Date: Sunday, July 12, 2020 @ 14:10:45 Author: dreisner Revision: 391755
upgpkg: shadow 4.8.1-2 - use libcap-ng to set filecaps rather than libcap (FS#63920) Modified: shadow/trunk/PKGBUILD shadow/trunk/shadow.install ----------------+ PKGBUILD | 5 +++-- shadow.install | 11 +++++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) Modified: PKGBUILD =================================================================== --- PKGBUILD 2020-07-12 13:02:37 UTC (rev 391754) +++ PKGBUILD 2020-07-12 14:10:45 UTC (rev 391755) @@ -3,12 +3,13 @@ pkgname=shadow pkgver=4.8.1 -pkgrel=1 +pkgrel=2 pkgdesc="Password and account management tool suite with support for shadow files and PAM" arch=('x86_64') url='https://github.com/shadow-maint/shadow' license=('BSD') -depends=('pam' 'acl' 'audit' 'libaudit.so') +# libcap-ng needed by install scriptlet for 'filecap' +depends=('pam' 'acl' 'audit' 'libaudit.so' 'libcap-ng') makedepends=('git' 'itstool' 'libxslt' 'docbook-xsl') backup=(etc/login.defs etc/pam.d/{chage,passwd,shadow,useradd,usermod,userdel} Modified: shadow.install =================================================================== --- shadow.install 2020-07-12 13:02:37 UTC (rev 391754) +++ shadow.install 2020-07-12 14:10:45 UTC (rev 391755) @@ -1,7 +1,14 @@ setcaps() { + _setcap() { + if filecap "$1" "$2"; then + chmod -s "$1" + fi + } + # shadow ships these as setuid, but if we can apply file caps, use those instead. - setcap cap_setuid+ep usr/bin/newuidmap 2>/dev/null && chmod -s usr/bin/newuidmap - setcap cap_setgid+ep usr/bin/newgidmap 2>/dev/null && chmod -s usr/bin/newgidmap + # 'filecap' insists on absolute paths + _setcap /usr/bin/newuidmap setuid + _setcap /usr/bin/newgidmap setgid } post_install() {