From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42072) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VgwzV-0002il-Iu for qemu-devel@nongnu.org; Thu, 14 Nov 2013 08:29:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VgwzQ-0006lf-DG for qemu-devel@nongnu.org; Thu, 14 Nov 2013 08:29:49 -0500 Received: from mail-wg0-x22a.google.com ([2a00:1450:400c:c00::22a]:59087) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VgwzQ-0006kj-6I for qemu-devel@nongnu.org; Thu, 14 Nov 2013 08:29:44 -0500 Received: by mail-wg0-f42.google.com with SMTP id k14so691358wgh.5 for ; Thu, 14 Nov 2013 05:29:43 -0800 (PST) Date: Thu, 14 Nov 2013 14:29:40 +0100 From: Stefan Hajnoczi Message-ID: <20131114132940.GB26847@stefanha-thinkpad.redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [PATCH] build: set up capabilities on qemu-bridge-helper List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Avi Kivity Cc: Michael Tokarev , qemu-devel@nongnu.org, Cole Robinson On Tue, Nov 12, 2013 at 01:10:24PM +0200, Avi Kivity wrote: > Out-of-the-box, 'make install' sets up an unusable qemu-bridge-helper since > it doesn't have the required capabilities. > > Fix by adding them. Up until now, downstreams had to make the bridge helper executable setuid, add the cap_net_admin capability, or they did nothing and it was broken ;-). CCing downstream package maintainers in case they have any comments on this patch. > Note: this may break installing as non-root. This is actually the right > thing to do, since not setting up the capability would result in a broken > setup. Perhaps we need a configure flag to disable helpers. Users who have been successfully installing QEMU would be upset if it suddenly starts failing after this patch. The bridge helper is a niche feature that shouldn't cause a regression for the majority of users who don't care about it. If we're installing non-root then the bridge helper simply shouldn't be installed. > Signed-off-by: Avi Kivity > --- > Makefile | 3 +++ > rules.mak | 2 ++ > 2 files changed, 5 insertions(+) > > diff --git a/Makefile b/Makefile > index b15003f..af7748c 100644 > --- a/Makefile > +++ b/Makefile > @@ -188,6 +188,7 @@ qemu-img$(EXESUF): qemu-img.o $(block-obj-y) libqemuutil.a libqemustub.a > qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) libqemuutil.a libqemustub.a > qemu-io$(EXESUF): qemu-io.o $(block-obj-y) libqemuutil.a libqemustub.a > > +qemu-bridge-helper$(EXESUF).capabilities = cap_net_admin > qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o > > fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o libqemuutil.a libqemustub.a > @@ -345,6 +346,8 @@ endif > ifneq ($(HELPERS-y),) > $(INSTALL_DIR) "$(DESTDIR)$(libexecdir)" > $(INSTALL_PROG) $(STRIP_OPT) $(HELPERS-y) "$(DESTDIR)$(libexecdir)" > + $(SETCAP) $(foreach helper, $(HELPERS-y), \ > + $($(helper).capabilities)+pe "$(DESTDIR)$(libexecdir)"/$(helper)) > endif > ifneq ($(BLOBS),) > set -e; for x in $(BLOBS); do \ > diff --git a/rules.mak b/rules.mak > index 49edb9b..9194c79 100644 > --- a/rules.mak > +++ b/rules.mak > @@ -177,3 +177,5 @@ $(shell mkdir -p $(sort $(foreach var,$(nested-vars),$(dir $($(var)))))) > $(foreach var,$(nested-vars), $(eval \ > -include $(addsuffix *.d, $(sort $(dir $($(var))))))) > endef > + > +SETCAP = setcap > \ No newline at end of file > -- > 1.8.3.1 > >