Use Linux setcap command to set capabilities during Yocto build -


i'm using yocto 1.8 build linux system.

i need use command "setcap" set files capabilities during build, introduced via libcap package recipe: http://cgit.openembedded.org/openembedded-core/tree/meta/recipes-support/libcap/libcap_2.25.bb?h=master

the problem recipe provides libcap package, library, , subpackage called libcap-bin contains binaries need use. couldn't build or use libcap-bin-native package inside recipe dependancy (using depends variable). everytime call "setcap" binary, yocto uses host binaries (ubuntu 14.04 64-bit) not build system ones (as it's not there).

i need know how include native binaries built libcap-bin package in native sysroot buildsystem used during recipe execution.

example recipe use setcap command:

description = "apply  caps on files" section = "bin" license = "closed"  do_install() {     install -d ${d}${bindir}     touch ${d}${bindir}/testacl }  depends = "libcap libcap-native"  #new task added each recipe apply attributes inside ipks fakeroot do_setcaps() {     setcap 'cap_sys_admin,cap_sys_rawio+ep' ${workdir}/packages-split/${pn}${bindir}/testacl }  #adding new task  before do_package_write_ipk task addtask setcaps before do_package_write_ipk after do_packagedata 

this recipe working fine, except uses setcap command host system (ubuntu 14.04 64-bit) located "/sbin/setcap"

the dependency package libcap-native includes library files inside native sysroot, not binaries.

if used inside recipe:

depends = "libcap-bin" 

i got error:

error: nothing provides 'libcap-bin' 

i saw thread talking same topic: linux capabilities yocto

but uses yocto > 2.3 , i'm using yocto 1.8 , , can't update right now.

any help?

ps: updated yocto build system preserve acls , extended attributes during ipk creation, , it's working , being preserved inside ipk, inside rootfs, , on target after flashing.

i found solution. had add libcap recipe

packageconfig_class-native = "attr" 

as generated binaries (setcap & getcap) depending on libattr, , has configured manually.

i found it's configured target package

packageconfig ??= "attr ${@bb.utils.contains('distro_features', 'pam', 'pam', '', d)}" 

sorry disturbing.


Comments

  1. hi, i add to use depends = "libcap-native"

    be aware that after the yocto build you don't get any capabilites with getcap from the files.

    yocto uses pseudo lib to intercept chown, chmod calls, track them in a sqlite db [1] (uses LD_PRELOAD for interception)

    so this attributes are not set for the files in the "rootfs" folder, however added at image/rootfs creation.

    [1] https://superuser.com/questions/914334/changing-ownership-not-permitted

    ReplyDelete

Post a Comment

Popular posts from this blog

cookies - Yii2 Advanced - Share session between frontend and mainsite (duplicate of frontend for www) -

angular - password and confirm password field validation angular2 reactive forms -

javascript - Angular2 intelliJ config error.. Cannot find module '@angular/core' -