Hello community, here is the log from the commit of package libcap for openSUSE:Factory checked in at Wed Sep 21 17:09:49 CEST 2011.
-------- --- libcap/libcap.changes 2010-12-02 15:48:24.000000000 +0100 +++ /mounts/work_src_done/STABLE/libcap/libcap.changes 2011-09-20 09:48:26.000000000 +0200 @@ -1,0 +2,21 @@ +Tue Sep 20 07:48:12 UTC 2011 - [email protected] + +- Cleanup specfile a bit: Remove old tags. + +------------------------------------------------------------------- +Tue Sep 20 07:29:05 UTC 2011 - [email protected] + +- Update to libcap 2.22 +- libcap 2.22 includes: + * Clarified License file (with version 2 of the GPL) + * Support getting/setting capabilities on large files + * After --chroot command, change working directory to "/". +- libcap 2.21 includes: + * Introduce cap_get_bound() and cap_drop_bound() functions. + also include a macro CAP_IS_SUPPORTED(cap) for capabilities +- libcap 2.20 includes: + * Latest kernel capabilites supported: now includes CAP_SYSLOG + * $(CFLAGS) Makefile fixes + * Default to installing setcap with an inheritable capability. + +------------------------------------------------------------------- calling whatdependson for head-i586 Old: ---- libcap-2.19.tar.bz2 New: ---- libcap-2.22.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libcap.spec ++++++ --- /var/tmp/diff_new_pack.FrYKoz/_old 2011-09-21 17:09:44.000000000 +0200 +++ /var/tmp/diff_new_pack.FrYKoz/_new 2011-09-21 17:09:44.000000000 +0200 @@ -1,5 +1,5 @@ # -# spec file for package libcap (Version 2.19) +# spec file for package libcap # # Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. # @@ -15,19 +15,17 @@ # Please submit bugfixes or comments via http://bugs.opensuse.org/ # -# norootforbuild Name: libcap -License: BSD3c +License: BSD3c;GPLv2 Group: System/Libraries -AutoReqProv: on Summary: Library for Capabilities (linux-privs) Support -Version: 2.19 +Version: 2.22 Release: 1 Source: ftp://ftp.de.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-%{version}.tar.bz2 Source2: baselibs.conf -#URL: http://www.kernel.org/ +Url: https://sites.google.com/site/fullycapable/ BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: libattr-devel %if 0%{?suse_version} > 1030 @@ -46,7 +44,7 @@ %package -n libcap2 -License: BSD3c +License: BSD3c;GPLv2 Summary: Library for Capabilities (linux-privs) Support Group: System/Libraries @@ -61,7 +59,7 @@ %package devel -License: BSD3c +License: BSD3c;GPLv2 Summary: Development files for libcap Group: Development/Libraries/C and C++ Requires: glibc-devel libcap2 = %{version} @@ -79,7 +77,7 @@ %package progs -License: BSD3c +License: BSD3c;GPLv2 Summary: Libcap utility programs Group: System/Filesystems @@ -97,8 +95,8 @@ lib=%{_lib} make %{?_smp_mflags} DEBUG="-g $RPM_OPT_FLAGS" %install -make install DESTDIR=$RPM_BUILD_ROOT LIBDIR=$RPM_BUILD_ROOT/%{_lib} MANDIR=$RPM_BUILD_ROOT%{_mandir} -# remove unneeded fi +make install DESTDIR=$RPM_BUILD_ROOT LIBDIR=$RPM_BUILD_ROOT/%{_lib} MANDIR=$RPM_BUILD_ROOT%{_mandir} RAISE_SETFCAP=no +# remove unneeded files rm -f $RPM_BUILD_ROOT/%{_lib}/*.*a # move *.so file to libdir and relink rm -f $RPM_BUILD_ROOT/%{_lib}/*.so ++++++ libcap-2.19.tar.bz2 -> libcap-2.22.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/License new/libcap-2.22/License --- old/libcap-2.19/License 2008-01-22 01:16:58.000000000 +0100 +++ new/libcap-2.22/License 2011-07-25 03:52:49.000000000 +0200 @@ -21,10 +21,11 @@ written permission. ALTERNATIVELY, this product may be distributed under the terms of the -GNU General Public License, in which case the provisions of the GNU -GPL are required INSTEAD OF the above restrictions. (This clause is -necessary due to a potential conflict between the GNU GPL and the -restrictions contained in a BSD-style copyright.) +GNU General Public License (v2.0 - see below), in which case the +provisions of the GNU GPL are required INSTEAD OF the above +restrictions. (This clause is necessary due to a potential conflict +between the GNU GPL and the restrictions contained in a BSD-style +copyright.) THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF @@ -39,3 +40,346 @@ DAMAGE. ------------------------------------------------------------------------- +------------------------- +Full text of gpl-2.0.txt: +------------------------- + + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + <one line to give the program's name and a brief idea of what it does.> + Copyright (C) <year> <name of author> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + <signature of Ty Coon>, 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/Make.Rules new/libcap-2.22/Make.Rules --- old/libcap-2.19/Make.Rules 2010-01-14 03:04:58.000000000 +0100 +++ new/libcap-2.22/Make.Rules 2011-07-25 04:18:23.000000000 +0200 @@ -9,6 +9,8 @@ # Autoconf-style prefixes are activated when $(prefix) is defined. # Otherwise binaries and libraraies are installed in /{lib,sbin}/, # header files in /usr/include/ and documentation in /usr/man/man?/. +# These choices are motivated by the fact that getcap and setcap are +# administrative operations that could be needed to recover a system. ifndef lib lib=$(shell ldd /usr/bin/ld|fgrep ld-linux|cut -d/ -f2) @@ -37,22 +39,22 @@ # common defines for libcap LIBTITLE=libcap VERSION=2 -MINOR=19 +MINOR=22 # # Compilation specifics KERNEL_HEADERS := $(topdir)/libcap/include -IPATH += -I$(topdir)/libcap/include -I$(KERNEL_HEADERS) +IPATH += -fPIC -I$(topdir)/libcap/include -I$(KERNEL_HEADERS) CC := gcc -CFLAGS := -O2 +CFLAGS := -O2 -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 BUILD_CC := $(CC) BUILD_CFLAGS := $(CFLAGS) $(IPATH) AR := ar RANLIB := ranlib DEBUG = -g #-DDEBUG -WARNINGS=-fPIC -Wall -Wwrite-strings \ +WARNINGS=-Wall -Wwrite-strings \ -Wpointer-arith -Wcast-qual -Wcast-align \ -Wstrict-prototypes -Wmissing-prototypes \ -Wnested-externs -Winline -Wshadow @@ -62,12 +64,22 @@ SYSTEM_HEADERS = /usr/include INCS=$(topdir)/libcap/include/sys/capability.h LDFLAGS += -L$(topdir)/libcap -CFLAGS += -Dlinux $(WARNINGS) $(DEBUG) $(IPATH) +CFLAGS += -Dlinux $(WARNINGS) $(DEBUG) PAM_CAP := $(shell if [ -f /usr/include/security/pam_modules.h ]; then echo yes ; else echo no ; fi) INDENT := $(shell if [ -n "$(which indent 2>/dev/null)" ]; then echo "| indent -kr" ; fi) DYNAMIC := $(shell if [ ! -d "$(topdir)/.git" ]; then echo yes; fi) LIBATTR := yes +# When installing setcap, set its inheritable bit to be able to place +# capabilities on files. It can be used in conjunction with pam_cap +# (associated with su and certain users say) to make it useful for +# specially blessed users. If you wish to drop this install feature, +# use this command when running install +# +# make RAISE_SETFCAP=no install +# +RAISE_SETFCAP := $(LIBATTR) + # Global cleanup stuff LOCALCLEAN=rm -f *~ core diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/Makefile new/libcap-2.22/Makefile --- old/libcap-2.19/Makefile 2008-07-10 08:18:40.000000000 +0200 +++ new/libcap-2.22/Makefile 2011-07-25 04:23:05.000000000 +0200 @@ -28,3 +28,7 @@ release: distclean cd .. && ln -s libcap libcap-$(VERSION).$(MINOR) && tar cvfz libcap-$(VERSION).$(MINOR).tar.gz libcap-$(VERSION).$(MINOR)/* && rm libcap-$(VERSION).$(MINOR) + +tagrelease: distclean + git tag -s libcap-$(VERSION).$(MINOR) + make release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/Makefile new/libcap-2.22/doc/Makefile --- old/libcap-2.19/doc/Makefile 2009-12-26 01:09:29.000000000 +0100 +++ new/libcap-2.22/doc/Makefile 2011-04-26 06:38:17.000000000 +0200 @@ -12,7 +12,8 @@ cap_get_file.3 cap_get_fd.3 cap_set_file.3 cap_set_fd.3 \ cap_copy_ext.3 cap_size.3 cap_copy_int.3 \ cap_from_text.3 cap_to_text.3 cap_from_name.3 cap_to_name.3 \ - capsetp.3 capgetp.3 libcap.3 + capsetp.3 capgetp.3 libcap.3 \ + cap_get_bound.3 cap_drop_bound.3 MAN8S = getcap.8 setcap.8 MANS = $(MAN1S) $(MAN3S) $(MAN8S) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/cap_drop_bound.3 new/libcap-2.22/doc/cap_drop_bound.3 --- old/libcap-2.19/doc/cap_drop_bound.3 1970-01-01 01:00:00.000000000 +0100 +++ new/libcap-2.22/doc/cap_drop_bound.3 2011-04-26 06:36:49.000000000 +0200 @@ -0,0 +1 @@ +.so man3/cap_get_proc.3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/cap_from_text.3 new/libcap-2.22/doc/cap_from_text.3 --- old/libcap-2.19/doc/cap_from_text.3 2008-10-09 08:20:33.000000000 +0200 +++ new/libcap-2.22/doc/cap_from_text.3 2010-08-09 00:20:34.000000000 +0200 @@ -149,9 +149,9 @@ .BR cap_from_text (), .BR cap_to_text () and -.BR cap_to_text () +.BR cap_to_name () return a non-NULL value on success, and NULL on failure. -.BR cap_from_text () +.BR cap_from_name () returns 0 for success, and -1 on failure (unknown capability). .PP On failure, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/cap_get_bound.3 new/libcap-2.22/doc/cap_get_bound.3 --- old/libcap-2.19/doc/cap_get_bound.3 1970-01-01 01:00:00.000000000 +0100 +++ new/libcap-2.22/doc/cap_get_bound.3 2011-04-26 06:37:03.000000000 +0200 @@ -0,0 +1 @@ +.so man3/cap_get_proc.3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/cap_get_proc.3 new/libcap-2.22/doc/cap_get_proc.3 --- old/libcap-2.19/doc/cap_get_proc.3 2008-10-09 08:20:33.000000000 +0200 +++ new/libcap-2.22/doc/cap_get_proc.3 2011-04-26 06:40:29.000000000 +0200 @@ -3,8 +3,8 @@ .\" .TH CAP_GET_PROC 3 "2008-05-11" "" "Linux Programmer's Manual" .SH NAME -cap_get_proc, cap_set_proc, capgetp \- capability manipulation on -processes +cap_get_proc, cap_set_proc, capgetp, cap_get_bound, cap_drop_bound \- +capability manipulation on processes .SH SYNOPSIS .B #include <sys/capability.h> .sp @@ -12,6 +12,12 @@ .sp .BI "int cap_set_proc(cap_t " cap_p ); .sp +.BI "int cap_get_bound(cap_value_t " cap ); +.sp +.BI "CAP_IS_SUPPORTED(cap_value_t " cap ); +.sp +.BI "int cap_drop_bound(cap_value_t " cap ); +.sp .B #include <sys/types.h> .sp .BI "cap_t cap_get_pid(pid_t " pid ); @@ -52,6 +58,28 @@ This information can also be obtained from the .I /proc/<pid>/status file. +.PP +.BR cap_get_bound () +with a +.I cap +as an argument returns the current value of this bounding set +capability flag in effect for the current process. This operation is +unpriveged. Note, a macro function +.BI "CAP_IS_SUPPORTED(cap_value_t " cap ) +is provided that evaluates to true (1) if the system supports the +specified capability, +.IR cap . +If the system does not support the capability, this function returns +0. This macro works by testing for an error condition with +.BR cap_get_bound (). +.PP +.BR cap_drop_bound () +can be used to lower the specified bounding set capability, +.BR cap , +To complete successfully, the prevailing +.I effective +capability set must have a raised +.BR CAP_SETPCAP . .SH "RETURN VALUE" The functions .BR cap_get_proc () @@ -60,7 +88,15 @@ return a non-NULL value on success, and NULL on failure. .PP The function +.BR cap_get_bound () +returns -1 if the requested capability is unknown, otherwise the +return value reflects the current state of that capability in the +prevailing bounding set. Note, a macro function, +.PP +The functions .BR cap_set_proc () +and +.BR cap_drop_bound () return zero for success, and \-1 on failure. .PP On failure, @@ -140,6 +176,9 @@ cap_t caps; cap_value_t cap_list[2]; + if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) + /* handle error */ + caps = cap_get_proc(); if (caps == NULL) /* handle error */; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/capsh.1 new/libcap-2.22/doc/capsh.1 --- old/libcap-2.19/doc/capsh.1 2009-12-26 01:09:29.000000000 +0100 +++ new/libcap-2.22/doc/capsh.1 2011-04-25 01:23:54.000000000 +0200 @@ -1,7 +1,7 @@ .\" .\" capsh.1 Man page added 2009-12-23 Andrew G. Morgan <[email protected]> .\" -.TH CAPSH 1 "2009-12-24" "libcap 2" "User Commands" +.TH CAPSH 1 "2011-04-24" "libcap 2" "User Commands" .SH NAME capsh \- capability shell wrapper .SH SYNOPSIS @@ -150,6 +150,15 @@ we observe that the missing capability is: .BR cap_setpcap . +.TP +.BI --supports= xxx +As the kernel evolves, more capabilities are added. This option can be used +to verify the existence of a capability on the system. For example, +.BI --supports= cap_syslog +will cause capsh to promptly exit with a status of 1 when run on +kernel 2.6.27. However, when run on kernel 2.6.38 it will silently +succeed. +.TP .SH "EXIT STATUS" Following successful execution the tool exits with status 0. Following an error, the tool immediately exits with status 1. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/doc/libcap.3 new/libcap-2.22/doc/libcap.3 --- old/libcap-2.19/doc/libcap.3 2008-10-09 08:20:33.000000000 +0200 +++ new/libcap-2.22/doc/libcap.3 2011-04-26 06:36:21.000000000 +0200 @@ -111,3 +111,4 @@ .BR cap_init (3), .BR capabilities (7), .BR getpid (2) +.BR capsh (1) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/libcap/Makefile new/libcap-2.22/libcap/Makefile --- old/libcap-2.19/libcap/Makefile 2008-12-04 08:03:12.000000000 +0100 +++ new/libcap-2.22/libcap/Makefile 2010-08-09 00:26:04.000000000 +0200 @@ -55,10 +55,10 @@ ln -sf $(MAJLIBNAME) $(LIBNAME) %.o: %.c $(INCLS) - $(CC) $(CFLAGS) -c $< -o $@ + $(CC) $(CFLAGS) $(IPATH) -c $< -o $@ cap_text.o: cap_text.c $(USE_GPERF_OUTPUT) $(INCLS) - $(CC) $(CFLAGS) $(INCLUDE_GPERF_OUTPUT) -c $< -o $@ + $(CC) $(CFLAGS) $(IPATH) $(INCLUDE_GPERF_OUTPUT) -c $< -o $@ install: all mkdir -p -m 0755 $(INCDIR)/sys diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/libcap/cap_proc.c new/libcap-2.22/libcap/cap_proc.c --- old/libcap-2.19/libcap/cap_proc.c 2008-07-10 08:18:40.000000000 +0200 +++ new/libcap-2.22/libcap/cap_proc.c 2011-07-25 04:13:51.000000000 +0200 @@ -1,9 +1,11 @@ /* - * Copyright (c) 1997-8,2007 Andrew G Morgan <[email protected]> + * Copyright (c) 1997-8,2007,2011 Andrew G Morgan <[email protected]> * - * This file deals with setting capabilities on processes. + * This file deals with getting and setting capabilities on processes. */ +#include <sys/prctl.h> + #include "libcap.h" cap_t cap_get_proc(void) @@ -103,3 +105,22 @@ return error; } +/* get a capability from the bounding set */ + +int cap_get_bound(cap_value_t cap) +{ + int result; + + result = prctl(PR_CAPBSET_READ, cap); + return result; +} + +/* drop a capability from the bounding set */ + +int cap_drop_bound(cap_value_t cap) +{ + int result; + + result = prctl(PR_CAPBSET_DROP, cap); + return result; +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/libcap/include/linux/capability.h new/libcap-2.22/libcap/include/linux/capability.h --- old/libcap-2.19/libcap/include/linux/capability.h 2010-01-14 02:59:33.000000000 +0100 +++ new/libcap-2.22/libcap/include/linux/capability.h 2011-01-19 06:00:55.000000000 +0100 @@ -355,7 +355,12 @@ #define CAP_MAC_ADMIN 33 -#define CAP_LAST_CAP CAP_MAC_ADMIN + +/* Privileged syslog operations currently require CAP_SYSLOG. + CAP_SYS_ADMIN is not acceptable anymore. */ +#define CAP_SYSLOG 34 + +#define CAP_LAST_CAP CAP_SYSLOG #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/libcap/include/sys/capability.h new/libcap-2.22/libcap/include/sys/capability.h --- old/libcap-2.19/libcap/include/sys/capability.h 2009-08-27 07:01:01.000000000 +0200 +++ new/libcap-2.22/libcap/include/sys/capability.h 2011-04-25 00:56:52.000000000 +0200 @@ -93,6 +93,11 @@ extern cap_t cap_get_pid(pid_t); extern int cap_set_proc(cap_t); +extern int cap_get_bound(cap_value_t); +extern int cap_drop_bound(cap_value_t); + +#define CAP_IS_SUPPORTED(cap) (cap_get_bound(cap) >= 0) + /* libcap/cap_extint.c */ extern ssize_t cap_size(cap_t); extern ssize_t cap_copy_ext(void *, cap_t, ssize_t); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/pam_cap/Makefile new/libcap-2.22/pam_cap/Makefile --- old/libcap-2.19/pam_cap/Makefile 2008-10-17 06:31:01.000000000 +0200 +++ new/libcap-2.22/pam_cap/Makefile 2010-08-09 02:08:01.000000000 +0200 @@ -3,8 +3,11 @@ topdir=$(shell pwd)/.. include ../Make.Rules -LDLIBS += -lcap -CFLAGS += -fPIC +# Note (as the author of much of the Linux-PAM library, I am confident +# that this next line does *not* require -lpam on it.) If you think it +# does, *verify that it does*, and if you observe that it fails as +# written (and you know why it fails), email me and explain why. Thanks! +LDLIBS += -L../libcap -lcap all: pam_cap.so $(MAKE) testcompile @@ -17,7 +20,7 @@ $(LD) $(LDFLAGS) -o pam_cap.so $< $(LDLIBS) pam_cap.o: pam_cap.c - $(CC) $(CFLAGS) -c $< -o $@ + $(CC) $(CFLAGS) $(IPATH) -c $< -o $@ testcompile: test.c pam_cap.o $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $+ -lpam -ldl $(LDLIBS) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/pam_cap/capability.conf new/libcap-2.22/pam_cap/capability.conf --- old/libcap-2.19/pam_cap/capability.conf 2008-05-01 04:18:10.000000000 +0200 +++ new/libcap-2.22/pam_cap/capability.conf 2010-08-09 01:44:07.000000000 +0200 @@ -15,15 +15,31 @@ # Here are some sample lines (remove the preceding '#' if you want to # use them -## user 'morgan' gets the CAP_SETFCAP inheritable capability +## user 'morgan' gets the CAP_SETFCAP inheritable capability (commented out!) #cap_setfcap morgan -## user 'luser' inherits the CAP_DAC_OVERRIDE capability +## user 'luser' inherits the CAP_DAC_OVERRIDE capability (commented out!) #cap_dac_override luser -## 'everyone else' gets no inheritable capabilities +## 'everyone else' gets no inheritable capabilities (restrictive config) none * ## if there is no '*' entry, all users not explicitly mentioned will ## get all available capabilities. This is a permissive default, and -## probably not what you want... +## possibly not what you want... On first reading, you might think this +## is a security problem waiting to happen, but it defaults to not being +## so in this sample file! Further, by 'get', we mean 'get in their inheritable +## set'. That is, if you look at a random process, even one run by root, +## you will see it has no inheritable capabilities (by default): +## +## $ /sbin/capsh --decode=$(grep CapInh /proc/1/status|awk '{print $2}') +## 0000000000000000= +## +## The pam_cap module simply alters the value of this capability +## set. Including the 'none *' forces use of this module with an +## unspecified user to have their inheritable set forced to zero. +## +## Omitting the line will cause the inheritable set to be unmodified +## from what the parent process had (which is generally 0 unless the +## invoking user was bestowed with some inheritable capabilities by a +## previous invocation). diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/progs/Makefile new/libcap-2.22/progs/Makefile --- old/libcap-2.19/progs/Makefile 2008-11-24 06:33:33.000000000 +0100 +++ new/libcap-2.22/progs/Makefile 2010-08-09 01:56:40.000000000 +0200 @@ -14,7 +14,7 @@ ifneq ($(DYNAMIC),yes) LDFLAGS += --static endif -LDLIBS += -lcap +LDLIBS += -L../libcap -lcap all: $(BUILD) @@ -22,13 +22,16 @@ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< $(LDLIBS) %.o: %.c $(INCS) - $(CC) $(CFLAGS) -c $< -o $@ + $(CC) $(IPATH) $(CFLAGS) -c $< -o $@ install: all mkdir -p -m 0755 $(SBINDIR) for p in $(PROGS) ; do \ install -m 0755 $$p $(SBINDIR) ; \ done +ifeq ($(RAISE_SETFCAP),yes) + $(SBINDIR)/setcap cap_setfcap=i $(SBINDIR)/setcap +endif clean: $(LOCALCLEAN) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/progs/capsh.c new/libcap-2.22/progs/capsh.c --- old/libcap-2.19/progs/capsh.c 2010-01-14 02:59:33.000000000 +0100 +++ new/libcap-2.22/progs/capsh.c 2011-07-25 04:05:15.000000000 +0200 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008 Andrew G. Morgan <[email protected]> + * Copyright (c) 2008-11 Andrew G. Morgan <[email protected]> * * This is a simple 'bash' wrapper program that can be used to * raise and lower both the bset and pI capabilities before invoking @@ -80,11 +80,15 @@ if (strcmp("all", argv[i]+7) == 0) { unsigned j = 0; - while (prctl(PR_CAPBSET_READ, j) >= 0) { - if (prctl(PR_CAPBSET_DROP, j) != 0) { + while (CAP_IS_SUPPORTED(j)) { + if (cap_drop_bound(j) != 0) { + char *name_ptr; + + name_ptr = cap_to_name(j); fprintf(stderr, "Unable to drop bounding capability [%s]\n", - cap_to_name(j)); + name_ptr); + cap_free(name_ptr); exit(1); } j++; @@ -152,7 +156,11 @@ perror("Out of memory for inh set"); exit(1); } - sprintf(ptr, "%s %s+i", text, argv[i]+6); + if (argv[i][6] && strcmp("none", argv[i]+6)) { + sprintf(ptr, "%s %s+i", text, argv[i]+6); + } else { + strcpy(ptr, text); + } all = cap_from_text(ptr); if (all == NULL) { @@ -270,10 +278,16 @@ perror("unable to lower CAP_SYS_CHROOT"); exit(1); } + /* + * Given we are now in a new directory tree, its good practice + * to start off in a sane location + */ + status = chdir("/"); + cap_free(orig); if (status != 0) { - fprintf(stderr, "Unable to chroot to [%s]", argv[i]+9); + fprintf(stderr, "Unable to chroot/chdir to [%s]", argv[i]+9); exit(1); } } else if (!memcmp("--secbits=", argv[i], 10)) { @@ -441,11 +455,12 @@ for (cap=0; (cap < 64) && (value >> cap); ++cap) { if (value & (1ULL << cap)) { - const char *ptr; + char *ptr; ptr = cap_to_name(cap); if (ptr != NULL) { printf("%s%s", sep, ptr); + cap_free(ptr); } else { printf("%s%u", sep, cap); } @@ -453,6 +468,19 @@ } } printf("\n"); + } else if (!memcmp("--supports=", argv[i], 11)) { + cap_value_t cap; + + if (cap_from_name(argv[i] + 11, &cap) < 0) { + fprintf(stderr, "cap[%s] not recognized by library\n", + argv[i] + 11); + exit(1); + } + if (!CAP_IS_SUPPORTED(cap)) { + fprintf(stderr, "cap[%s=%d] not supported by kernel\n", + argv[i] + 11, cap); + exit(1); + } } else if (!strcmp("--print", argv[i])) { unsigned cap; int set, status, j; @@ -472,17 +500,18 @@ printf("Bounding set ="); sep = ""; - for (cap=0; (set = prctl(PR_CAPBSET_READ, cap)) >= 0; cap++) { - const char *ptr; + for (cap=0; (set = cap_get_bound(cap)) >= 0; cap++) { + char *ptr; if (!set) { continue; } ptr = cap_to_name(cap); - if (ptr == 0) { + if (ptr == NULL) { printf("%s%u", sep, cap); } else { printf("%s%s", sep, ptr); + cap_free(ptr); } sep = ","; } @@ -538,6 +567,7 @@ " --help this message (or try 'man capsh')\n" " --print display capability relevant state\n" " --decode=xxx decode a hex string to a list of caps\n" + " --supports=xxx exit 1 if capability xxx unsupported\n" " --drop=xxx remove xxx,.. capabilities from bset\n" " --caps=xxx set caps as per cap_from_text()\n" " --inh=xxx set xxx,.. inheritiable set\n" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcap-2.19/progs/quicktest.sh new/libcap-2.22/progs/quicktest.sh --- old/libcap-2.19/progs/quicktest.sh 2010-01-14 02:59:33.000000000 +0100 +++ new/libcap-2.22/progs/quicktest.sh 2011-07-25 04:11:33.000000000 +0200 @@ -21,6 +21,7 @@ echo -n "EXPECT FAILURE: " try_capsh "$@" if [ $? -eq 1 ]; then + echo "[WHICH MEANS A PASS!]" return 0 else echo "Undesired result - aborting" @@ -121,7 +122,7 @@ exit 0 EOF chmod +xs hack.sh -./capsh --uid=500 -- ./hack.sh +./capsh --uid=500 --inh=none --print -- ./hack.sh status=$? rm -f ./hack.sh if [ $status -ne 0 ]; then @@ -132,3 +133,8 @@ # Max lockdown pass_capsh --keep=1 --user=nobody --caps=cap_setpcap=ep \ --drop=all --secbits=0x2f --caps= --print + +# Verify we can chroot +pass_capsh --chroot=$(/bin/pwd) +pass_capsh --chroot=$(/bin/pwd) == +fail_capsh --chroot=$(/bin/pwd) -- -c "echo oops" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
