Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libcap for openSUSE:Factory checked
in at 2022-01-02 16:06:24
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libcap (Old)
and /work/SRC/openSUSE:Factory/.libcap.new.1896 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcap"
Sun Jan 2 16:06:24 2022 rev:50 rq:943181 version:2.62
Changes:
--------
--- /work/SRC/openSUSE:Factory/libcap/libcap.changes 2021-12-02
22:30:40.450570999 +0100
+++ /work/SRC/openSUSE:Factory/.libcap.new.1896/libcap.changes 2022-01-02
16:06:25.195882870 +0100
@@ -1,0 +2,9 @@
+Thu Dec 30 09:52:10 UTC 2021 - Dirk M??ller <dmuel...@suse.com>
+
+- update to 2.62:
+ * Bug fix for Go package "cap" and launching
+ * Build cleanups
+ * Documentation updates: cap_max_bits has a man page entry
+ * Recognize default securebits as a libcap mode: HYBRID
+
+-------------------------------------------------------------------
Old:
----
libcap-2.61.tar.sign
libcap-2.61.tar.xz
New:
----
libcap-2.62.tar.sign
libcap-2.62.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libcap.spec ++++++
--- /var/tmp/diff_new_pack.V9CkcW/_old 2022-01-02 16:06:25.895883310 +0100
+++ /var/tmp/diff_new_pack.V9CkcW/_new 2022-01-02 16:06:25.903883316 +0100
@@ -17,7 +17,7 @@
Name: libcap
-Version: 2.61
+Version: 2.62
Release: 0
Summary: Library for Capabilities (linux-privs) Support
License: BSD-3-Clause AND GPL-2.0-only
++++++ libcap-2.61.tar.xz -> libcap-2.62.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/Make.Rules new/libcap-2.62/Make.Rules
--- old/libcap-2.61/Make.Rules 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/Make.Rules 2021-12-12 03:05:17.000000000 +0100
@@ -1,7 +1,7 @@
# Common version number defines for libcap
LIBTITLE=libcap
VERSION=2
-MINOR=61
+MINOR=62
#
## Optional prefixes:
@@ -92,7 +92,19 @@
BUILD_CFLAGS ?= $(BUILD_COPTS)
BUILD_CPPFLAGS += -Dlinux $(WARNINGS) $(DEBUG) $(DEFINES) $(LIBCAP_INCLUDES)
BUILD_LDFLAGS ?= $(LDFLAGS)
-BUILD_GPERF := $(shell which gperf >/dev/null 2>/dev/null && echo yes)
+BUILD_SED ?= sed
+BUILD_GREP ?= grep
+BUILD_EGREP ?= $(BUILD_GREP) -E
+BUILD_FGREP ?= $(BUILD_GREP) -F
+
+# Plan to eventually redefine BUILD_GPERF to be the actual gperf tool
+# alias as per above. Typical distributions are upto a year behind
+# HEAD so we'll not do that before 2023-01-01.
+ifdef BUILD_GPERF
+$(error BUILD_GPERF is now reserved, please use USE_GPERF=yes or no instead)
+endif
+
+USE_GPERF ?= $(shell which gperf >/dev/null 2>/dev/null && echo yes)
LIBCAPLIB := -L$(topdir)/libcap -lcap
PSXLINKFLAGS := -lpthread -Wl,-wrap,pthread_create
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/Makefile new/libcap-2.62/Makefile
--- old/libcap-2.61/Makefile 2021-09-18 05:56:21.000000000 +0200
+++ new/libcap-2.62/Makefile 2021-12-12 00:00:00.000000000 +0100
@@ -35,7 +35,7 @@
distclean: clean
$(DISTCLEAN)
@echo "CONFIRM Go package cap has right version dependency on cap/psx:"
- for x in $$(find . -name go.mod); do grep -F -v "module" $$x | fgrep
"kernel.org/pub/linux/libs/security/libcap" > /dev/null || continue ; grep -F
"v$(GOMAJOR).$(VERSION).$(MINOR)" $$x > /dev/null && continue ; echo "$$x is
not updated. Try running: ./gomods.sh v$(GOMAJOR).$(VERSION).$(MINOR)" ; exit 1
; done
+ for x in $$(find . -name go.mod); do $(BUILD_FGREP) -v "module" $$x |
$(BUILD_FGREP) "kernel.org/pub/linux/libs/security/libcap" > /dev/null ||
continue ; $(BUILD_FGREP) "v$(GOMAJOR).$(VERSION).$(MINOR)" $$x > /dev/null &&
continue ; echo "$$x is not updated. Try running: ./gomods.sh
v$(GOMAJOR).$(VERSION).$(MINOR)" ; exit 1 ; done
@echo "ALL go.mod files updated"
@echo "Now validate that everything is checked in to a clean tree.."
test -z "$$(git status --ignored -s)"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/cap/convenience.go
new/libcap-2.62/cap/convenience.go
--- old/libcap-2.61/cap/convenience.go 2021-09-18 05:56:21.000000000 +0200
+++ new/libcap-2.62/cap/convenience.go 2021-11-22 02:20:50.000000000 +0100
@@ -75,6 +75,7 @@
ModeNoPriv
ModePure1EInit
ModePure1E
+ ModeHybrid
)
// GetMode assesses the current process state and summarizes it as
@@ -82,6 +83,9 @@
// declared ModeUncertain.
func GetMode() Mode {
b := GetSecbits()
+ if b == 0 {
+ return ModeHybrid
+ }
if b&securedBasicBits != securedBasicBits {
return ModeUncertain
}
@@ -141,6 +145,10 @@
return err
}
+ if m == ModeHybrid {
+ return sc.setSecbits(0)
+ }
+
if m == ModeNoPriv || m == ModePure1EInit {
w.ClearFlag(Inheritable)
} else if m != ModePure1E {
@@ -199,6 +207,8 @@
return "PURE1E_INIT"
case ModePure1E:
return "PURE1E"
+ case ModeHybrid:
+ return "HYBRID"
default:
return "UNKNOWN"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/cap/go.mod new/libcap-2.62/cap/go.mod
--- old/libcap-2.61/cap/go.mod 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/cap/go.mod 2021-12-12 03:05:53.000000000 +0100
@@ -2,4 +2,4 @@
go 1.11
-require kernel.org/pub/linux/libs/security/libcap/psx v1.2.61
+require kernel.org/pub/linux/libs/security/libcap/psx v1.2.62
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/cap/launch.go
new/libcap-2.62/cap/launch.go
--- old/libcap-2.61/cap/launch.go 2021-10-23 07:22:32.000000000 +0200
+++ new/libcap-2.62/cap/launch.go 2021-12-12 03:00:15.000000000 +0100
@@ -181,6 +181,10 @@
// lResult is used to get the result from the doomed launcher thread.
type lResult struct {
+ // tgid holds the thread group id, which is an alias for the
+ // shared process id of the parent program.
+ tgid int
+
// tid holds the tid of the locked launching thread which dies
// as the launch completes.
tid int
@@ -232,13 +236,15 @@
defer close(quit)
}
- pid := syscall.Getpid()
+ // Thread group ID is the process ID.
+ tgid := syscall.Getpid()
+
// This code waits until we are not scheduled on the parent
// thread. We will exit this thread once the child has
// launched.
runtime.LockOSThread()
tid := syscall.Gettid()
- if tid == pid {
+ if tid == tgid {
// Force the go runtime to find a new thread to run
// on. (It is really awkward to have a process'
// PID=TID thread in effectively a zombie state. The
@@ -257,6 +263,12 @@
return
}
+ // Provide a way to serialize the caller on the thread
+ // completing. This should be done by the one locked tid that
+ // does the ForkExec(). All the other threads have a different
+ // security context.
+ defer close(result)
+
// By never releasing the LockOSThread here, we guarantee that
// the runtime will terminate the current OS thread once this
// function returns.
@@ -266,10 +278,6 @@
// the callbackFn or something else hangs up.
singlesc.prctlrcall(prSetName, uintptr(unsafe.Pointer(&lName[0])), 0)
- // Provide a way to serialize the caller on the thread
- // completing.
- defer close(result)
-
var pa *syscall.ProcAttr
var err error
var needChroot bool
@@ -289,12 +297,12 @@
}
}
+ var pid int
if attr.callbackFn != nil {
if err = attr.callbackFn(pa, data); err != nil {
goto abort
}
if attr.path == "" {
- pid = 0
goto abort
}
}
@@ -341,16 +349,30 @@
pid = -1
}
result <- lResult{
- tid: tid,
- pid: pid,
- err: err,
+ tgid: tgid,
+ tid: tid,
+ pid: pid,
+ err: err,
}
}
+// pollForThreadExit waits for a thread to terminate. Only after the
+// thread has safely exited is it safe to resume POSIX semantics
+// security state mirroring for the rest of the process threads.
+func (v lResult) pollForThreadExit() {
+ if v.tid == -1 {
+ return
+ }
+ for syscall.Tgkill(v.tgid, v.tid, 0) == nil {
+ runtime.Gosched()
+ }
+ scwSetState(launchActive, launchIdle, v.tid)
+}
+
// Launch performs a callback function and/or new program launch with
// a disposable security state. The data object, when not nil, can be
// used to communicate with the callback. It can also be used to
-// return details from the callback functions execution.
+// return details from the callback function's execution.
//
// If the attr was created with NewLauncher(), this present function
// will return the pid of the launched process, or -1 and a non-nil
@@ -362,15 +384,15 @@
// callback return value.
//
// Note, while the disposable security state thread makes some
-// oprerations seem more isolated - they are *not securely
+// operations seem more isolated - they are *not securely
// isolated*. Launching is inherently violating the POSIX semantics
// maintained by the rest of the "libcap/cap" package, so think of
// launching as a convenience wrapper around fork()ing.
//
// Advanced user note: if the caller of this function thinks they know
// what they are doing by using runtime.LockOSThread() before invoking
-// this function, they should understand that the OS Thread invoking
-// (*Launcher).Launch() is *not guaranteed* to be the one used for the
+// this function, they should understand that the OS thread invoking
+// (*Launcher).Launch() is *not* guaranteed to be the one used for the
// disposable security state to perform the launch. If said caller
// needs to run something on the disposable security state thread,
// they should do it via the launch callback function mechanism. (The
@@ -391,18 +413,11 @@
result := make(chan lResult)
go launch(result, attr, data, nil)
- for {
- select {
- case v, ok := <-result:
- if !ok {
- return -1, ErrLaunchFailed
- }
- if v.tid != -1 {
- defer scwSetState(launchActive, launchIdle,
v.tid)
- }
- return v.pid, v.err
- default:
- runtime.Gosched()
- }
+ v, ok := <-result
+ if !ok {
+ return -1, ErrLaunchFailed
}
+ <-result // blocks until the launch() goroutine exits
+ v.pollForThreadExit()
+ return v.pid, v.err
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/contrib/seccomp/go.mod
new/libcap-2.62/contrib/seccomp/go.mod
--- old/libcap-2.61/contrib/seccomp/go.mod 2021-11-21 07:19:17.000000000
+0100
+++ new/libcap-2.62/contrib/seccomp/go.mod 2021-12-12 03:05:53.000000000
+0100
@@ -2,4 +2,4 @@
go 1.14
-require kernel.org/pub/linux/libs/security/libcap/psx v1.2.61
+require kernel.org/pub/linux/libs/security/libcap/psx v1.2.62
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/doc/Makefile new/libcap-2.62/doc/Makefile
--- old/libcap-2.61/doc/Makefile 2021-10-23 07:22:32.000000000 +0200
+++ new/libcap-2.62/doc/Makefile 2021-12-12 00:00:00.000000000 +0100
@@ -8,7 +8,7 @@
MAN1S = capsh.1
MAN3S = cap_init.3 cap_free.3 cap_dup.3 \
cap_clear.3 cap_clear_flag.3 cap_get_flag.3 cap_set_flag.3 \
- cap_fill.3 cap_fill_flag.3 \
+ cap_fill.3 cap_fill_flag.3 cap_max_bits.3 \
cap_compare.3 cap_get_proc.3 cap_get_pid.3 cap_set_proc.3 \
cap_get_file.3 cap_get_fd.3 cap_set_file.3 cap_set_fd.3 \
cap_copy_ext.3 cap_size.3 cap_copy_int.3 cap_mode.3 \
@@ -44,7 +44,7 @@
mkdir -p html
for man in $(MANS) ; \
do \
- egrep '^\.so man' $$man > /dev/null || \
+ $(BUILD_EGREP) '^\.so man' $$man > /dev/null || \
groff -man -Thtml $$man > html/$$man.html ; \
done
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/doc/cap_clear.3
new/libcap-2.62/doc/cap_clear.3
--- old/libcap-2.61/doc/cap_clear.3 2021-11-21 06:48:26.000000000 +0100
+++ new/libcap-2.62/doc/cap_clear.3 2021-11-22 02:20:50.000000000 +0100
@@ -139,11 +139,14 @@
.BR EINVAL ,
indicating that one of the arguments is invalid.
.SH "CONFORMING TO"
-These functions are as per the withdrawn POSIX.1e draft specification.
-.BR cap_clear_flag ()
-and
+These functions are mostly as per specified in the withdrawn POSIX.1e
+draft specification. The following are Linux extensions:
+.BR cap_fill (),
+.BR cap_fill_flag (),
+.BR cap_clear_flag (),
.BR cap_compare ()
-are Linux extensions.
+and
+.BR cap_max_bits ().
.SH "SEE ALSO"
.BR libcap (3),
.BR cap_copy_ext (3),
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/go/.gitignore
new/libcap-2.62/go/.gitignore
--- old/libcap-2.61/go/.gitignore 2021-09-18 05:56:21.000000000 +0200
+++ new/libcap-2.62/go/.gitignore 2021-12-12 00:00:00.000000000 +0100
@@ -5,6 +5,8 @@
psx-signals
psx-signals-cgo
b210613
+b215283
+b215283-cgo
mknames
web
setid
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/go/Makefile new/libcap-2.62/go/Makefile
--- old/libcap-2.61/go/Makefile 2021-09-18 05:56:21.000000000 +0200
+++ new/libcap-2.62/go/Makefile 2021-12-12 00:00:00.000000000 +0100
@@ -94,6 +94,14 @@
b210613: b210613.go CAPGOPACKAGE
CC="$(CC)" CGO_ENABLED="$(CGO_REQUIRED)" $(CGO_LDFLAGS_ALLOW)
CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" $(GO) build
$(GO_BUILD_FLAGS) -mod=vendor $<
+b215283: b215283.go CAPGOPACKAGE
+ CC="$(CC)" CGO_ENABLED="$(CGO_REQUIRED)" $(CGO_LDFLAGS_ALLOW)
CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" $(GO) build
$(GO_BUILD_FLAGS) -mod=vendor $<
+
+ifeq ($(CGO_REQUIRED),0)
+b215283-cgo: b215283.go CAPGOPACKAGE
+ CC="$(CC)" CGO_ENABLED="1" $(CGO_LDFLAGS_ALLOW)
CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" $(GO) build
$(GO_BUILD_FLAGS) -mod=vendor -o $@ $<
+endif
+
test: setid gowns captree $(TESTS)
CC="$(CC)" CGO_ENABLED="$(CGO_REQUIRED)" $(CGO_LDFLAGS_ALLOW) $(GO)
test -mod=vendor $(IMPORTDIR)/psx
CC="$(CC)" CGO_ENABLED="$(CGO_REQUIRED)" $(CGO_LDFLAGS_ALLOW) $(GO)
test -mod=vendor $(IMPORTDIR)/cap
@@ -110,7 +118,7 @@
# Note, the user namespace doesn't require sudo, but I wanted to avoid
# requiring that the hosting kernel supports user namespaces for the
# regular test case.
-sudotest: test ../progs/tcapsh-static b210613
+sudotest: test ../progs/tcapsh-static b210613 b215283
../progs/tcapsh-static --has-b=cap_sys_admin || exit 0 && ./gowns --ns
-- -c "echo gowns runs with user namespace"
./try-launching
ifeq ($(CGO_REQUIRED),0)
@@ -121,6 +129,12 @@
$(SUDO) ./try-launching-cgo
endif
$(SUDO) ../progs/tcapsh-static --cap-uid=$$(id -u)
--caps="cap_setpcap=ep" --iab="^cap_setpcap" -- -c ./b210613
+ $(SUDO) ./b215283
+ifeq ($(CGO_REQUIRED),0)
+ $(MAKE) b215283-cgo
+ $(SUDO) ./b215283-cgo
+endif
+
# As of libcap-2.55 We stopped installing the cap and psx packages as
# part of the install. Most distribution's packagers skip the Go
@@ -142,5 +156,5 @@
rm -f web setid gowns captree
rm -f compare-cap try-launching try-launching-cgo
rm -f $(topdir)/cap/*~ $(topdir)/psx/*~
- rm -f b210613 psx-signals psx-signals-cgo
+ rm -f b210613 b215283 b215283-cgo psx-signals psx-signals-cgo
rm -fr vendor CAPGOPACKAGE PSXGOPACKAGE go.sum
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/go/b215283.go
new/libcap-2.62/go/b215283.go
--- old/libcap-2.61/go/b215283.go 1970-01-01 01:00:00.000000000 +0100
+++ new/libcap-2.62/go/b215283.go 2021-12-12 00:00:00.000000000 +0100
@@ -0,0 +1,47 @@
+// Program b215283 requires privilege to execute and is a minimally adapted
+// version of a test case provided by Lorenz Bauer as a reproducer for a
+// problem he found and reported in:
+//
+// https://bugzilla.kernel.org/show_bug.cgi?id=215283
+package main
+
+import (
+ "fmt"
+ "os"
+
+ "kernel.org/pub/linux/libs/security/libcap/cap"
+)
+
+func main() {
+ const secbits = cap.SecbitNoRoot | cap.SecbitNoSetUIDFixup
+
+ if v, err := cap.GetProc().GetFlag(cap.Permitted, cap.SETPCAP); err !=
nil {
+ panic(fmt.Sprintf("failed to get flag value: %v", err))
+ os.Exit(1)
+ } else if !v {
+ fmt.Printf("test requires cap_setpcap: found %q\n",
cap.GetProc())
+ os.Exit(1)
+ }
+ if bits := cap.GetSecbits(); bits != 0 {
+ fmt.Printf("test expects secbits=0 to run; found: 0%o\n", bits)
+ os.Exit(1)
+ }
+
+ fmt.Println("secbits:", cap.GetSecbits(), " caps:", cap.GetProc())
+
+ l := cap.FuncLauncher(func(interface{}) error {
+ return cap.NewSet().SetProc()
+ })
+
+ if _, err := l.Launch(nil); err != nil {
+ fmt.Printf("launch failed: %v\n", err)
+ os.Exit(1)
+ }
+
+ fmt.Println("secbits:", cap.GetSecbits(), " caps:", cap.GetProc())
+
+ if err := secbits.Set(); err != nil {
+ fmt.Printf("set securebits: %v", err.Error())
+ os.Exit(1)
+ }
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/go/compare-cap.go
new/libcap-2.62/go/compare-cap.go
--- old/libcap-2.61/go/compare-cap.go 2021-09-18 05:56:21.000000000 +0200
+++ new/libcap-2.62/go/compare-cap.go 2021-11-22 02:20:50.000000000 +0100
@@ -158,8 +158,8 @@
log.Fatalf("wrong of groups: got=%v want=[100 l01]", gs)
}
- if mode := cap.GetMode(); mode != cap.ModeUncertain {
- log.Fatalf("initial mode should be 0 (UNCERTAIN), got: %d
(%v)", mode, mode)
+ if mode := cap.GetMode(); mode != cap.ModeHybrid {
+ log.Fatalf("initial mode should be 4 (HYBRID), got: %d (%v)",
mode, mode)
}
// To distinguish PURE1E and PURE1E_INIT we need an inheritable
capability set.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/go/go.mod new/libcap-2.62/go/go.mod
--- old/libcap-2.61/go/go.mod 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/go/go.mod 2021-12-12 03:05:53.000000000 +0100
@@ -3,6 +3,6 @@
go 1.11
require (
- kernel.org/pub/linux/libs/security/libcap/cap v1.2.61
- kernel.org/pub/linux/libs/security/libcap/psx v1.2.61
+ kernel.org/pub/linux/libs/security/libcap/cap v1.2.62
+ kernel.org/pub/linux/libs/security/libcap/psx v1.2.62
)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/goapps/captree/go.mod
new/libcap-2.62/goapps/captree/go.mod
--- old/libcap-2.61/goapps/captree/go.mod 2021-11-21 07:19:17.000000000
+0100
+++ new/libcap-2.62/goapps/captree/go.mod 2021-12-12 03:05:53.000000000
+0100
@@ -2,4 +2,4 @@
go 1.16
-require kernel.org/pub/linux/libs/security/libcap/cap v1.2.61
+require kernel.org/pub/linux/libs/security/libcap/cap v1.2.62
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/goapps/gowns/go.mod
new/libcap-2.62/goapps/gowns/go.mod
--- old/libcap-2.61/goapps/gowns/go.mod 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/goapps/gowns/go.mod 2021-12-12 03:05:53.000000000 +0100
@@ -2,4 +2,4 @@
go 1.15
-require kernel.org/pub/linux/libs/security/libcap/cap v1.2.61
+require kernel.org/pub/linux/libs/security/libcap/cap v1.2.62
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/goapps/setid/go.mod
new/libcap-2.62/goapps/setid/go.mod
--- old/libcap-2.61/goapps/setid/go.mod 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/goapps/setid/go.mod 2021-12-12 03:05:53.000000000 +0100
@@ -3,6 +3,6 @@
go 1.11
require (
- kernel.org/pub/linux/libs/security/libcap/cap v1.2.61
- kernel.org/pub/linux/libs/security/libcap/psx v1.2.61
+ kernel.org/pub/linux/libs/security/libcap/cap v1.2.62
+ kernel.org/pub/linux/libs/security/libcap/psx v1.2.62
)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/goapps/web/go.mod
new/libcap-2.62/goapps/web/go.mod
--- old/libcap-2.61/goapps/web/go.mod 2021-11-21 07:19:17.000000000 +0100
+++ new/libcap-2.62/goapps/web/go.mod 2021-12-12 03:05:53.000000000 +0100
@@ -2,4 +2,4 @@
go 1.11
-require kernel.org/pub/linux/libs/security/libcap/cap v1.2.61
+require kernel.org/pub/linux/libs/security/libcap/cap v1.2.62
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/Makefile
new/libcap-2.62/libcap/Makefile
--- old/libcap-2.61/libcap/Makefile 2021-11-21 07:13:35.000000000 +0100
+++ new/libcap-2.62/libcap/Makefile 2021-12-12 00:00:00.000000000 +0100
@@ -52,13 +52,13 @@
$(MAKE) $(PSXTITLE).pc
endif
-ifeq ($(BUILD_GPERF),yes)
+ifeq ($(USE_GPERF),yes)
USE_GPERF_OUTPUT = $(GPERF_OUTPUT)
INCLUDE_GPERF_OUTPUT = -DINCLUDE_GPERF_OUTPUT='"$(GPERF_OUTPUT)"'
endif
$(LIBTITLE).pc: $(LIBTITLE).pc.in
- sed -e 's,@prefix@,$(prefix),' \
+ $(BUILD_SED) -e 's,@prefix@,$(prefix),' \
-e 's,@exec_prefix@,$(exec_prefix),' \
-e 's,@libdir@,$(LIBDIR),' \
-e 's,@includedir@,$(inc_prefix)/include,' \
@@ -67,7 +67,7 @@
$< >$@
$(PSXTITLE).pc: $(PSXTITLE).pc.in
- sed -e 's,@prefix@,$(prefix),' \
+ $(BUILD_SED) -e 's,@prefix@,$(prefix),' \
-e 's,@exec_prefix@,$(exec_prefix),' \
-e 's,@libdir@,$(LIBDIR),' \
-e 's,@includedir@,$(inc_prefix)/include,' \
@@ -81,18 +81,22 @@
cap_names.h: _makenames
./_makenames > cap_names.h
-$(GPERF_OUTPUT): cap_names.list.h
- perl -e 'print "struct __cap_token_s { const char *name; int index;
};\n%{\nconst struct __cap_token_s *__cap_lookup_name(const char *,
size_t);\n%}\n%%\n"; while ($$l = <>) { $$l =~ s/[\{\"]//g; $$l =~ s/\}.*// ;
print $$l; }' < $< | gperf --ignore-case --language=ANSI-C --readonly
--null-strings --global-table --hash-function-name=__cap_hash_name
--lookup-function-name="__cap_lookup_name" -c -t -m20 $(INDENT) > $@
- sed -e 's/unsigned int len/size_t len/' -i $@
+$(GPERF_OUTPUT): cap_names.list.h cap_names.header Makefile
+ (cat cap_names.header ; $(BUILD_SED) -e 's/[\{\}"]//g' -e 's/,$$//'
cap_names.list.h) | gperf --ignore-case --language=ANSI-C --readonly
--null-strings --global-table --hash-function-name=__cap_hash_name
--lookup-function-name="__cap_lookup_name" -c -t -m20 $(INDENT) > $@
+ $(BUILD_SED) -e 's/unsigned int len/size_t len/' -i $@
# Intention is that libcap keeps up with torvalds' tree, as reflected
# by this maintained version of the kernel header. libcap dynamically
# trims the meaning of "all" capabilities down to that of the running
-# kernel as of 2.30.
+# kernel as of 2.30. That is, all production kernels should be equal
+# to or behind libcap.
+#
+# Note "./libcap.so --summary" should explain how the built libcap.so
+# compares to the running kernel.
UAPI_HEADER := $(topdir)/libcap/include/uapi/linux/capability.h
cap_names.list.h: Makefile $(UAPI_HEADER)
@echo "=> making $@ from $(UAPI_HEADER)"
- perl -e 'while ($$l=<>) { if ($$l =~ /^\#define[ \t](CAP[_A-Z]+)[
\t]+([0-9]+)\s+$$/) { $$tok=$$1; $$val=$$2; $$tok =~ tr/A-Z/a-z/; print
"{\"$$tok\",$$val},\n"; } }' $(UAPI_HEADER) | fgrep -v 0x > $@
+ $(BUILD_EGREP) '^#define\s+CAP_([^\s]+)\s+[0-9]+\s*$$'
include/uapi/linux/capability.h | $(BUILD_SED) -e 's/^#define\s\+/{"/' -e
's/\s*$$/},/' -e 's/\s\+/",/' -e
'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/' > $@
$(STACAPLIBNAME): $(CAPOBJS)
$(AR) rcs $@ $^
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/cap_names.header
new/libcap-2.62/libcap/cap_names.header
--- old/libcap-2.61/libcap/cap_names.header 1970-01-01 01:00:00.000000000
+0100
+++ new/libcap-2.62/libcap/cap_names.header 2021-12-12 00:00:00.000000000
+0100
@@ -0,0 +1,5 @@
+struct __cap_token_s { const char *name; int index; };
+%{
+const struct __cap_token_s *__cap_lookup_name(const char *, size_t);
+%}
+%%
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/cap_proc.c
new/libcap-2.62/libcap/cap_proc.c
--- old/libcap-2.61/libcap/cap_proc.c 2021-10-23 07:22:32.000000000 +0200
+++ new/libcap-2.62/libcap/cap_proc.c 2021-11-22 02:20:50.000000000 +0100
@@ -488,7 +488,9 @@
/* for good measure */
_cap_set_no_new_privs(sc);
break;
-
+ case CAP_MODE_HYBRID:
+ ret = _cap_set_secbits(sc, 0);
+ break;
default:
errno = EINVAL;
ret = -1;
@@ -524,6 +526,9 @@
{
unsigned secbits = cap_get_secbits();
+ if (secbits == 0) {
+ return CAP_MODE_HYBRID;
+ }
if ((secbits & CAP_SECURED_BITS_BASIC) != CAP_SECURED_BITS_BASIC) {
return CAP_MODE_UNCERTAIN;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/cap_test.c
new/libcap-2.62/libcap/cap_test.c
--- old/libcap-2.61/libcap/cap_test.c 2021-10-02 04:29:49.000000000 +0200
+++ new/libcap-2.62/libcap/cap_test.c 2021-12-12 00:00:00.000000000 +0100
@@ -124,7 +124,7 @@
}
if (strlen(tmp) > __CAP_NAME_SIZE) {
printf("cap_to_text buffer size reservation needs fixing (%ld > %d)\n",
- strlen(tmp), __CAP_NAME_SIZE);
+ (long int)strlen(tmp), __CAP_NAME_SIZE);
result = -1;
}
free(tmp);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/cap_text.c
new/libcap-2.62/libcap/cap_text.c
--- old/libcap-2.61/libcap/cap_text.c 2021-10-23 07:22:32.000000000 +0200
+++ new/libcap-2.62/libcap/cap_text.c 2021-11-22 02:20:50.000000000 +0100
@@ -503,6 +503,8 @@
return "PURE1E";
case CAP_MODE_UNCERTAIN:
return "UNCERTAIN";
+ case CAP_MODE_HYBRID:
+ return "HYBRID";
default:
return "UNKNOWN";
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libcap-2.61/libcap/include/sys/capability.h
new/libcap-2.62/libcap/include/sys/capability.h
--- old/libcap-2.61/libcap/include/sys/capability.h 2021-10-23
07:22:32.000000000 +0200
+++ new/libcap-2.62/libcap/include/sys/capability.h 2021-11-22
02:20:50.000000000 +0100
@@ -122,6 +122,7 @@
#define CAP_MODE_NOPRIV ((cap_mode_t) 1)
#define CAP_MODE_PURE1E_INIT ((cap_mode_t) 2)
#define CAP_MODE_PURE1E ((cap_mode_t) 3)
+#define CAP_MODE_HYBRID ((cap_mode_t) 4)
/* libcap/cap_alloc.c */
extern cap_t cap_dup(cap_t);
