Package: mtr
Tags: patch, security
This seems to have been fairly successful for iputils, so let's do it
more. The attached patch causes mtr and mtr-tiny to be installed with
a file capability for CAP_NET_RAW instead of being setuid root, which
substantially reduces their privileges. I've shamelessly copied the
postinst script from iputils (noahm++).
diff --git a/debian/control b/debian/control
index be35beb..42515c7 100644
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Build-Depends: libncurses-dev, debhelper (>= 5), libgtk2.0-dev, automake
Package: mtr
Architecture: any
Priority: extra
-Depends: ${shlibs:Depends}, ${misc:Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}, libcap2-bin
Conflicts: suidmanager (<< 0.50), mtr-tiny
Replaces: mtr-tiny
Description: Full screen ncurses and X11 traceroute tool
@@ -26,7 +26,7 @@ Description: Full screen ncurses and X11 traceroute tool
Package: mtr-tiny
Architecture: any
Priority: optional
-Depends: ${shlibs:Depends}, ${misc:Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}, libcap2-bin
Conflicts: suidmanager (<< 0.50), mtr
Replaces: mtr
Description: Full screen ncurses traceroute tool
diff --git a/debian/mtr-tiny.postinst b/debian/mtr-tiny.postinst
new file mode 100644
index 0000000..f72e35b
--- /dev/null
+++ b/debian/mtr-tiny.postinst
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = configure ]; then
+ # If we have setcap is installed, try setting cap_net_raw+ep,
+ # which allows us to install our binaries without the setuid
+ # bit.
+ if command -v setcap > /dev/null; then
+ if ! setcap cap_net_raw+ep /usr/bin/mtr-tiny; then
+ echo "Setcap failed on /usr/bin/mtr-tiny, falling back to setuid" >&2
+ chmod u+s /usr/bin/mtr-tiny
+ fi
+ else
+ echo "Setcap is not installed, falling back to setuid" >&2
+ chmod u+s /usr/bin/mtr-tiny
+ fi
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/mtr.postinst b/debian/mtr.postinst
new file mode 100644
index 0000000..13fb00e
--- /dev/null
+++ b/debian/mtr.postinst
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = configure ]; then
+ # If we have setcap is installed, try setting cap_net_raw+ep,
+ # which allows us to install our binaries without the setuid
+ # bit.
+ if command -v setcap > /dev/null; then
+ if ! setcap cap_net_raw+ep /usr/bin/mtr; then
+ echo "Setcap failed on /usr/bin/mtr, falling back to setuid" >&2
+ chmod u+s /usr/bin/mtr
+ fi
+ else
+ echo "Setcap is not installed, falling back to setuid" >&2
+ chmod u+s /usr/bin/mtr
+ fi
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/rules b/debian/rules
index 05ce1e8..d416d7c 100755
--- a/debian/rules
+++ b/debian/rules
@@ -64,6 +64,7 @@ binary-arch: build
# Add here commands to install the files into debian/tmp
$(MAKE) -C mtr-tiny prefix=`pwd`/debian/mtr-tiny/usr install
mv mtr-tiny/debian/tmp/usr/bin/mtr debian/mtr-tiny/usr/bin/
+ chmod 0755 debian/mtr/usr/bin/mtr-tiny
dh_installdocs -pmtr-tiny
# dh_installexamples -mtr-ptiny
@@ -87,6 +88,7 @@ binary-arch: build
dh_installdirs -pmtr
$(MAKE) -C mtr prefix=`pwd`/debian/mtr/usr install
mv mtr/debian/tmp/usr/bin/mtr debian/mtr/usr/bin/
+ chmod 0755 debian/mtr/usr/bin/mtr
dh_installdocs -pmtr
# dh_installexamples -pmtr
