Re: libcap vs libcap-ng mess

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Nov 28, 2019 at 07:04:08PM +0000, Dr. David Alan Gilbert wrote:
> Hi,
>   We seem to have a bit of a mess with libcap and libcap-ng; and I'm not
> sure if we should try and untangle it.
> 
> a) Our configure script has tests for both libcap and libcap-ng
>   for libcap it says $cap, for libcap-ng it says $cap_ng (ok)
>   If $cap is set - nothing happens?
>   If $cap_ng is set - we define CONFIG_LIBCAP  (!)

Wow, confusing to the max.

> b) We use both
>   1) pr-helper and bridge-helper use CONFIG_LIBCAP and use cap-ng
>   2) 9p's virtfs-proxy-helper uses libcap - it's got a check in
>      configure to make sure you have libcap if you've asked for 9p
> 
> c) Our gitlab-ci.yml installs libcap-dev to get the 9p stuff tested
>   but never installes libcap-ng-dev

Opps.

> 
> I hit this because we're using libcap in virtiofsd at the moment.
> 
> So hmm how to fix?
> I'm tempted to:
>   x) Replace CONFIG_LIBCAP by CONFIG_LIBCAPNG to make it clear

Definitely

>   y) Should we flip over to only using one or the other - what
>      are the advantages?

In libvirt we use libcap-ng. We picked this originally as its API
design allows you do write simpler code than libcap in some cases
You can see some docs & examples here:

  https://people.redhat.com/sgrubb/libcap-ng/

So I vote for changing the 9p code to use libcap-ng.

>   z) We should probably add the other one to the ci.

Yep.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|