在 Yocto ext4 Image 中设置 Linux 功能

Question

I intend to set some capabilities on binaries included in a Yocto image using "setcap". For some reason the solutions mentioned here did not work for me: Linux capabilities with yocto . I have checked that by running "getcap" on my binary within the rootfs creation directory:

getcap ${IMAGE_ROOTFS}/usr/bin/mybinary

does not return anything. Nor do I find the capabilities in the final running sdcard image.

Next I tried the approach using IMAGE_PREPROCESS_COMMAND. I wrapped up setcap commands in small shell functions such as:

my_setcap_function() {
    sudo setcap cap_ipc_owner+ep ${IMAGE_ROOTFS}/usr/bin/mybinary
}

and append the function names to IMAGE_PREPROCESS_COMMAND. This works to the extent that now running getcap on my binary within the {IMAGE_ROOTFS} directory does show the correct caps set. However I still do not get the capabilities in the final running sdcard image.

Also if I mount the rootfs ext4 (which is used to create the final sdcard image) on a directory using -o loop, I do not see the capabilities on my binary. It seems to me that the capabilitiess somehow get lost when the ext4 is created using mkfs.ext4.

I had to attach sudo to setcap because otherwise it complains saying "unable to set CAP_SETFCAP effective capability: Operation not permitted". Although my understanding was that IMAGE_PREPROCESS_COMMAND commands are run using fakeroot so this sudo should not be required.

So, to summarize my question:

1. How can I get the capabilities on the sdcard image made using ext4 rootfs image?
2. I want to use a way that does not require using "sudo".

I am using Yocto Krogoth and currently cannot upgrade that.

Answer 1

Did you really test it on the final image or in the rootfs folder from the yocto build?

I run getcap on the files in the rootfs folder, and there where nothing set.

Because yocto uses pseudo lib to intercept chown, chmod calls, track them in a sqlite db (uses LD_PRELOAD for interception).

So this attributes are not set for the files in the "rootfs" folder, however added at image/rootfs creation.

you can use setcap in recipe, you have to add

DEPENDS = "libcap-native"

in your recipe.