Package: coreutils
Version: 9.10-1
Severity: normal
Tags: patch
X-Debbugs-Cc: [email protected]
Hi Michael,
I noticed that in Debian Forky, ‘ls’ from GNU coreutils is not linked to
libcap:
$ podman run --rm -it debian:forky
$ { apt update -y && apt upgrade -y \
&& apt install -y binutils; } >/dev/null 2>&1
$ readelf -d /usr/bin/ls | grep -F NEEDED
0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
In Debian Trixie it is:
$ podman run --rm -it debian:trixie
$ { apt update -y && apt upgrade -y \
&& apt install -y binutils; } >/dev/null 2>&1
$ readelf -d /usr/bin/ls | grep -F NEEDED
0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1]
0x0000000000000001 (NEEDED) Shared library: [libcap.so.2]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
GNU coreutils' 'ls' uses this to color files with capabilities set. It
appears that the coreutils package never had libcap-dev listed in
Build-Depends. In Trixie, it was brought in through the libsystemd
dependency. We can see that it depends on libcap in Trixie [1]. However,
in Forky the dependency was dropped [2], causing GNU coreutils to be
built without support for capabilities.
I confirmed this using an unstable sbuild chroot. Here is the relevant
output from ./configure before making any changes to the source package:
checking for cap_get_file in -lcap... no
configure: WARNING: libcap library was not found or not usable.
configure: WARNING: GNU coreutils will be built without capability support.
Here we can see that ‘ls’ from the just-built package is missing a
libcap dependency:
$ dpkg-deb -x coreutils_9.10-1_amd64.deb out
$ readelf -d out/usr/bin/ls | grep -F NEEDED
0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
I wrote the following patch and then bumped the version number:
$ diff -u debian/control.orig debian/control
--- debian/control.orig 2026-10-11 19:14:52.598734877 -0700
+++ debian/control 2026-10-11 19:15:49.163618195 -0700
@@ -2,7 +2,7 @@
Maintainer: Michael Stone <[email protected]>
Section: utils
Standards-Version: 4.7.3
-Build-Depends: gettext (>= 0.10.37), debhelper-compat (= 13), texinfo (>= 4.2)
<!nodoc>, libattr1-dev [linux-any], libacl1-dev [linux-any], libselinux-dev
[linux-any], gperf, bison, libgmp3-dev, libssl-dev, libsystemd-dev
+Build-Depends: gettext (>= 0.10.37), debhelper-compat (= 13), texinfo (>= 4.2)
<!nodoc>, libattr1-dev [linux-any], libacl1-dev [linux-any], libselinux-dev
[linux-any], gperf, bison, libgmp3-dev, libssl-dev, libsystemd-dev, libcap-dev
Package: coreutils
Architecture: any
Here is the relevant output from ./configure with those changes:
checking for cap_get_file in -lcap... yes
checking for sys/capability.h... yes
Here we can see that ‘ls’ from the just-built package has the libcap
dependency:
$ dpkg-deb -x coreutils_9.10-1.1_amd64.deb out
$ readelf -d out/usr/bin/ls | grep -F NEEDED
0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1]
0x0000000000000001 (NEEDED) Shared library: [libcap.so.2]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
Thanks,
Collin
[1] https://packages.debian.org/trixie/libsystemd0
[2] https://packages.debian.org/forky/libsystemd0
