Use Linux setcap command to set capabilities during Yocto build -
i'm using yocto 1.8 build linux system.
i need use command "setcap" set files capabilities during build, introduced via libcap package recipe: http://cgit.openembedded.org/openembedded-core/tree/meta/recipes-support/libcap/libcap_2.25.bb?h=master
the problem recipe provides libcap package, library, , subpackage called libcap-bin contains binaries need use. couldn't build or use libcap-bin-native package inside recipe dependancy (using depends variable). everytime call "setcap" binary, yocto uses host binaries (ubuntu 14.04 64-bit) not build system ones (as it's not there).
i need know how include native binaries built libcap-bin package in native sysroot buildsystem used during recipe execution.
example recipe use setcap command:
description = "apply caps on files" section = "bin" license = "closed" do_install() { install -d ${d}${bindir} touch ${d}${bindir}/testacl } depends = "libcap libcap-native" #new task added each recipe apply attributes inside ipks fakeroot do_setcaps() { setcap 'cap_sys_admin,cap_sys_rawio+ep' ${workdir}/packages-split/${pn}${bindir}/testacl } #adding new task before do_package_write_ipk task addtask setcaps before do_package_write_ipk after do_packagedata
this recipe working fine, except uses setcap command host system (ubuntu 14.04 64-bit) located "/sbin/setcap"
the dependency package libcap-native includes library files inside native sysroot, not binaries.
if used inside recipe:
depends = "libcap-bin"
i got error:
error: nothing provides 'libcap-bin'
i saw thread talking same topic: linux capabilities yocto
but uses yocto > 2.3 , i'm using yocto 1.8 , , can't update right now.
any help?
ps: updated yocto build system preserve acls , extended attributes during ipk creation, , it's working , being preserved inside ipk, inside rootfs, , on target after flashing.
i found solution. had add libcap recipe
packageconfig_class-native = "attr"
as generated binaries (setcap & getcap) depending on libattr, , has configured manually.
i found it's configured target package
packageconfig ??= "attr ${@bb.utils.contains('distro_features', 'pam', 'pam', '', d)}"
sorry disturbing.
hi, i add to use depends = "libcap-native"
ReplyDeletebe aware that after the yocto build you don't get any capabilites with getcap from the files.
yocto uses pseudo lib to intercept chown, chmod calls, track them in a sqlite db [1] (uses LD_PRELOAD for interception)
so this attributes are not set for the files in the "rootfs" folder, however added at image/rootfs creation.
[1] https://superuser.com/questions/914334/changing-ownership-not-permitted