION: # Sets the specified capabilities on the specified files. # # The caps option takes the form as expected by the cap_from_text(3) man page. # If no action is specified, then "=ep" will be used as a default. # # If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the # appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current # ebuild phase. # # If the system is unable to set capabilities, it will use the specified user, # group, and mode (presumably to make the binary set*id). The defaults there # are root:root and 4711. Otherwise, the ownership and permissions will be # unchanged. fcaps() { debug-print-function ${FUNCNAME} "$@" # Process the user options first. local owner='root' local group='root' local mode='4711' while [[ $# -gt 0 ]] ; do case $1 in -o) owner=$2; shift;; -g) group=$2; shift;; -m) mode=$2; shift;; *) break;; esac shift done [[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count" local caps=$1 [[ ${caps} == *[-=+]* ]] || caps+="=ep" shift local root case ${EBUILD_PHASE} in compile|install|preinst) root=${ED:-${D}} ;; postinst) root=${EROOT:-${ROOT}} ;; esac # Process every file! local file out for file ; do [[ ${file} != /* ]] && file="${root}${file}" if use filecaps ; then # Try to set capabilities. Ignore errors when the # fs doesn't support it, but abort on all others. debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'" if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then if [[ ${out} != *"Operation not supported"* ]] ; then eerror "Setting caps '${caps}' on file '${file}' failed:" eerror "${out}" die "could not set caps" else local fstype=$(stat -f -c %T "${file}") ewarn "Could not set caps on '${file}' due to missing filesystem support." ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel." fi else # Sanity check that everything took. setcap -v "${caps}" "${file}" >/dev/null \ || die "Checking caps '${caps}' on '${file}' failed" # Everything worked. Move on to the next file. continue fi fi # If we're still here, setcaps failed. debug-print "${FUNCNAME}: setting owner/mode on '${file}'" chown "${owner}:${group}" "${file}" || die chmod ${mode} "${file}" || die done } # @FUNCTION: fcaps_pkg_postinst # @DESCRIPTION: # Process the FILECAPS array. fcaps_pkg_postinst() { local arg args=() for arg in "${FILECAPS[@]}" "--" ; do if [[ ${arg} == "--" ]] ; then fcaps "${args[@]}" args=() else args+=( "${arg}" ) fi done } EXPORT_FUNCTIONS pkg_postinst fi --nextPart2744396.t0NHatUnnn Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (GNU/Linux) iQIcBAABAgAGBQJRAxqQAAoJEEFjO5/oN/WBKNUP/2CVo7D4S3GiPt1J/teC2ea6 Bn8Q35UEOJUAI9fbWhSbunXu2+6VBJQUekS2OAxmlznYxH5fjB7AP692m1fviOna Xi/MpDKlsHLCt6h/bPLdgiPYFcyv8ZIkEyd/xObX+P4+HJuLdE/Sxr17DIs3u1DQ 3vRO83kxz6VAyReSgtcSFYC7zyzRPVy1qSkBTjjHUo8f3MVY73Tw9eAUf3bWl/UZ ZGqRL02XNgePEL2mw+r/VaK0JGRhrt03NP4fKQD4JMWQ0XXrR2/Vh+z5gmQQcWFJ 4RLPkW6xq/+HQ0L+zrYK/uwF3kvFhiQBoxGVYg9MTwgZCClfAbSYHgKrDiwWSuO6 Zdn3LKTxnItbcf9o7R5/NXsjnCC89uzcWLmJdWw98vo2OZD1+/7tbcAW5h856crQ rHkkb7nUZxE735hVmgKFpVyxfHvh5LQnQ1+dUeIA3T2xGjIIRGjgT6CIYPfMMgm9 Jxq6YZYR7hXGDXyh0BJwwKIjg9yQULoaV3M1qybB6LoiFnJ0x45sKjFCtTxOxAr+ pR/N93Yb5RUMnLxRso5zgBRGBccQXxV+yjO6b6qgHlPq5XLO71Iodv4jdzIIRJIv OXvYNA74zfG+D7qyVBT3KtHDfwwx7ZCv3f7UkQmZng3NB0a4/wof0Oh1hYHpO1m5 YQ1sp4V1g8XZcE7BVmBD =pdma -----END PGP SIGNATURE----- --nextPart2744396.t0NHatUnnn--