gentoo-x86/eclass/fcaps.eclass

# Copyright 1999-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.4 2013/04/28 03:11:47 vapier Exp $

# @ECLASS: fcaps.eclass
# @MAINTAINER:
# Constanze Hausner <constanze@gentoo.org>
# base-system@gentoo.org
# @BLURB: function to set POSIX file-based capabilities
# @DESCRIPTION:
# This eclass provides a function to set file-based capabilities on binaries.
#
# Due to probable capability-loss on moving or copying, this happens in
# pkg_postinst-phase (at least for now).
#
# @EXAMPLE:
# You can manually set the caps on ping and ping6 by doing:
# @CODE
# pkg_postinst() {
#       fcaps cap_net_raw bin/ping bin/ping6
# }
# @CODE
#
# Or set it via the global ebuild var FILECAPS:
# @CODE
# FILECAPS=(
#       cap_net_raw bin/ping bin/ping6
# )
# @CODE

if [[ ${___ECLASS_ONCE_FCAPS} != "recur -_+^+_- spank" ]] ; then
___ECLASS_ONCE_FCAPS="recur -_+^+_- spank"

IUSE="+filecaps"

DEPEND="filecaps? ( || ( sys-libs/libcap sys-libs/libcap-ng ) )"

# @ECLASS-VARIABLE: FILECAPS
# @DEFAULT_UNSET
# @DESCRIPTION:
# An array of fcap arguments to use to automatically execute fcaps.  See that
# function for more details.
#
# All args are consumed until the '--' marker is found.  So if you have:
# @CODE
#       FILECAPS=( moo cow -- fat cat -- chubby penguin )
# @CODE
#
# This will end up executing:
# @CODE
#       fcaps moo cow
#       fcaps fat cat
#       fcaps chubby penguin
# @CODE
#
# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.

# @FUNCTION: fcaps
# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
# @DESCRIPTION:
# Sets the specified capabilities on the specified files.
#
# The caps option takes the form as expected by the cap_from_text(3) man page.
# If no action is specified, then "=ep" will be used as a default.
#
# If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
# ebuild phase.
#
# The caps mode (default 711) is used to set the permission on the file if
# capabilities were properly set on the file.
#
# If the system is unable to set capabilities, it will use the specified user,
# group, and mode (presumably to make the binary set*id).  The defaults there
# are root:root and 4711.  Otherwise, the ownership and permissions will be
# unchanged.
fcaps() {
        debug-print-function ${FUNCNAME} "$@"

        # Process the user options first.
        local owner='root'
        local group='root'
        local mode='4711'
        local caps_mode='711'

        while [[ $# -gt 0 ]] ; do
                case $1 in
                -o) owner=$2; shift;;
                -g) group=$2; shift;;
                -m) mode=$2; shift;;
                -M) caps_mode=$2; shift;;
                *) break;;
                esac
                shift
        done

        [[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"

        local caps=$1
        [[ ${caps} == *[-=+]* ]] || caps+="=ep"
        shift

        local root
        case ${EBUILD_PHASE} in
        compile|install|preinst)
                root=${ED:-${D}}
                ;;
        postinst)
                root=${EROOT:-${ROOT}}
                ;;
        esac

        # Process every file!
        local file
        for file ; do
                [[ ${file} != /* ]] && file="${root}${file}"

                if use filecaps ; then
                        # Try to set capabilities.  Ignore errors when the
                        # fs doesn't support it, but abort on all others.
                        debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"

                        # If everything goes well, we don't want the file to be readable
                        # by people.
                        chmod ${caps_mode} "${file}" || die

                        # Set/verify funcs for sys-libs/libcap.
                        _libcap()        { setcap "${caps}" "${file}" ; }
                        _libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }

                        # Set/verify funcs for sys-libs/libcap-ng.
                        # Note: filecap only supports =ep mode.
                        # It also expects a different form:
                        #  setcap cap_foo,cap_bar
                        #  filecap foo bar
                        _libcap_ng() {
                                local caps=",${caps%=ep}"
                                filecap "${file}" "${caps//,cap_}"
                        }
                        _libcap_ng_verify() {
                                # libcap-ng has a crappy interface
                                local rcaps icaps caps=",${caps%=ep}"
                                rcaps=$(filecap "${file}" | \
                                        sed -nr \
                                                -e "s:^.{${#file}} +::" \
                                                -e 's:, +:\n:g' \
                                                -e 2p | \
                                        LC_ALL=C sort) || return 1
                                icaps=$(echo "${caps//,cap_}" | LC_ALL=C sort)
                                [[ ${rcaps} == ${icaps} ]]
                        }

                        local out cmd notfound=0
                        for cmd in _libcap _libcap_ng ; do
                                if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
                                        case ${out} in
                                        *"command not found"*)
                                                : $(( ++notfound ))
                                                continue
                                                ;;
                                        *"Operation not supported"*)
                                                local fstype=$(stat -f -c %T "${file}")
                                                ewarn "Could not set caps on '${file}' due to missing filesystem support."
                                                ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
                                                ewarn "You might also have to enable the relevant FS_SECURITY option."
                                                break
                                                ;;
                                        *)
                                                eerror "Setting caps '${caps}' on file '${file}' failed:"
                                                eerror "${out}"
                                                die "could not set caps"
                                                ;;
                                        esac
                                else
                                        # Sanity check that everything took.
                                        ${cmd}_verify || die "Checking caps '${caps}' on '${file}' failed"

                                        # Everything worked.  Move on to the next file.
                                        continue 2
                                fi
                        done
                        if [[ ${notfound} -eq 2 ]] && [[ -z ${__FCAPS_WARNED} ]] ; then
                                __FCAPS_WARNED="true"
                                ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
                        fi
                fi

                # If we're still here, setcaps failed.
                debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
                chown "${owner}:${group}" "${file}" || die
                chmod ${mode} "${file}" || die
        done
}

# @FUNCTION: fcaps_pkg_postinst
# @DESCRIPTION:
# Process the FILECAPS array.
fcaps_pkg_postinst() {
        local arg args=()
        for arg in "${FILECAPS[@]}" "--" ; do
                if [[ ${arg} == "--" ]] ; then
                        fcaps "${args[@]}"
                        args=()
                else
                        args+=( "${arg}" )
                fi
        done
}

EXPORT_FUNCTIONS pkg_postinst

fi
1	vapier	1.1	# Copyright 1999-2013 Gentoo Foundation
2			# Distributed under the terms of the GNU General Public License v2
3	vapier	1.5	# $Header: /var/cvsroot/gentoo-x86/eclass/fcaps.eclass,v 1.4 2013/04/28 03:11:47 vapier Exp $
4	vapier	1.1
5			# @ECLASS: fcaps.eclass
6			# @MAINTAINER:
7			# Constanze Hausner <constanze@gentoo.org>
8			# base-system@gentoo.org
9			# @BLURB: function to set POSIX file-based capabilities
10			# @DESCRIPTION:
11			# This eclass provides a function to set file-based capabilities on binaries.
12			#
13			# Due to probable capability-loss on moving or copying, this happens in
14			# pkg_postinst-phase (at least for now).
15			#
16			# @EXAMPLE:
17			# You can manually set the caps on ping and ping6 by doing:
18			# @CODE
19			# pkg_postinst() {
20			# fcaps cap_net_raw bin/ping bin/ping6
21			# }
22			# @CODE
23			#
24			# Or set it via the global ebuild var FILECAPS:
25			# @CODE
26			# FILECAPS=(
27			# cap_net_raw bin/ping bin/ping6
28			# )
29			# @CODE
30
31			if [[ ${___ECLASS_ONCE_FCAPS} != "recur -_+^+_- spank" ]] ; then
32			___ECLASS_ONCE_FCAPS="recur -_+^+_- spank"
33
34			IUSE="+filecaps"
35
36	vapier	1.5	DEPEND="filecaps? ( \|\| ( sys-libs/libcap sys-libs/libcap-ng ) )"
37	vapier	1.1
38			# @ECLASS-VARIABLE: FILECAPS
39			# @DEFAULT_UNSET
40			# @DESCRIPTION:
41			# An array of fcap arguments to use to automatically execute fcaps. See that
42			# function for more details.
43			#
44			# All args are consumed until the '--' marker is found. So if you have:
45			# @CODE
46			# FILECAPS=( moo cow -- fat cat -- chubby penguin )
47			# @CODE
48			#
49			# This will end up executing:
50			# @CODE
51			# fcaps moo cow
52			# fcaps fat cat
53			# fcaps chubby penguin
54			# @CODE
55			#
56			# Note: If you override pkg_postinst, you must call fcaps_pkg_postinst yourself.
57
58			# @FUNCTION: fcaps
59	vapier	1.2	# @USAGE: [-o <owner>] [-g <group>] [-m <mode>] [-M <caps mode>] <capabilities> <file[s]>
60	vapier	1.1	# @DESCRIPTION:
61			# Sets the specified capabilities on the specified files.
62			#
63			# The caps option takes the form as expected by the cap_from_text(3) man page.
64			# If no action is specified, then "=ep" will be used as a default.
65			#
66			# If the file is a relative path (e.g. bin/foo rather than /bin/foo), then the
67			# appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
68			# ebuild phase.
69			#
70	vapier	1.2	# The caps mode (default 711) is used to set the permission on the file if
71			# capabilities were properly set on the file.
72			#
73	vapier	1.1	# If the system is unable to set capabilities, it will use the specified user,
74			# group, and mode (presumably to make the binary set*id). The defaults there
75			# are root:root and 4711. Otherwise, the ownership and permissions will be
76			# unchanged.
77			fcaps() {
78			debug-print-function ${FUNCNAME} "$@"
79
80			# Process the user options first.
81			local owner='root'
82			local group='root'
83			local mode='4711'
84	vapier	1.2	local caps_mode='711'
85	vapier	1.1
86			while [[ $# -gt 0 ]] ; do
87			case $1 in
88			-o) owner=$2; shift;;
89			-g) group=$2; shift;;
90			-m) mode=$2; shift;;
91	vapier	1.2	-M) caps_mode=$2; shift;;
92	vapier	1.1	*) break;;
93			esac
94			shift
95			done
96
97			[[ $# -lt 2 ]] && die "${FUNCNAME}: wrong arg count"
98
99			local caps=$1
100			[[ ${caps} == [-=+] ]] \|\| caps+="=ep"
101			shift
102
103			local root
104			case ${EBUILD_PHASE} in
105			compile\|install\|preinst)
106			root=${ED:-${D}}
107			;;
108			postinst)
109			root=${EROOT:-${ROOT}}
110			;;
111			esac
112
113			# Process every file!
114	vapier	1.5	local file
115	vapier	1.1	for file ; do
116			[[ ${file} != /* ]] && file="${root}${file}"
117
118			if use filecaps ; then
119			# Try to set capabilities. Ignore errors when the
120			# fs doesn't support it, but abort on all others.
121			debug-print "${FUNCNAME}: setting caps '${caps}' on '${file}'"
122
123	vapier	1.2	# If everything goes well, we don't want the file to be readable
124			# by people.
125			chmod ${caps_mode} "${file}" \|\| die
126
127	vapier	1.5	# Set/verify funcs for sys-libs/libcap.
128			_libcap() { setcap "${caps}" "${file}" ; }
129			_libcap_verify() { setcap -v "${caps}" "${file}" >/dev/null ; }
130
131			# Set/verify funcs for sys-libs/libcap-ng.
132			# Note: filecap only supports =ep mode.
133			# It also expects a different form:
134			# setcap cap_foo,cap_bar
135			# filecap foo bar
136			_libcap_ng() {
137			local caps=",${caps%=ep}"
138			filecap "${file}" "${caps//,cap_}"
139			}
140			_libcap_ng_verify() {
141			# libcap-ng has a crappy interface
142			local rcaps icaps caps=",${caps%=ep}"
143			rcaps=$(filecap "${file}" \| \
144			sed -nr \
145			-e "s:^.{${#file}} +::" \
146			-e 's:, +:\n:g' \
147			-e 2p \| \
148			LC_ALL=C sort) \|\| return 1
149			icaps=$(echo "${caps//,cap_}" \| LC_ALL=C sort)
150			[[ ${rcaps} == ${icaps} ]]
151			}
152
153			local out cmd notfound=0
154			for cmd in _libcap _libcap_ng ; do
155			if ! out=$(LC_ALL=C ${cmd} 2>&1) ; then
156			case ${out} in
157			"command not found")
158			: $(( ++notfound ))
159			continue
160			;;
161			"Operation not supported")
162			local fstype=$(stat -f -c %T "${file}")
163			ewarn "Could not set caps on '${file}' due to missing filesystem support."
164			ewarn "Make sure you enable XATTR support for '${fstype}' in your kernel."
165			ewarn "You might also have to enable the relevant FS_SECURITY option."
166			break
167			;;
168			*)
169			eerror "Setting caps '${caps}' on file '${file}' failed:"
170			eerror "${out}"
171			die "could not set caps"
172			;;
173			esac
174			else
175			# Sanity check that everything took.
176			${cmd}_verify \|\| die "Checking caps '${caps}' on '${file}' failed"
177
178			# Everything worked. Move on to the next file.
179			continue 2
180			fi
181			done
182			if [[ ${notfound} -eq 2 ]] && [[ -z ${__FCAPS_WARNED} ]] ; then
183			__FCAPS_WARNED="true"
184			ewarn "Could not find cap utils; make sure libcap or libcap-ng is available."
185	vapier	1.1	fi
186			fi
187
188			# If we're still here, setcaps failed.
189			debug-print "${FUNCNAME}: setting owner/mode on '${file}'"
190			chown "${owner}:${group}" "${file}" \|\| die
191			chmod ${mode} "${file}" \|\| die
192			done
193			}
194
195			# @FUNCTION: fcaps_pkg_postinst
196			# @DESCRIPTION:
197			# Process the FILECAPS array.
198			fcaps_pkg_postinst() {
199			local arg args=()
200			for arg in "${FILECAPS[@]}" "--" ; do
201			if [[ ${arg} == "--" ]] ; then
202			fcaps "${args[@]}"
203			args=()
204			else
205			args+=( "${arg}" )
206			fi
207			done
208			}
209
210			EXPORT_FUNCTIONS pkg_postinst
211
212			fi