1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.3 2013/01/30 07:15:49 vapier Exp $
# @ECLASS: fcaps.eclass
# @MAINTAINER:
# Constanze Hausner <constanze@gentoo.org>
# base-system@gentoo.org
# @BLURB: function to set POSIX file-based capabilities
# @DESCRIPTION:
# This eclass provides a function to set file-based capabilities on binaries.
#
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst-phase (at least for now).
#
# @EXAMPLE:
# You can manually set the caps on ping and ping6 by doing:
# @CODE
# pkg_postinst() {
# fcaps cap_net_raw bin/ping bin/ping6
# }
# @CODE
#
# Or set it via the global ebuild var FILECAPS:
# @CODE
# FILECAPS=(
# cap_net_raw bin/ping bin/ping6
# )
# @CODE
if [[ ${___ECLASS_ONCE_FCAPS} != "recur -_+^+_- spank" ]] ; then
___ECLASS_ONCE_FCAPS="recur -_+^+_- spank"
IUSE="+filecaps"
DEPEND="filecaps? ( sys-libs/libcap )"
# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
# @DESCRIPTION:
# An array of fcap arguments to use to automatically execute fcaps. See that
# function for more details.
#
# All args are consumed until the '--' marker is found. So if you have:
# @CODE
# FILECAPS=( moo cow -- fat cat -- chubby penguin )
# @CODE
#
# This will end up executing:
# @CODE
# fcaps moo cow
# fcaps fat cat
# fcaps chubby penguin
# @CODE
#
# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
# @FUNCTION: fcaps
# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
# @DESCRIPTION:
# Sets the specified capabilities on the specified files.
#
# The caps option takes the form as expected by the cap_from_text(3) man page.
# If no action is specified, then "=ep" will be used as a default.
#
# If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
# ebuild phase.
#
# The caps mode (default 711) is used to set the permission on the file if
# capabilities were properly set on the file.
#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id). The defaults there
# are root:root and 4711. Otherwise, the ownership and permissions will be
# unchanged.
fcaps() {
debug-print-function ${FUNCNAME} "$@"
# Process the user options first.
local owner='root'
local group='root'
local mode='4711'
local caps_mode='711'
while [[ $# -gt 0 ]] ; do
case $1 in
-o) owner=$2; shift;;
-g) group=$2; shift;;
-m) mode=$2; shift;;
-M) caps_mode=$2; shift;;
*) break;;
esac
shift
done
[[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"
local caps=$1
[[ ${caps} == *[-=+]* ]] || caps+="=ep"
shift
local root
case ${EBUILD_PHASE} in
compile|install|preinst)
root=${ED:-${D}}
;;
postinst)
root=${EROOT:-${ROOT}}
;;
esac
# Process every file!
local file out
for file ; do
[[ ${file} != /* ]] && file="${root}${file}"
if use filecaps ; then
# Try to set capabilities. Ignore errors when the
# fs doesn't support it, but abort on all others.
debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
# If everything goes well, we don't want the file to be readable
# by people.
chmod ${caps_mode} "${file}" || die
if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
if [[ ${out} != *"Operation not supported"* ]] ; then
eerror "Setting caps '${caps}' on file '${file}' failed:"
eerror "${out}"
die "could not set caps"
else
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support."
ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
ewarn "You might also have to enable the relevant FS_SECURITY option."
fi
else
# Sanity check that everything took.
setcap -v "${caps}" "${file}" >/dev/null \
|| die "Checking caps '${caps}' on '${file}' failed"
# Everything worked. Move on to the next file.
continue
fi
fi
# If we're still here, setcaps failed.
debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
chown "${owner}:${group}" "${file}" || die
chmod ${mode} "${file}" || die
done
}
# @FUNCTION: fcaps_pkg_postinst
# @DESCRIPTION:
# Process the FILECAPS array.
fcaps_pkg_postinst() {
local arg args=()
for arg in "${FILECAPS[@]}" "--" ; do
if [[ ${arg} == "--" ]] ; then
fcaps "${args[@]}"
args=()
else
args+=( "${arg}" )
fi
done
}
EXPORT_FUNCTIONS pkg_postinst
fi
|
GitWeb