You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

220 lines
5.9 KiB

# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# @ECLASS: fcaps.eclass
# @MAINTAINER:
# base-system@gentoo.org
# @BLURB: function to set POSIX file-based capabilities
# @DESCRIPTION:
# This eclass provides a function to set file-based capabilities on binaries.
# This is not the same as USE=caps which controls runtime capability changes,
# often via packages like libcap.
#
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst phase (at least for now).
#
# @EXAMPLE:
# You can manually set the caps on ping and ping6 by doing:
# @CODE
# pkg_postinst() {
# fcaps cap_net_raw bin/ping bin/ping6
# }
# @CODE
#
# Or set it via the global ebuild var FILECAPS:
# @CODE
# FILECAPS=(
# cap_net_raw bin/ping bin/ping6
# )
# @CODE
if [[ -z ${_FCAPS_ECLASS} ]]; then
_FCAPS_ECLASS=1
IUSE="+filecaps"
# We can't use libcap-ng atm due to #471414.
DEPEND="filecaps? ( sys-libs/libcap )"
# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
# @DESCRIPTION:
# An array of fcap arguments to use to automatically execute fcaps. See that
# function for more details.
#
# All args are consumed until the '--' marker is found. So if you have:
# @CODE
# FILECAPS=( moo cow -- fat cat -- chubby penguin )
# @CODE
#
# This will end up executing:
# @CODE
# fcaps moo cow
# fcaps fat cat
# fcaps chubby penguin
# @CODE
#
# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
# @FUNCTION: fcaps
# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
# @DESCRIPTION:
# Sets the specified capabilities on the specified files.
#
# The caps option takes the form as expected by the cap_from_text(3) man page.
# If no action is specified, then "=ep" will be used as a default.
#
# If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
# ebuild phase.
#
# The caps mode (default 711) is used to set the permission on the file if
# capabilities were properly set on the file.
#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id). The defaults there
# are root:0 and 4711. Otherwise, the ownership and permissions will be
# unchanged.
fcaps() {
debug-print-function ${FUNCNAME} "$@"
# Process the user options first.
local owner='root'
local group='0'
local mode='4711'
local caps_mode='711'
while [[ $# -gt 0 ]] ; do
case $1 in
-o) owner=$2; shift;;
-g) group=$2; shift;;
-m) mode=$2; shift;;
-M) caps_mode=$2; shift;;
*) break;;
esac
shift
done
[[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"
local caps=$1
[[ ${caps} == *[-=+]* ]] || caps+="=ep"
shift
local root
case ${EBUILD_PHASE} in
compile|install|preinst)
root=${ED:-${D}}
;;
postinst)
root=${EROOT:-${ROOT}}
;;
esac
root=${root%/}
# Process every file!
local file
for file ; do
[[ ${file} != /* ]] && file="${root}/${file}"
if use filecaps ; then
# Try to set capabilities. Ignore errors when the
# fs doesn't support it, but abort on all others.
debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
# If everything goes well, we don't want the file to be readable
# by people.
chmod ${caps_mode} "${file}" || die
# Set/verify funcs for sys-libs/libcap.
_libcap() { setcap "${caps}" "${file}" ; }
_libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }
# Set/verify funcs for sys-libs/libcap-ng.
# Note: filecap only supports =ep mode.
# It also expects a different form:
# setcap cap_foo,cap_bar
# filecap foo bar
_libcap_ng() {
local caps=",${caps%=ep}"
filecap "${file}" "${caps//,cap_}"
}
_libcap_ng_verify() {
# libcap-ng has a crappy interface
local rcaps icaps caps=",${caps%=ep}"
rcaps=$(filecap "${file}" | \
sed -nr \
-e "s:^.{${#file}} +::" \
-e 's:, +:\n:g' \
-e 2p | \
LC_ALL=C sort)
[[ ${PIPESTATUS[0]} -eq 0 ]] || return 1
icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
[[ ${rcaps} == ${icaps} ]]
}
local out cmd notfound=0
for cmd in _libcap _libcap_ng ; do
if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
case ${out} in
*"command not found"*)
: $(( ++notfound ))
continue
;;
# ENOTSUP and EOPNOTSUPP might be the same value which means
# strerror() on them is unstable -- we can get both. #559608
*"Not supported"*|\
*"Operation not supported"*)
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support:"
ewarn "* enable XATTR support for '${fstype}' in your kernel (if configurable)"
ewarn "* mount the fs with the user_xattr option (if not the default)"
ewarn "* enable the relevant FS_SECURITY option (if configurable)"
break
;;
*)
eerror "Setting caps '${caps}' on file '${file}' failed:"
eerror "${out}"
die "could not set caps"
;;
esac
else
# Sanity check that everything took.
${cmd}_verify || die "Checking caps '${caps}' on '${file}' failed"
# Everything worked. Move on to the next file.
continue 2
fi
done
if [[ ${notfound} -eq 2 ]] && [[ -z ${_FCAPS_WARNED} ]] ; then
_FCAPS_WARNED="true"
ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
fi
fi
# If we're still here, setcaps failed.
debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
chown "${owner}:${group}" "${file}" || die
chmod ${mode} "${file}" || die
done
}
# @FUNCTION: fcaps_pkg_postinst
# @DESCRIPTION:
# Process the FILECAPS array.
fcaps_pkg_postinst() {
local arg args=()
for arg in "${FILECAPS[@]}" "--" ; do
if [[ ${arg} == "--" ]] ; then
fcaps "${args[@]}"
args=()
else
args+=( "${arg}" )
fi
done
}
EXPORT_FUNCTIONS pkg_postinst
fi