Bug 9859

Summary:	setcap doesn't work
Product:	[Yocto Project Subprojects] Pseudo	Reporter:	Ross Burton <ross.burton>
Component:	pseudo	Assignee:	Seebs <seebs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium	CC:	joshuagloe, mark.hatle, seebs, sgw, yp.pseudo.watcher, yp.watcher
Version:	unspecified
Target Milestone:	2.3 M3
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)
Bug Depends on:
Bug Blocks:	9858

Description Ross Burton 2016-06-30 15:13:31 UTC

If setcap is called inside pseudo context then it errors out.

"
The setcap utility supplied by libcap is used to set capabilities on a
file. Before setting a file's capabilities with cap_set_file() (which uses
setxattr()) it calls cap_set_flag(mycaps, CAP_EFFECTIVE, 1, &capflag,
CAP_SET). cap_set_flag() uses the capset syscall to raise the process'
effective capability. In most cases if the process isn't running as root
this will fail and setcap will exit with an error. Because setxattr is
intercepted by pseudo it's unnecessary for setcap to call capset().
"

https://lists.yoctoproject.org/pipermail/yocto/2016-May/029903.html has a patch.

Comment 1 Seebs 2016-12-12 20:29:30 UTC

The proposed patch appears to be logically correct; we have no real reason to support capset, but it needs to pretend to work. Merged in master.

Comment 2 Seebs 2017-03-20 19:22:26 UTC

I believe this is in pseudo 1.8.2, which has been merged for a bit. I forgot about the open bug. Sorry!