gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-08-06 00:48:18 -07:00
Code Issues Projects Releases Wiki Activity

fcaps.eclass: Remove sys-libs/libcap-ng support

Browse Source 
libcap-ng-0.7.10 changed the output format slightly (in upstream commit
bc1a9c07ebf5 "- Add capng_have_permitted_capabilities function and use
it in filecap"), breaking our usage of it. It's obvious that it's not
supposed to be used programmatically given the awful sed'ing we were
already doing. It doesn't seem like there was a compelling reason why it
was added either (bug #454908), so let's just get rid of it.

At the same time, fix the dependency on sys-libs/libcap by  moving it to
RDEPEND, as dependencies in DEPEND/BDEPEND are not guaranteed to exist
during pkg_postinst() when this eclass is intended to run.

Signed-off-by: Matt Turner <mattst88@gentoo.org>
This commit is contained in:
Matt Turner
2020-04-14 12:26:50 -07:00
parent f6959ff2b7
commit 7228b9cce3
1 changed files with 32 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
eclass/fcaps.eclass
View File

@@ -33,10 +33,15 @@ _FCAPS_ECLASS=1
IUSE="+filecaps"
# We can't use libcap-ng atm due to #471414.
# Since it is needed in pkg_postinst() it must be in RDEPEND
case "${EAPI:-0}" in
[0-6]) DEPEND="filecaps? ( sys-libs/libcap )" ;;
*) BDEPEND="filecaps? ( sys-libs/libcap )" ;;
[0-6])
RDEPEND="filecaps? ( sys-libs/libcap )"
;;
*)
BDEPEND="filecaps? ( sys-libs/libcap )"
RDEPEND="${BDEPEND}"
;;
esac
# @ECLASS-VARIABLE: FILECAPS
@@ -134,69 +139,31 @@ fcaps() {
# by people.
chmod ${caps_mode} "${file}" || die
# Set/verify funcs for sys-libs/libcap.
_libcap() { setcap "${caps}" "${file}" ; }
_libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }
if ! out=$(LC_ALL=C setcap "${caps}" "${file}" 2>&1) ; then
case ${out} in
# ENOTSUP and EOPNOTSUPP might be the same value which means
# strerror() on them is unstable -- we can get both. #559608
*"Not supported"*|\
*"Operation not supported"*)
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support:"
ewarn "* enable XATTR support for '${fstype}' in your kernel (if configurable)"
ewarn "* mount the fs with the user_xattr option (if not the default)"
ewarn "* enable the relevant FS_SECURITY option (if configurable)"
;;
*)
eerror "Setting caps '${caps}' on file '${file}' failed:"
eerror "${out}"
die "could not set caps"
;;
esac
else
# Sanity check that everything took.
setcap -v "${caps}" "${file}" >/dev/null \
|| die "Checking caps '${caps}' on '${file}' failed"
# Set/verify funcs for sys-libs/libcap-ng.
# Note: filecap only supports =ep mode.
# It also expects a different form:
# setcap cap_foo,cap_bar
# filecap foo bar
_libcap_ng() {
local caps=",${caps%=ep}"
filecap "${file}" "${caps//,cap_}"
}
_libcap_ng_verify() {
# libcap-ng has a crappy interface
local rcaps icaps caps=",${caps%=ep}"
rcaps=$(filecap "${file}" | \
sed -nr \
-e "s:^.{${#file}} +::" \
-e 's:, +:\n:g' \
-e 2p | \
LC_ALL=C sort)
[[ ${PIPESTATUS[0]} -eq 0 ]] || return 1
icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
[[ ${rcaps} == ${icaps} ]]
}
local out cmd notfound=0
for cmd in _libcap _libcap_ng ; do
if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
case ${out} in
*"command not found"*)
: $(( ++notfound ))
continue
;;
# ENOTSUP and EOPNOTSUPP might be the same value which means
# strerror() on them is unstable -- we can get both. #559608
*"Not supported"*|\
*"Operation not supported"*)
local fstype=$(stat -f -c %T "${file}")
ewarn "Could not set caps on '${file}' due to missing filesystem support:"
ewarn "* enable XATTR support for '${fstype}' in your kernel (if configurable)"
ewarn "* mount the fs with the user_xattr option (if not the default)"
ewarn "* enable the relevant FS_SECURITY option (if configurable)"
break
;;
*)
eerror "Setting caps '${caps}' on file '${file}' failed:"
eerror "${out}"
die "could not set caps"
;;
esac
else
# Sanity check that everything took.
${cmd}_verify || die "Checking caps '${caps}' on '${file}' failed"
# Everything worked. Move on to the next file.
continue 2
fi
done
if [[ ${notfound} -eq 2 ]] && [[ -z ${_FCAPS_WARNED} ]] ; then
_FCAPS_WARNED="true"
ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
# Everything worked. Move on to the next file.
continue
fi
fi