Question regarding file capabilities being shipped in Core Updates

Question regarding file capabilities being shipped in Core Updates

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 306 bytes --]

Hello *,

while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However,
it seems as the capabilities set to /usr/bin/ping are not preserved that way.

Am I mistaken? Can we even use file capabilities in this environment?

Thanks, and best regards,
Peter Müller

Re: Question regarding file capabilities being shipped in Core Updates

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 861 bytes --]

Hi Peter,

In the CHANGES file in the source tarball setcap is mentioned twice:-

===== s20200821 =====
released August 21, 2020

* arping
- [security] disable setcap and setuid (prevent ARP Poisoning, issue: #203)

* Meson build system
- Allow to set using setcap-setuid.sh per application (commit: 054670a)

The setcap-setuid.sh script is in the build-aux directory in the source tarball. Maybe this script is what needs to be used now.

Hope this helps.

Regards,

Adolf.

On 07/07/2021 20:26, Peter Müller wrote:
> Hello *,
>
> while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However,
> it seems as the capabilities set to /usr/bin/ping are not preserved that way.
>
> Am I mistaken? Can we even use file capabilities in this environment?
>
> Thanks, and best regards,
> Peter Müller

Re: Question regarding file capabilities being shipped in Core Updates

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 687 bytes --]

For completeness. This has been fixed in:

https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=37ef9fe4e07a97d3597b9d9e7895652fcfe79150

The capabilities where set correctly, but strip removed them later and so nothing landed in the ISO or updater.

Best,
-Michael

> On 7 Jul 2021, at 19:26, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> Hello *,
> 
> while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However,
> it seems as the capabilities set to /usr/bin/ping are not preserved that way.
> 
> Am I mistaken? Can we even use file capabilities in this environment?
> 
> Thanks, and best regards,
> Peter Müller