eclass/fcaps.eclass

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 # @ECLASS: fcaps.eclass
   5 # @MAINTAINER:
   6 # base-system@gentoo.org
   7 # @BLURB: function to set POSIX file-based capabilities
   8 # @DESCRIPTION:
   9 # This eclass provides a function to set file-based capabilities on binaries.
  10 # This is not the same as USE=caps which controls runtime capability changes,
  11 # often via packages like libcap.
  12 #
  13 # Due to probable capability-loss on moving or copying, this happens in
  14 # pkg_postinst phase (at least for now).
  15 #
  16 # @EXAMPLE:
  17 # You can manually set the caps on ping and ping6 by doing:
  18 # @CODE
  19 # pkg_postinst() {
  20 #       fcaps cap_net_raw bin/ping bin/ping6
  21 # }
  22 # @CODE
  23 #
  24 # Or set it via the global ebuild var FILECAPS:
  25 # @CODE
  26 # FILECAPS=(
  27 #       cap_net_raw bin/ping bin/ping6
  28 # )
  29 # @CODE
  30
  31 if [[ -z ${_FCAPS_ECLASS} ]]; then
  32 _FCAPS_ECLASS=1
  33
  34 IUSE="+filecaps"
  35
  36 # We can't use libcap-ng atm due to #471414.
  37 case "${EAPI:-0}" in
  38         [0-6]) DEPEND="filecaps? ( sys-libs/libcap )" ;;
  39         *) BDEPEND="filecaps? ( sys-libs/libcap )" ;;
  40 esac
  41
  42 # @ECLASS-VARIABLE: FILECAPS
  43 # @DEFAULT_UNSET
  44 # @DESCRIPTION:
  45 # An array of fcap arguments to use to automatically execute fcaps.  See that
  46 # function for more details.
  47 #
  48 # All args are consumed until the '--' marker is found.  So if you have:
  49 # @CODE
  50 #       FILECAPS=( moo cow -- fat cat -- chubby penguin )
  51 # @CODE
  52 #
  53 # This will end up executing:
  54 # @CODE
  55 #       fcaps moo cow
  56 #       fcaps fat cat
  57 #       fcaps chubby penguin
  58 # @CODE
  59 #
  60 # Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
  61
  62 # @FUNCTION: fcaps
  63 # @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
  64 # @DESCRIPTION:
  65 # Sets the specified capabilities on the specified files.
  66 #
  67 # The caps option takes the form as expected by the cap_from_text(3) man page.
  68 # If no action is specified, then "=ep" will be used as a default.
  69 #
  70 # If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
  71 # appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
  72 # ebuild phase.
  73 #
  74 # The caps mode (default 711) is used to set the permission on the file if
  75 # capabilities were properly set on the file.
  76 #
  77 # If the system is unable to set capabilities, it will use the specified user,
  78 # group, and mode (presumably to make the binary set*id).  The defaults there
  79 # are root:0 and 4711.  Otherwise, the ownership and permissions will be
  80 # unchanged.
  81 fcaps() {
  82         debug-print-function ${FUNCNAME} "$@"
  83
  84         if [[ ${EUID} != 0 ]] ; then
  85                 einfo "Insufficient privileges to execute ${FUNCNAME}, skipping."
  86                 return 0
  87         fi
  88
  89         # Process the user options first.
  90         local owner='root'
  91         local group='0'
  92         local mode='4711'
  93         local caps_mode='711'
  94
  95         while [[ $# -gt 0 ]] ; do
  96                 case $1 in
  97                 -o) owner=$2; shift;;
  98                 -g) group=$2; shift;;
  99                 -m) mode=$2; shift;;
 100                 -M) caps_mode=$2; shift;;
 101                 *) break;;
 102                 esac
 103                 shift
 104         done
 105
 106         [[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"
 107
 108         local caps=$1
 109         [[ ${caps} == *[-=+]* ]] || caps+="=ep"
 110         shift
 111
 112         local root
 113         case ${EBUILD_PHASE} in
 114         compile|install|preinst)
 115                 root=${ED:-${D}}
 116                 ;;
 117         postinst)
 118                 root=${EROOT:-${ROOT}}
 119                 ;;
 120         esac
 121         root=${root%/}
 122
 123         # Process every file!
 124         local file
 125         for file ; do
 126                 [[ ${file} != /* ]] && file="${root}/${file}"
 127
 128                 if use filecaps ; then
 129                         # Try to set capabilities.  Ignore errors when the
 130                         # fs doesn't support it, but abort on all others.
 131                         debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
 132
 133                         # If everything goes well, we don't want the file to be readable
 134                         # by people.
 135                         chmod ${caps_mode} "${file}" || die
 136
 137                         # Set/verify funcs for sys-libs/libcap.
 138                         _libcap()        { setcap "${caps}" "${file}" ; }
 139                         _libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }
 140
 141                         # Set/verify funcs for sys-libs/libcap-ng.
 142                         # Note: filecap only supports =ep mode.
 143                         # It also expects a different form:
 144                         #  setcap cap_foo,cap_bar
 145                         #  filecap foo bar
 146                         _libcap_ng() {
 147                                 local caps=",${caps%=ep}"
 148                                 filecap "${file}" "${caps//,cap_}"
 149                         }
 150                         _libcap_ng_verify() {
 151                                 # libcap-ng has a crappy interface
 152                                 local rcaps icaps caps=",${caps%=ep}"
 153                                 rcaps=$(filecap "${file}" | \
 154                                         sed -nr \
 155                                                 -e "s:^.{${#file}} +::" \
 156                                                 -e 's:, +:\n:g' \
 157                                                 -e 2p | \
 158                                         LC_ALL=C sort)
 159                                 [[ ${PIPESTATUS[0]} -eq 0 ]] || return 1
 160                                 icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
 161                                 [[ ${rcaps} == ${icaps} ]]
 162                         }
 163
 164                         local out cmd notfound=0
 165                         for cmd in _libcap _libcap_ng ; do
 166                                 if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
 167                                         case ${out} in
 168                                         *"command not found"*)
 169                                                 : $(( ++notfound ))
 170                                                 continue
 171                                                 ;;
 172                                         # ENOTSUP and EOPNOTSUPP might be the same value which means
 173                                         # strerror() on them is unstable -- we can get both. #559608
 174                                         *"Not supported"*|\
 175                                         *"Operation not supported"*)
 176                                                 local fstype=$(stat -f -c %T "${file}")
 177                                                 ewarn "Could not set caps on '${file}' due to missing filesystem support:"
 178                                                 ewarn "* enable XATTR support for '${fstype}' in your kernel (if configurable)"
 179                                                 ewarn "* mount the fs with the user_xattr option (if not the default)"
 180                                                 ewarn "* enable the relevant FS_SECURITY option (if configurable)"
 181                                                 break
 182                                                 ;;
 183                                         *)
 184                                                 eerror "Setting caps '${caps}' on file '${file}' failed:"
 185                                                 eerror "${out}"
 186                                                 die "could not set caps"
 187                                                 ;;
 188                                         esac
 189                                 else
 190                                         # Sanity check that everything took.
 191                                         ${cmd}_verify || die "Checking caps '${caps}' on '${file}' failed"
 192
 193                                         # Everything worked.  Move on to the next file.
 194                                         continue 2
 195                                 fi
 196                         done
 197                         if [[ ${notfound} -eq 2 ]] && [[ -z ${_FCAPS_WARNED} ]] ; then
 198                                 _FCAPS_WARNED="true"
 199                                 ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
 200                         fi
 201                 fi
 202
 203                 # If we're still here, setcaps failed.
 204                 debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
 205                 chown "${owner}:${group}" "${file}" || die
 206                 chmod ${mode} "${file}" || die
 207         done
 208 }
 209
 210 # @FUNCTION: fcaps_pkg_postinst
 211 # @DESCRIPTION:
 212 # Process the FILECAPS array.
 213 fcaps_pkg_postinst() {
 214         local arg args=()
 215         for arg in "${FILECAPS[@]}" "--" ; do
 216                 if [[ ${arg} == "--" ]] ; then
 217                         fcaps "${args[@]}"
 218                         args=()
 219                 else
 220                         args+=( "${arg}" )
 221                 fi
 222         done
 223 }
 224
 225 EXPORT_FUNCTIONS pkg_postinst
 226
 227 fi