On Friday 25 July 2008 12:40:25 you wrote:
> On what type of system did the new test succeed for you?
> On rawhide, capget appears to malfunction:
>
> # rm t;>t;strace -e capget setcap cap_net_bind_service=ep t 2>&1|cut
> -c-78 capget(0x20071026, 0, NULL) = -1 EFAULT (Bad address)
> capget(0x20071026, 0,
> {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWN capget(0x20071026,
> 0, NULL) = -1 EFAULT (Bad address) Failed to set capabilities
> on file `t' (Operation not permitted) usage: setcap [-q] (-r|-|<caps>)
> <filename> [ ... (-r|-|<capsN>) <filenameN> ]
>
> Note <filename> must be a regular (non-symlink) file.
>
> Considering the test doesn't pass anywhere I've tried, I'm in
> no hurry to apply it.
I have not my own rawhide testing machine, but it is disabled even on F-9. It
helped to me allow it manually (using audit2allow):
# echo "module local 1.0;
require {
type unconfined_t;
class capability setfcap;
}
allow unconfined_t self:capability setfcap;
" > local.te
# checkmodule -M -m -o local.mod local.te
# semodule_package -o local.pp -m local.mod
# semodule -i local.pp
This is easy way to enable setting of file capabilities on SELinux, but it is
still disabled by default. So I think the best solution is to skip the test
if setcap fails (as it was in my 1st version of test), because this is not
failure of ls.
Kamil
_______________________________________________
Bug-coreutils mailing list
Bug-coreutils@gnu.org
http://lists.gnu.org/mailman/listinfo/bug-coreutils
