Gentoo Logo
Gentoo Spaceship

Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-dev
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
To: gentoo-dev@g.o
From: Constanze Hausner <constanze@g.o>
Subject: eclass for handling of file-based capabilities
Date: Sat, 5 Mar 2011 14:24:22 +0100

last GSoC I developed an eclass for the handling of file-based
capabilities [1]. One should be able to set file-caps for the binary from
the src_install phase. The eclass handles the setting of the caps and
also applies a fallback file-mode, if the caps-setting goes wrong.

I would be happy, if you guys and gals could take a look at it, 
and review it :).

It uses a new global use-flag (filecaps) so it wouldn't collide with
the caps use-flag and the corresponding old handling of file-caps.

The git repository, which also includes a manpage and some tests for the eclass,
is available here [2]. 
I'm going to update the eclass with your patches there.


# Copyright 2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: $

# @ECLASS: fcaps.eclass
# @MAINTAINER: Constanze Hausner <constanze@g.o>
# @BLURB: function to set POSIX file-based capabilities
# This eclass provides a function to set file-based capabilities on binaries.
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst-phase (at least for now).

DEPEND="filecaps? ( sys-libs/libcap )"

# @FUNCTION: fcaps 
# @USAGE: fcaps {uid:gid} {file-mode} {cap1[,cap2,...]} {file}
# @RETURN: 0 if all okay; non-zero if failure and fallback
# fcaps sets the specified capabilities in the effective and permitted set of
# the given file. In case of failure fcaps sets the given file-mode.
fcaps() {
	debug-print-function ${FUNCNAME} "$@"
	debug-print "${FUNCNAME}: Trying to set capabilities for ${4}"
	local uid_gid=$1
	local perms=$2
	export fallbackFileMode=$perms
	local capset=$3
	local path=$4
	if [ $# -eq 5 ]; then
		local set_mode=$5
		debug-print "${FUNCNAME}: no set-mode provided, setting it to ep"
		#if there is no set_mode provided, it is set to true
		local set_mode=1

	#set owner/group
	debug-print "${FUNCNAME}: setting owner and group to ${uid_gid}"
	chown $uid_gid $path
	if [ $? -ne 0 ]; then
		eerror "chown "$uid_gid" "$path" failed."
		return 2

	#set file-mode including suid
	debug-print "${FUNCNAME}: setting file-mode ${perms}, including suid"
	chmod $perms $path
	if [ $? -ne 0 ]; then
		eerror "chmod "$perms" "$path" failed."
		return 3

	#if filecaps is not enabled all is done
	use !filecaps && return 0

	#if libcap is not installed caps cannot be set
	if [ ! -f "/sbin/setcap" ]; then
		debug-print "${FUNCNAME}: libcap not installed, could not set caps"
		return 4

	#Check for set mode
	if [ $set_mode -eq 1 ]; then
		debug-print "${FUNCNAME}: set-mode = ep"
		local sets="=ep"
		debug-print "${FUNCNAME}: set-mode = ei"
		local sets="=ei"

	#set the capability
	debug-print "${FUNCNAME}: setting capabilities"
	setcap "$capset""$sets" "$path" &> /dev/null

	#check if the capabilitiy got set correctly
	debug-print "${FUNCNAME}: checking capabilities"
	setcap -v "$capset""$sets" "$path" &> /dev/null

	local res=$?

	#if caps could be set, remove suid-bit
	if [ $res -eq 0 ]; then
		debug-print "${FUNCNAME}: caps were set, removing suid-bit"
		chmod -s $path
		debug-print "${FUNCNAME}: caps could not be set"
		ewarn "setcap "$capset" "$path" failed."
		ewarn "Check your kernel and filesystem."
		ewarn "Fallback file-mode was set."

	return $res
Re: eclass for handling of file-based capabilities
-- Brian Harring
Re: eclass for handling of file-based capabilities
-- Ciaran McCreesh
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
RFC: Remove .lzma in favor of .xz portage snapshots
Next by thread:
Re: eclass for handling of file-based capabilities
Previous by date:
Re: Re: Last rites: www-client/chromium-bin
Next by date:
Re: eclass for handling of file-based capabilities

Updated Jun 29, 2012

Summary: Archive of the gentoo-dev mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.