From 83a255962cb155bd8b64e4ca452a77b737d1841f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Wed, 3 Apr 2024 12:16:45 -0700 Subject: [PATCH 01/26] Add manpages for pam_cap and capability.conf --- 0001-doc-document-pam_cap-and-its-conf.patch | 179 +++++++++++++++++++ libcap.spec | 9 +- tests/manpages/test.sh | 2 + 3 files changed, 188 insertions(+), 2 deletions(-) create mode 100644 0001-doc-document-pam_cap-and-its-conf.patch diff --git a/0001-doc-document-pam_cap-and-its-conf.patch b/0001-doc-document-pam_cap-and-its-conf.patch new file mode 100644 index 0000000..c87afb3 --- /dev/null +++ b/0001-doc-document-pam_cap-and-its-conf.patch @@ -0,0 +1,179 @@ +From 7787f4019a86b962ef3b44305cde5888a14cfe52 Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Wed, 3 Apr 2024 11:57:14 -0700 +Subject: [PATCH] doc: document pam_cap and its conf + +Signed-off-by: Carlos Rodriguez-Fernandez +--- + doc/Makefile | 8 ++-- + doc/capability.conf.5 | 85 +++++++++++++++++++++++++++++++++++++++++++ + doc/pam_cap.8 | 35 ++++++++++++++++++ + 3 files changed, 125 insertions(+), 3 deletions(-) + create mode 100644 doc/capability.conf.5 + create mode 100644 doc/pam_cap.8 + +diff --git a/doc/Makefile b/doc/Makefile +index 6919488..9d1574c 100644 +--- a/doc/Makefile ++++ b/doc/Makefile +@@ -32,9 +32,10 @@ MAN3S = cap_init.3 cap_free.3 cap_dup.3 \ + psx_syscall.3 psx_syscall3.3 psx_syscall6.3 psx_set_sensitivity.3 \ + psx_load_syscalls.3 __psx_syscall.3 \ + libpsx.3 +-MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 ++MAN5S = capability.conf.5 ++MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 pam_cap.8 + +-MANS = $(MAN1S) $(MAN3S) $(MAN8S) ++MANS = $(MAN1S) $(MAN3S) $(MAN5S) $(MAN8S) + + all: $(MANS) + +@@ -54,10 +55,11 @@ html: + done + + install: +- mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man8 ++ mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man5 $(FAKEROOT)$(MANDIR)/man8 + for man in \ + $(FAKEROOT)$(MANDIR)/man1 $(MAN1S) \ + $(FAKEROOT)$(MANDIR)/man3 $(MAN3S) \ ++ $(FAKEROOT)$(MANDIR)/man5 $(MAN5S) \ + $(FAKEROOT)$(MANDIR)/man8 $(MAN8S) \ + ; \ + do \ +diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 +new file mode 100644 +index 0000000..10ff63b +--- /dev/null ++++ b/doc/capability.conf.5 +@@ -0,0 +1,85 @@ ++.\" generated with Ronn-NG/v0.9.1 ++.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 ++.TH "CAPABILITY\.CONF" "5" "April 2024" "" ++.SH "NAME" ++\fBcapability\.conf\fR \- pam_cap module configuration file ++.SH "SYNOPSIS" ++\fB/etc/security/capability\.conf\fR ++.SH "DESCRIPTION" ++The syntax for lines in this configuration file is: ++.P ++\fB# <\-\- \'#\' precedes a comment\fR ++.P ++\fB\fR ++.P ++Where \fB\fR refers to the text format for an inheritable IAB capability tuple, or the words \fBall\fR or \fBnone\fR\. ++.P ++The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. ++.P ++Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. ++.P ++The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. ++.P ++Examples of valid syntax are: ++.IP "" 4 ++.nf ++# only root gets to keep what it had ++ ++all root ++ ++ ++# this should fire for user beta only, who will have ++ ++# cap_chown dropped from their bounding set\. ++ ++!cap_chown beta ++ ++ ++# the next one should snag the members of the \'three\' group ++ ++# granting them cap_setuid and cap_chown ++ ++cap_setuid,cap_chown @three ++ ++ ++# this would apply to beta and gamma, but beta is already ++ ++# granted a lack of cap_chown above\. Further, if gamma is ++ ++# in the \'three\' group, it would not reach this line\. ++ ++cap_chown beta gamma ++ ++ ++# members of the \'one\' group are granted the cap_setuid Inheritable ++ ++# capability, but cap_chown is dropped from their bounding set\. ++ ++!cap_chown,cap_setuid @one ++ ++ ++# user alpha gets an ambient capability (unless it is also ++ ++# a member of the groups \'one\' or \'three\')\. ++ ++^cap_setuid alpha ++ ++ ++# user delta (if not a member of groups \'one\' and \'three\') will get ++ ++# cap_chown and cap_setgid Ambient capabilities, but have cap_setuid ++ ++# dropped from its bounding set\. ++ ++^cap_chown,^cap_setgid,!cap_setuid delta ++ ++ ++# any remaining members of group \'four\' will get the cap_setuid ++ ++# Inheritable capability\. ++ ++cap_setuid @four ++.fi ++.IP "" 0 ++.SH "SEE ALSO" ++pam_cap(8) +diff --git a/doc/pam_cap.8 b/doc/pam_cap.8 +new file mode 100644 +index 0000000..93c1a71 +--- /dev/null ++++ b/doc/pam_cap.8 +@@ -0,0 +1,35 @@ ++.\" generated with Ronn-NG/v0.9.1 ++.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 ++.TH "PAM_CAP" "8" "April 2024" "" ++.SH "NAME" ++\fBpam_cap\fR \- Capabilities PAM module ++.SH "SYNOPSIS" ++[service\-name] \fBauth\fR control\-flag \fBpam_cap\fR [options] ++.SH "DESCRIPTION" ++The \fBpam_so\fR module can be used to specify \fIInheritable\fR capabilities to process trees rooted in the PAM application\. The module also supports blocking \fIBounding\fR vector capabilities and adding \fIAmbient\fR vector capabilities\. ++.P ++For general PAM apps to work correctly, the application must be run with at least \fBCAP_SETPCAP\fR raised in its \fIPermitted\fR capability flag\. Many PAM applications run as \fIroot\fR, which has all of the bits in the \fIBounding\fR set raised, so this requirement is typically met\. To grant an \fIAmbient\fR vector capability, the corresponding Permitted bit must be available to the application too\. ++.P ++The \fBpam_so\fR module is a Linux\-PAM \fIauth\fR module\. It provides functionality to back \fBpam_sm_authenticate()\fR and \fBpam_sm_setcred()\fR\. It is the latter that actually modifies the inheritable 3\-tuple of capability vectors: the configured \fIIAB\fR\. In a typical application configuration you might have a line like this: ++.IP "" 4 ++.nf ++auth optional pam_cap\.so ++.fi ++.IP "" 0 ++.P ++The module arguments are: ++.IP "\[ci]" 4 ++\fBdebug\fR: While supported, this is a no\-op at present\. ++.IP "\[ci]" 4 ++\fBconfig=\fR\fI/path/to/file\fR: Override the default config for the module\. The unspecified default value for this file is \fB/etc/security/capability\.conf\fR\. Note, \fBconfig=/dev/null\fR is a valid value\. See \fBdefault=\fR below for situations in which this might be appropriate\. ++.IP "\[ci]" 4 ++\fBkeepcaps\fR: This is as much as the \fBpam_cap\.so\fR module can do to help an application support use of the \fIAmbient\fR capability vector\. The application support for the \fIAmbient\fR set is poor at the present time\. ++.IP "\[ci]" 4 ++\fBautoauth\fR: This argument causes the \fBpam_cap\.so\fR module to return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR being authenticated exists\. The absence of this argument will cause \fBpam_cap\.so\fR to only return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR is covered by a specific rule in the prevailing config file\. ++.IP "\[ci]" 4 ++\fBdefault=\fR\fIIAB\fR: This argument is ignored if the prevailing configuration file contains a "\fB*\fR" rule\. If there is no such rule, the \fIIAB\fR 3\-tuple is inserted at the end of the config file and applies to all \fBPAM_USER\fRs not covered by an earlier rule\. Note, if you want all \fBPAM_USER\fRs to be covered by this default rule, you can supply the module argument \fBconfig=/dev/null\fR\. ++.IP "\[ci]" 4 ++\fBdefer\fR: This argument arranges for the \fIIAB\fR capabilities granted to a user to be added sufficiently late in the Linux\-PAM authentication stack that they stick\. That is, \fIafter\fR the application does its \fBsetuid(UID)\fR call\. As such, in conjunction with the \fBkeepcaps\fR module argument, such compliant applications can support granting \fIAmbient\fR vector capabilities with \fBpam_cap\.so\fR\. ++.IP "" 0 ++.SH "SEE ALSO" ++pam\.conf(5), capability\.conf(5), pam(8) +-- +2.44.0 + diff --git a/libcap.spec b/libcap.spec index b8ab0a9..8c248a6 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -8,6 +8,7 @@ License: BSD-3-Clause OR GPL-2.0-only Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc +Patch0: 0001-doc-document-pam_cap-and-its-conf.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -84,7 +85,8 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %{_libdir}/libpsx.so.2{,.*} %{_sbindir}/{capsh,getcap,getpcaps,setcap} %{_mandir}/man1/capsh.1* -%{_mandir}/man8/{getcap,getpcaps,setcap}.8* +%{_mandir}/man5/capability.conf.5* +%{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8* %{_libdir}/security/pam_cap.so %exclude %{_mandir}/man8/captree.8* @@ -112,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Wed Apr 03 2024 Carlos Rodriguez-Fernandez - 2.69-5 +- Add manpages for pam_cap and capability.conf + * Sun Feb 11 2024 Maxwell G - 2.69-4 - Rebuild for golang 1.22.0 diff --git a/tests/manpages/test.sh b/tests/manpages/test.sh index f9b20ac..db05935 100755 --- a/tests/manpages/test.sh +++ b/tests/manpages/test.sh @@ -5,9 +5,11 @@ expected_manpages=( 'capsh(1)' 'libcap(3)' # there are many more but if these are present then it verifies it because of the glob install 'libpsx(3)' + 'capability.conf(5)' 'getcap(8)' 'getpcaps(8)' 'setcap(8)' + 'pam_cap(8)' ) rlJournalStart From ea9717d27dd8ea5e1d934fcd4602a1e5f267cd2d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Thu, 4 Apr 2024 20:32:51 -0700 Subject: [PATCH 02/26] Fix incompatibility of the build with go 1.22. --- libcap.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libcap.spec b/libcap.spec index 8c248a6..7979446 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -63,15 +63,15 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags=-linkmode=external" all +%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags=-linkmode=external" +%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" -mkdir -p %{buildroot}/%{_mandir}/man{2,3,8} +mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ chmod +x %{buildroot}/%{_libdir}/*.so.* @@ -114,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Thu Apr 04 2024 Carlos Rodriguez-Fernandez - 2.69-6 +- Fix incompatibility of the build with go 1.22. + * Wed Apr 03 2024 Carlos Rodriguez-Fernandez - 2.69-5 - Add manpages for pam_cap and capability.conf From d21909866942e731bbe765d8778c76dcbb415806 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Wed, 3 Apr 2024 12:16:45 -0700 Subject: [PATCH 03/26] Add manpages for pam_cap and capability.conf --- 0001-doc-document-pam_cap-and-its-conf.patch | 179 +++++++++++++++++++ libcap.spec | 9 +- tests/manpages/test.sh | 2 + 3 files changed, 188 insertions(+), 2 deletions(-) create mode 100644 0001-doc-document-pam_cap-and-its-conf.patch diff --git a/0001-doc-document-pam_cap-and-its-conf.patch b/0001-doc-document-pam_cap-and-its-conf.patch new file mode 100644 index 0000000..c87afb3 --- /dev/null +++ b/0001-doc-document-pam_cap-and-its-conf.patch @@ -0,0 +1,179 @@ +From 7787f4019a86b962ef3b44305cde5888a14cfe52 Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Wed, 3 Apr 2024 11:57:14 -0700 +Subject: [PATCH] doc: document pam_cap and its conf + +Signed-off-by: Carlos Rodriguez-Fernandez +--- + doc/Makefile | 8 ++-- + doc/capability.conf.5 | 85 +++++++++++++++++++++++++++++++++++++++++++ + doc/pam_cap.8 | 35 ++++++++++++++++++ + 3 files changed, 125 insertions(+), 3 deletions(-) + create mode 100644 doc/capability.conf.5 + create mode 100644 doc/pam_cap.8 + +diff --git a/doc/Makefile b/doc/Makefile +index 6919488..9d1574c 100644 +--- a/doc/Makefile ++++ b/doc/Makefile +@@ -32,9 +32,10 @@ MAN3S = cap_init.3 cap_free.3 cap_dup.3 \ + psx_syscall.3 psx_syscall3.3 psx_syscall6.3 psx_set_sensitivity.3 \ + psx_load_syscalls.3 __psx_syscall.3 \ + libpsx.3 +-MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 ++MAN5S = capability.conf.5 ++MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 pam_cap.8 + +-MANS = $(MAN1S) $(MAN3S) $(MAN8S) ++MANS = $(MAN1S) $(MAN3S) $(MAN5S) $(MAN8S) + + all: $(MANS) + +@@ -54,10 +55,11 @@ html: + done + + install: +- mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man8 ++ mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man5 $(FAKEROOT)$(MANDIR)/man8 + for man in \ + $(FAKEROOT)$(MANDIR)/man1 $(MAN1S) \ + $(FAKEROOT)$(MANDIR)/man3 $(MAN3S) \ ++ $(FAKEROOT)$(MANDIR)/man5 $(MAN5S) \ + $(FAKEROOT)$(MANDIR)/man8 $(MAN8S) \ + ; \ + do \ +diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 +new file mode 100644 +index 0000000..10ff63b +--- /dev/null ++++ b/doc/capability.conf.5 +@@ -0,0 +1,85 @@ ++.\" generated with Ronn-NG/v0.9.1 ++.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 ++.TH "CAPABILITY\.CONF" "5" "April 2024" "" ++.SH "NAME" ++\fBcapability\.conf\fR \- pam_cap module configuration file ++.SH "SYNOPSIS" ++\fB/etc/security/capability\.conf\fR ++.SH "DESCRIPTION" ++The syntax for lines in this configuration file is: ++.P ++\fB# <\-\- \'#\' precedes a comment\fR ++.P ++\fB\fR ++.P ++Where \fB\fR refers to the text format for an inheritable IAB capability tuple, or the words \fBall\fR or \fBnone\fR\. ++.P ++The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. ++.P ++Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. ++.P ++The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. ++.P ++Examples of valid syntax are: ++.IP "" 4 ++.nf ++# only root gets to keep what it had ++ ++all root ++ ++ ++# this should fire for user beta only, who will have ++ ++# cap_chown dropped from their bounding set\. ++ ++!cap_chown beta ++ ++ ++# the next one should snag the members of the \'three\' group ++ ++# granting them cap_setuid and cap_chown ++ ++cap_setuid,cap_chown @three ++ ++ ++# this would apply to beta and gamma, but beta is already ++ ++# granted a lack of cap_chown above\. Further, if gamma is ++ ++# in the \'three\' group, it would not reach this line\. ++ ++cap_chown beta gamma ++ ++ ++# members of the \'one\' group are granted the cap_setuid Inheritable ++ ++# capability, but cap_chown is dropped from their bounding set\. ++ ++!cap_chown,cap_setuid @one ++ ++ ++# user alpha gets an ambient capability (unless it is also ++ ++# a member of the groups \'one\' or \'three\')\. ++ ++^cap_setuid alpha ++ ++ ++# user delta (if not a member of groups \'one\' and \'three\') will get ++ ++# cap_chown and cap_setgid Ambient capabilities, but have cap_setuid ++ ++# dropped from its bounding set\. ++ ++^cap_chown,^cap_setgid,!cap_setuid delta ++ ++ ++# any remaining members of group \'four\' will get the cap_setuid ++ ++# Inheritable capability\. ++ ++cap_setuid @four ++.fi ++.IP "" 0 ++.SH "SEE ALSO" ++pam_cap(8) +diff --git a/doc/pam_cap.8 b/doc/pam_cap.8 +new file mode 100644 +index 0000000..93c1a71 +--- /dev/null ++++ b/doc/pam_cap.8 +@@ -0,0 +1,35 @@ ++.\" generated with Ronn-NG/v0.9.1 ++.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 ++.TH "PAM_CAP" "8" "April 2024" "" ++.SH "NAME" ++\fBpam_cap\fR \- Capabilities PAM module ++.SH "SYNOPSIS" ++[service\-name] \fBauth\fR control\-flag \fBpam_cap\fR [options] ++.SH "DESCRIPTION" ++The \fBpam_so\fR module can be used to specify \fIInheritable\fR capabilities to process trees rooted in the PAM application\. The module also supports blocking \fIBounding\fR vector capabilities and adding \fIAmbient\fR vector capabilities\. ++.P ++For general PAM apps to work correctly, the application must be run with at least \fBCAP_SETPCAP\fR raised in its \fIPermitted\fR capability flag\. Many PAM applications run as \fIroot\fR, which has all of the bits in the \fIBounding\fR set raised, so this requirement is typically met\. To grant an \fIAmbient\fR vector capability, the corresponding Permitted bit must be available to the application too\. ++.P ++The \fBpam_so\fR module is a Linux\-PAM \fIauth\fR module\. It provides functionality to back \fBpam_sm_authenticate()\fR and \fBpam_sm_setcred()\fR\. It is the latter that actually modifies the inheritable 3\-tuple of capability vectors: the configured \fIIAB\fR\. In a typical application configuration you might have a line like this: ++.IP "" 4 ++.nf ++auth optional pam_cap\.so ++.fi ++.IP "" 0 ++.P ++The module arguments are: ++.IP "\[ci]" 4 ++\fBdebug\fR: While supported, this is a no\-op at present\. ++.IP "\[ci]" 4 ++\fBconfig=\fR\fI/path/to/file\fR: Override the default config for the module\. The unspecified default value for this file is \fB/etc/security/capability\.conf\fR\. Note, \fBconfig=/dev/null\fR is a valid value\. See \fBdefault=\fR below for situations in which this might be appropriate\. ++.IP "\[ci]" 4 ++\fBkeepcaps\fR: This is as much as the \fBpam_cap\.so\fR module can do to help an application support use of the \fIAmbient\fR capability vector\. The application support for the \fIAmbient\fR set is poor at the present time\. ++.IP "\[ci]" 4 ++\fBautoauth\fR: This argument causes the \fBpam_cap\.so\fR module to return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR being authenticated exists\. The absence of this argument will cause \fBpam_cap\.so\fR to only return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR is covered by a specific rule in the prevailing config file\. ++.IP "\[ci]" 4 ++\fBdefault=\fR\fIIAB\fR: This argument is ignored if the prevailing configuration file contains a "\fB*\fR" rule\. If there is no such rule, the \fIIAB\fR 3\-tuple is inserted at the end of the config file and applies to all \fBPAM_USER\fRs not covered by an earlier rule\. Note, if you want all \fBPAM_USER\fRs to be covered by this default rule, you can supply the module argument \fBconfig=/dev/null\fR\. ++.IP "\[ci]" 4 ++\fBdefer\fR: This argument arranges for the \fIIAB\fR capabilities granted to a user to be added sufficiently late in the Linux\-PAM authentication stack that they stick\. That is, \fIafter\fR the application does its \fBsetuid(UID)\fR call\. As such, in conjunction with the \fBkeepcaps\fR module argument, such compliant applications can support granting \fIAmbient\fR vector capabilities with \fBpam_cap\.so\fR\. ++.IP "" 0 ++.SH "SEE ALSO" ++pam\.conf(5), capability\.conf(5), pam(8) +-- +2.44.0 + diff --git a/libcap.spec b/libcap.spec index b8ab0a9..8c248a6 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -8,6 +8,7 @@ License: BSD-3-Clause OR GPL-2.0-only Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc +Patch0: 0001-doc-document-pam_cap-and-its-conf.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -84,7 +85,8 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %{_libdir}/libpsx.so.2{,.*} %{_sbindir}/{capsh,getcap,getpcaps,setcap} %{_mandir}/man1/capsh.1* -%{_mandir}/man8/{getcap,getpcaps,setcap}.8* +%{_mandir}/man5/capability.conf.5* +%{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8* %{_libdir}/security/pam_cap.so %exclude %{_mandir}/man8/captree.8* @@ -112,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Wed Apr 03 2024 Carlos Rodriguez-Fernandez - 2.69-5 +- Add manpages for pam_cap and capability.conf + * Sun Feb 11 2024 Maxwell G - 2.69-4 - Rebuild for golang 1.22.0 diff --git a/tests/manpages/test.sh b/tests/manpages/test.sh index f9b20ac..db05935 100755 --- a/tests/manpages/test.sh +++ b/tests/manpages/test.sh @@ -5,9 +5,11 @@ expected_manpages=( 'capsh(1)' 'libcap(3)' # there are many more but if these are present then it verifies it because of the glob install 'libpsx(3)' + 'capability.conf(5)' 'getcap(8)' 'getpcaps(8)' 'setcap(8)' + 'pam_cap(8)' ) rlJournalStart From 9376ef2fc2a06e0fe6828a62c0465b4c2c0ea1d9 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Thu, 4 Apr 2024 20:32:51 -0700 Subject: [PATCH 04/26] Fix incompatibility of the build with go 1.22. --- libcap.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libcap.spec b/libcap.spec index 8c248a6..7979446 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -63,15 +63,15 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags=-linkmode=external" all +%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags=-linkmode=external" +%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" -mkdir -p %{buildroot}/%{_mandir}/man{2,3,8} +mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ chmod +x %{buildroot}/%{_libdir}/*.so.* @@ -114,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Thu Apr 04 2024 Carlos Rodriguez-Fernandez - 2.69-6 +- Fix incompatibility of the build with go 1.22. + * Wed Apr 03 2024 Carlos Rodriguez-Fernandez - 2.69-5 - Add manpages for pam_cap and capability.conf From 95e684ecd796d5e1de06fd04caba9465da53611b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 5 Apr 2024 12:18:03 -0700 Subject: [PATCH 05/26] reenable PIE in the captree tool --- libcap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libcap.spec b/libcap.spec index 7979446..5999f33 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -63,13 +63,13 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" all +%make_build prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" +%make_install prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ @@ -114,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-7 +- Reenable PIE in the captree tool + * Thu Apr 04 2024 Carlos Rodriguez-Fernandez - 2.69-6 - Fix incompatibility of the build with go 1.22. From ec001e0d308eb02bcfae24de2d71644ca8464d1e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 5 Apr 2024 16:46:04 -0700 Subject: [PATCH 06/26] make correction to the capability.conf manpage --- ...ent-the-use-of-to-refer-to-all-users.patch | 26 +++++++++++++++++++ libcap.spec | 6 ++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 0001-doc-document-the-use-of-to-refer-to-all-users.patch diff --git a/0001-doc-document-the-use-of-to-refer-to-all-users.patch b/0001-doc-document-the-use-of-to-refer-to-all-users.patch new file mode 100644 index 0000000..9741d75 --- /dev/null +++ b/0001-doc-document-the-use-of-to-refer-to-all-users.patch @@ -0,0 +1,26 @@ +From 70783bddc65628a1afc3dd2f8b4b3f03fc839b8e Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Fri, 5 Apr 2024 16:37:30 -0700 +Subject: [PATCH] doc: document the use of `*` to refer to all users + +Signed-off-by: Carlos Rodriguez-Fernandez +--- + doc/capability.conf.5 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 +index 10ff63b..15535f4 100644 +--- a/doc/capability.conf.5 ++++ b/doc/capability.conf.5 +@@ -16,7 +16,7 @@ Where \fB\fR refers to the text format for an inheritable IAB capability tu + .P + The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. + .P +-Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. ++Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. An asterisk "\fB*\fR" can be used to denote all users\. + .P + The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. + .P +-- +2.44.0 + diff --git a/libcap.spec b/libcap.spec index 5999f33..7955ee0 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -9,6 +9,7 @@ Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/lib Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc Patch0: 0001-doc-document-pam_cap-and-its-conf.patch +Patch1: 0001-doc-document-the-use-of-to-refer-to-all-users.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -114,6 +115,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-8 +- Make correction to the capability.conf manpage + * Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-7 - Reenable PIE in the captree tool From d105d70b42170c5c58354620d5cf8bb32e42ecd1 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 5 Apr 2024 12:18:03 -0700 Subject: [PATCH 07/26] reenable PIE in the captree tool --- libcap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libcap.spec b/libcap.spec index 7979446..5999f33 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -63,13 +63,13 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" all +%make_build prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} GO_BUILD_FLAGS="-ldflags='-B gobuildid'" +%make_install prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ @@ -114,6 +114,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-7 +- Reenable PIE in the captree tool + * Thu Apr 04 2024 Carlos Rodriguez-Fernandez - 2.69-6 - Fix incompatibility of the build with go 1.22. From deb9345a8c0ca3d04788bee9c72d384a9ca4edb6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 5 Apr 2024 16:46:04 -0700 Subject: [PATCH 08/26] make correction to the capability.conf manpage --- ...ent-the-use-of-to-refer-to-all-users.patch | 26 +++++++++++++++++++ libcap.spec | 6 ++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 0001-doc-document-the-use-of-to-refer-to-all-users.patch diff --git a/0001-doc-document-the-use-of-to-refer-to-all-users.patch b/0001-doc-document-the-use-of-to-refer-to-all-users.patch new file mode 100644 index 0000000..9741d75 --- /dev/null +++ b/0001-doc-document-the-use-of-to-refer-to-all-users.patch @@ -0,0 +1,26 @@ +From 70783bddc65628a1afc3dd2f8b4b3f03fc839b8e Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Fri, 5 Apr 2024 16:37:30 -0700 +Subject: [PATCH] doc: document the use of `*` to refer to all users + +Signed-off-by: Carlos Rodriguez-Fernandez +--- + doc/capability.conf.5 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 +index 10ff63b..15535f4 100644 +--- a/doc/capability.conf.5 ++++ b/doc/capability.conf.5 +@@ -16,7 +16,7 @@ Where \fB\fR refers to the text format for an inheritable IAB capability tu + .P + The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. + .P +-Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. ++Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. An asterisk "\fB*\fR" can be used to denote all users\. + .P + The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. + .P +-- +2.44.0 + diff --git a/libcap.spec b/libcap.spec index 5999f33..7955ee0 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.69 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -9,6 +9,7 @@ Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/lib Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc Patch0: 0001-doc-document-pam_cap-and-its-conf.patch +Patch1: 0001-doc-document-the-use-of-to-refer-to-all-users.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -114,6 +115,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-8 +- Make correction to the capability.conf manpage + * Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-7 - Reenable PIE in the captree tool From 6b8df4ed5f78c311ddab1d491c2a30e21adab503 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Apr 2024 14:53:22 +0200 Subject: [PATCH 09/26] Actually use the sbindir location provided by rpm /usr/sbin was always used, which breaks build with https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, because then %_sbindir in %files doesn't match the file locations. --- libcap.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libcap.spec b/libcap.spec index 7955ee0..866f59f 100644 --- a/libcap.spec +++ b/libcap.spec @@ -64,13 +64,13 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all +%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" +%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ From bac8f5e536522c838b97ea5ace202eca058e9b1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 14 Apr 2024 15:31:35 +0200 Subject: [PATCH 10/26] Add compat sbin Provides In preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. dwarftherapist requires /usr/sbin/setcap. --- libcap.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libcap.spec b/libcap.spec index 866f59f..29bc5b8 100644 --- a/libcap.spec +++ b/libcap.spec @@ -20,6 +20,13 @@ BuildRequires: gnupg2 BuildRequires: golang >= 1.11 %endif +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/setcap +%endif + %description libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. From 4521e03315ce8d995f83db54ec74fdccda12a84a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Sun, 14 Apr 2024 21:28:04 -0700 Subject: [PATCH 11/26] fix golang version dependency --- libcap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 7955ee0..641742c 100644 --- a/libcap.spec +++ b/libcap.spec @@ -17,7 +17,7 @@ BuildRequires: glibc-static BuildRequires: gnupg2 %ifarch %{golang_arches} -BuildRequires: golang >= 1.11 +BuildRequires: golang >= 1.22 %endif %description From 98e4da842f0c46f88a28c0dab8d222eaccfd433d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Sun, 14 Apr 2024 21:28:04 -0700 Subject: [PATCH 12/26] fix golang version dependency --- libcap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 29bc5b8..a46c131 100644 --- a/libcap.spec +++ b/libcap.spec @@ -17,7 +17,7 @@ BuildRequires: glibc-static BuildRequires: gnupg2 %ifarch %{golang_arches} -BuildRequires: golang >= 1.11 +BuildRequires: golang >= 1.22 %endif %if "%{_sbindir}" == "%{_bindir}" From 120b640485cb29646adcd7d06d7caad2110875ce Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Mon, 20 May 2024 08:31:30 -0700 Subject: [PATCH 13/26] update to 2.70 --- 0001-doc-document-pam_cap-and-its-conf.patch | 179 ------------------ ...ent-the-use-of-to-refer-to-all-users.patch | 26 --- libcap.spec | 9 +- sources | 4 +- 4 files changed, 7 insertions(+), 211 deletions(-) delete mode 100644 0001-doc-document-pam_cap-and-its-conf.patch delete mode 100644 0001-doc-document-the-use-of-to-refer-to-all-users.patch diff --git a/0001-doc-document-pam_cap-and-its-conf.patch b/0001-doc-document-pam_cap-and-its-conf.patch deleted file mode 100644 index c87afb3..0000000 --- a/0001-doc-document-pam_cap-and-its-conf.patch +++ /dev/null @@ -1,179 +0,0 @@ -From 7787f4019a86b962ef3b44305cde5888a14cfe52 Mon Sep 17 00:00:00 2001 -From: Carlos Rodriguez-Fernandez -Date: Wed, 3 Apr 2024 11:57:14 -0700 -Subject: [PATCH] doc: document pam_cap and its conf - -Signed-off-by: Carlos Rodriguez-Fernandez ---- - doc/Makefile | 8 ++-- - doc/capability.conf.5 | 85 +++++++++++++++++++++++++++++++++++++++++++ - doc/pam_cap.8 | 35 ++++++++++++++++++ - 3 files changed, 125 insertions(+), 3 deletions(-) - create mode 100644 doc/capability.conf.5 - create mode 100644 doc/pam_cap.8 - -diff --git a/doc/Makefile b/doc/Makefile -index 6919488..9d1574c 100644 ---- a/doc/Makefile -+++ b/doc/Makefile -@@ -32,9 +32,10 @@ MAN3S = cap_init.3 cap_free.3 cap_dup.3 \ - psx_syscall.3 psx_syscall3.3 psx_syscall6.3 psx_set_sensitivity.3 \ - psx_load_syscalls.3 __psx_syscall.3 \ - libpsx.3 --MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 -+MAN5S = capability.conf.5 -+MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 pam_cap.8 - --MANS = $(MAN1S) $(MAN3S) $(MAN8S) -+MANS = $(MAN1S) $(MAN3S) $(MAN5S) $(MAN8S) - - all: $(MANS) - -@@ -54,10 +55,11 @@ html: - done - - install: -- mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man8 -+ mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man5 $(FAKEROOT)$(MANDIR)/man8 - for man in \ - $(FAKEROOT)$(MANDIR)/man1 $(MAN1S) \ - $(FAKEROOT)$(MANDIR)/man3 $(MAN3S) \ -+ $(FAKEROOT)$(MANDIR)/man5 $(MAN5S) \ - $(FAKEROOT)$(MANDIR)/man8 $(MAN8S) \ - ; \ - do \ -diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 -new file mode 100644 -index 0000000..10ff63b ---- /dev/null -+++ b/doc/capability.conf.5 -@@ -0,0 +1,85 @@ -+.\" generated with Ronn-NG/v0.9.1 -+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -+.TH "CAPABILITY\.CONF" "5" "April 2024" "" -+.SH "NAME" -+\fBcapability\.conf\fR \- pam_cap module configuration file -+.SH "SYNOPSIS" -+\fB/etc/security/capability\.conf\fR -+.SH "DESCRIPTION" -+The syntax for lines in this configuration file is: -+.P -+\fB# <\-\- \'#\' precedes a comment\fR -+.P -+\fB\fR -+.P -+Where \fB\fR refers to the text format for an inheritable IAB capability tuple, or the words \fBall\fR or \fBnone\fR\. -+.P -+The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. -+.P -+Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. -+.P -+The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. -+.P -+Examples of valid syntax are: -+.IP "" 4 -+.nf -+# only root gets to keep what it had -+ -+all root -+ -+ -+# this should fire for user beta only, who will have -+ -+# cap_chown dropped from their bounding set\. -+ -+!cap_chown beta -+ -+ -+# the next one should snag the members of the \'three\' group -+ -+# granting them cap_setuid and cap_chown -+ -+cap_setuid,cap_chown @three -+ -+ -+# this would apply to beta and gamma, but beta is already -+ -+# granted a lack of cap_chown above\. Further, if gamma is -+ -+# in the \'three\' group, it would not reach this line\. -+ -+cap_chown beta gamma -+ -+ -+# members of the \'one\' group are granted the cap_setuid Inheritable -+ -+# capability, but cap_chown is dropped from their bounding set\. -+ -+!cap_chown,cap_setuid @one -+ -+ -+# user alpha gets an ambient capability (unless it is also -+ -+# a member of the groups \'one\' or \'three\')\. -+ -+^cap_setuid alpha -+ -+ -+# user delta (if not a member of groups \'one\' and \'three\') will get -+ -+# cap_chown and cap_setgid Ambient capabilities, but have cap_setuid -+ -+# dropped from its bounding set\. -+ -+^cap_chown,^cap_setgid,!cap_setuid delta -+ -+ -+# any remaining members of group \'four\' will get the cap_setuid -+ -+# Inheritable capability\. -+ -+cap_setuid @four -+.fi -+.IP "" 0 -+.SH "SEE ALSO" -+pam_cap(8) -diff --git a/doc/pam_cap.8 b/doc/pam_cap.8 -new file mode 100644 -index 0000000..93c1a71 ---- /dev/null -+++ b/doc/pam_cap.8 -@@ -0,0 +1,35 @@ -+.\" generated with Ronn-NG/v0.9.1 -+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -+.TH "PAM_CAP" "8" "April 2024" "" -+.SH "NAME" -+\fBpam_cap\fR \- Capabilities PAM module -+.SH "SYNOPSIS" -+[service\-name] \fBauth\fR control\-flag \fBpam_cap\fR [options] -+.SH "DESCRIPTION" -+The \fBpam_so\fR module can be used to specify \fIInheritable\fR capabilities to process trees rooted in the PAM application\. The module also supports blocking \fIBounding\fR vector capabilities and adding \fIAmbient\fR vector capabilities\. -+.P -+For general PAM apps to work correctly, the application must be run with at least \fBCAP_SETPCAP\fR raised in its \fIPermitted\fR capability flag\. Many PAM applications run as \fIroot\fR, which has all of the bits in the \fIBounding\fR set raised, so this requirement is typically met\. To grant an \fIAmbient\fR vector capability, the corresponding Permitted bit must be available to the application too\. -+.P -+The \fBpam_so\fR module is a Linux\-PAM \fIauth\fR module\. It provides functionality to back \fBpam_sm_authenticate()\fR and \fBpam_sm_setcred()\fR\. It is the latter that actually modifies the inheritable 3\-tuple of capability vectors: the configured \fIIAB\fR\. In a typical application configuration you might have a line like this: -+.IP "" 4 -+.nf -+auth optional pam_cap\.so -+.fi -+.IP "" 0 -+.P -+The module arguments are: -+.IP "\[ci]" 4 -+\fBdebug\fR: While supported, this is a no\-op at present\. -+.IP "\[ci]" 4 -+\fBconfig=\fR\fI/path/to/file\fR: Override the default config for the module\. The unspecified default value for this file is \fB/etc/security/capability\.conf\fR\. Note, \fBconfig=/dev/null\fR is a valid value\. See \fBdefault=\fR below for situations in which this might be appropriate\. -+.IP "\[ci]" 4 -+\fBkeepcaps\fR: This is as much as the \fBpam_cap\.so\fR module can do to help an application support use of the \fIAmbient\fR capability vector\. The application support for the \fIAmbient\fR set is poor at the present time\. -+.IP "\[ci]" 4 -+\fBautoauth\fR: This argument causes the \fBpam_cap\.so\fR module to return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR being authenticated exists\. The absence of this argument will cause \fBpam_cap\.so\fR to only return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR is covered by a specific rule in the prevailing config file\. -+.IP "\[ci]" 4 -+\fBdefault=\fR\fIIAB\fR: This argument is ignored if the prevailing configuration file contains a "\fB*\fR" rule\. If there is no such rule, the \fIIAB\fR 3\-tuple is inserted at the end of the config file and applies to all \fBPAM_USER\fRs not covered by an earlier rule\. Note, if you want all \fBPAM_USER\fRs to be covered by this default rule, you can supply the module argument \fBconfig=/dev/null\fR\. -+.IP "\[ci]" 4 -+\fBdefer\fR: This argument arranges for the \fIIAB\fR capabilities granted to a user to be added sufficiently late in the Linux\-PAM authentication stack that they stick\. That is, \fIafter\fR the application does its \fBsetuid(UID)\fR call\. As such, in conjunction with the \fBkeepcaps\fR module argument, such compliant applications can support granting \fIAmbient\fR vector capabilities with \fBpam_cap\.so\fR\. -+.IP "" 0 -+.SH "SEE ALSO" -+pam\.conf(5), capability\.conf(5), pam(8) --- -2.44.0 - diff --git a/0001-doc-document-the-use-of-to-refer-to-all-users.patch b/0001-doc-document-the-use-of-to-refer-to-all-users.patch deleted file mode 100644 index 9741d75..0000000 --- a/0001-doc-document-the-use-of-to-refer-to-all-users.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 70783bddc65628a1afc3dd2f8b4b3f03fc839b8e Mon Sep 17 00:00:00 2001 -From: Carlos Rodriguez-Fernandez -Date: Fri, 5 Apr 2024 16:37:30 -0700 -Subject: [PATCH] doc: document the use of `*` to refer to all users - -Signed-off-by: Carlos Rodriguez-Fernandez ---- - doc/capability.conf.5 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/doc/capability.conf.5 b/doc/capability.conf.5 -index 10ff63b..15535f4 100644 ---- a/doc/capability.conf.5 -+++ b/doc/capability.conf.5 -@@ -16,7 +16,7 @@ Where \fB\fR refers to the text format for an inheritable IAB capability tu - .P - The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\. - .P --Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. -+Here \fB\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. An asterisk "\fB*\fR" can be used to denote all users\. - .P - The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\. - .P --- -2.44.0 - diff --git a/libcap.spec b/libcap.spec index a46c131..0eb2b94 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap -Version: 2.69 -Release: 8%{?dist} +Version: 2.70 +Release: 1%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -8,8 +8,6 @@ License: BSD-3-Clause OR GPL-2.0-only Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc -Patch0: 0001-doc-document-pam_cap-and-its-conf.patch -Patch1: 0001-doc-document-the-use-of-to-refer-to-all-users.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -122,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Mon May 20 2024 Carlos Rodriguez-Fernandez - 2.70-1 +- Update to version 2.70 + * Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-8 - Make correction to the capability.conf manpage diff --git a/sources b/sources index 7857c6f..62713c8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libcap-2.69.tar.gz) = 75ee0fe8e1ac835f29cb76d233f731dcf126b73eed5229a130bbe4308a42441934d4e9cefeaaab45f774de2ed6859c752fbbfb9908e792f2f9f3d0f841e01aee -SHA512 (libcap-2.69.tar.sign) = 00f323444463b020c999f6fab255a61bd719f8d0ec1b619352e4f1b13407acee9a8e176861e5b408f64a871dc4095c6a26af541c3a0d4efca364c2d4b3679d30 +SHA512 (libcap-2.70.tar.gz) = 2a4a5959958989e6a0d54ea795a706b0f12596778ac660b19b7b1479910af01b4d870111b060dac0b1cd4671b98d815ea5953cefd4edde1a0ba9efe22f897842 +SHA512 (libcap-2.70.tar.sign) = d8a7d631d74ecdfad731e5d36087d959f9279ed837b20ed57bb518129f1ba6d144927987ca50a5459cc72d5374fe3a987583c1d5c88213e7f57f344ed698c71f From f6cc8a0776fa090950252efd694805f6e4fefebb Mon Sep 17 00:00:00 2001 From: Anderson Toshiyuki Sasaki Date: Fri, 31 May 2024 16:51:56 +0200 Subject: [PATCH 14/26] Include CGO_CFLAGS and CGO_LDFLAGS in the make command Set the value of CGO_CFLAGS as the CFLAGS environment variable value and CGO_LDFLAGS as the LDFLAGS value as part of the make command. The goal is to include the hardening compilation flags when building the Go binaries with CGO enabled. Also add -compressdwarf=false to ldflags, make the build verbose by adding the options -v -x, and force rebuilding by adding the -a option. Signed-off-by: Anderson Toshiyuki Sasaki --- libcap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libcap.spec b/libcap.spec index 0eb2b94..d79e912 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.70 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -69,13 +69,13 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1 %build -%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all +%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -a -v -x -ldflags='-compressdwarf=false -B gobuildid'" all %check make test %install -%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" +%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -ldflags='-compressdwarf=false -B gobuildid'" mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Tue Jun 04 2024 Anderson Toshiyuki Sasaki - 2.70-2 +- Set CGO_CFLAGS=$CFLAGS and CGO_LDFLAGS=$LDFLAGS to build Go code + * Mon May 20 2024 Carlos Rodriguez-Fernandez - 2.70-1 - Update to version 2.70 From f165102918a33eee70f6f25b507599413ac763f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 13:29:27 +0200 Subject: [PATCH 15/26] Rebuilt for the bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index d79e912..99aba72 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.70 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.70-3 +- Rebuilt for the bin-sbin merge + * Tue Jun 04 2024 Anderson Toshiyuki Sasaki - 2.70-2 - Set CGO_CFLAGS=$CFLAGS and CGO_LDFLAGS=$LDFLAGS to build Go code From ea30cbed1e2d40990b4cdb88ac103abe2047e37c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 13:27:58 +0000 Subject: [PATCH 16/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 99aba72..43a3e0c 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.70 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 2.70-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.70-3 - Rebuilt for the bin-sbin merge From 403c688803dbdfc057f2c88155e19dec2e70299a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Mon, 28 Oct 2024 17:34:47 -0700 Subject: [PATCH 17/26] update to 2.71 --- libcap.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/libcap.spec b/libcap.spec index 43a3e0c..edabdde 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap -Version: 2.70 -Release: 4%{?dist} +Version: 2.71 +Release: 1%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Mon Oct 28 2024 Carlos Rodriguez-Fernandez - 2.71-1 +- Update to version 2.71 + * Thu Jul 18 2024 Fedora Release Engineering - 2.70-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 62713c8..cd1d4df 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libcap-2.70.tar.gz) = 2a4a5959958989e6a0d54ea795a706b0f12596778ac660b19b7b1479910af01b4d870111b060dac0b1cd4671b98d815ea5953cefd4edde1a0ba9efe22f897842 -SHA512 (libcap-2.70.tar.sign) = d8a7d631d74ecdfad731e5d36087d959f9279ed837b20ed57bb518129f1ba6d144927987ca50a5459cc72d5374fe3a987583c1d5c88213e7f57f344ed698c71f +SHA512 (libcap-2.71.tar.gz) = 4ca378fda46a311cceaddede83be5300e40a81e8271ea5caa53ebd0f195b2cf70ba0751a58d22311715d8db773f601cf527201551359ed91704eee0fb3ca53e8 +SHA512 (libcap-2.71.tar.sign) = 1d03a41f5760a4fadad5301cc77ca02850d21158c3706cc921c42dde50541d0ad4abcde4ec208ef4f67045dc621aebdfb6755fc1048b5f97780127a7618eec2a From 4126e7676b42090f0e9263b38fa176641dde6b39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:33:14 +0100 Subject: [PATCH 18/26] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index edabdde..bfc4b89 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.71 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.71-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Mon Oct 28 2024 Carlos Rodriguez-Fernandez - 2.71-1 - Update to version 2.71 From 3f2c35c4b9ffe45d7ca8a7c88cd6b22f3bb57c9b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 10:46:02 +0000 Subject: [PATCH 19/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index bfc4b89..b5ad8d5 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.71 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 2.71-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.71-2 - Rebuilt for the bin-sbin merge (2nd attempt) From 607880c702b8f29eb62b8fec66a45a96f4917e7b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 24 Jan 2025 11:32:01 -0700 Subject: [PATCH 20/26] Update to 2.73 --- libcap.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/libcap.spec b/libcap.spec index b5ad8d5..b0da397 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap -Version: 2.71 -Release: 3%{?dist} +Version: 2.73 +Release: 1%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-1 +- Update to version 2.73 (rhbz#2340722) + * Fri Jan 17 2025 Fedora Release Engineering - 2.71-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index cd1d4df..ff42fc3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libcap-2.71.tar.gz) = 4ca378fda46a311cceaddede83be5300e40a81e8271ea5caa53ebd0f195b2cf70ba0751a58d22311715d8db773f601cf527201551359ed91704eee0fb3ca53e8 -SHA512 (libcap-2.71.tar.sign) = 1d03a41f5760a4fadad5301cc77ca02850d21158c3706cc921c42dde50541d0ad4abcde4ec208ef4f67045dc621aebdfb6755fc1048b5f97780127a7618eec2a +SHA512 (libcap-2.73.tar.gz) = 0311e2d955d1505eccd96a4b94d7153340d250c0b92be5b431e0f06759326d7d760e020bac92a8d46146782eaa99e1ef4a7576ac14d87571845174a929797c28 +SHA512 (libcap-2.73.tar.sign) = 2806018f3e6c145d558ac3623e3db8d453dec0cc837cf5710678ead5753865edf883d63915caff7fd174276ee76307c1f0bac0fd7058e5574a3525e88873eb2d From c0976890330a07be105a1df5708584839e2193dd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Fri, 24 Jan 2025 13:30:13 -0700 Subject: [PATCH 21/26] Update internal CI tests --- libcap.spec | 5 ++++- tests/pkg-configs/test.sh | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/libcap.spec b/libcap.spec index b0da397..6c0ebca 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.73 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -120,6 +120,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-2 +- Update internal CI tests + * Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-1 - Update to version 2.73 (rhbz#2340722) diff --git a/tests/pkg-configs/test.sh b/tests/pkg-configs/test.sh index 45f98a4..cc28259 100755 --- a/tests/pkg-configs/test.sh +++ b/tests/pkg-configs/test.sh @@ -26,7 +26,7 @@ rlJournalStart rlRun "rpm -ql libcap-devel | grep libpsx.pc" 0 "There must be libpsx.pc" if [ $? -eq 0 ]; then PCFILE=$(rpm -ql libcap-devel | grep libpsx.pc) - rlRun "pkg-config --libs libpsx | grep -- '-lpsx -lpthread -Wl,-wrap,pthread_create'" + rlRun "pkg-config --libs libpsx | grep -- '-lpsx'" VER=$(awk '/Version:/ { print $2 }' $PCFILE | tail -1) rlRun "pkg-config --modversion libpsx | grep $VER" rlRun -s "pkg-config --print-variables libpsx" From ecb8d1cb460374c3006583af3d4078d86752000d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Mon, 14 Apr 2025 22:14:24 -0700 Subject: [PATCH 22/26] Update to version 2.76 --- libcap.spec | 9 +++++++-- sources | 4 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/libcap.spec b/libcap.spec index 6c0ebca..87af783 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap -Version: 2.73 -Release: 2%{?dist} +Version: 2.76 +Release: 1%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -92,6 +92,7 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %{_sbindir}/{capsh,getcap,getpcaps,setcap} %{_mandir}/man1/capsh.1* %{_mandir}/man5/capability.conf.5* +%{_mandir}/man7/cap_text_formats.7* %{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8* %{_libdir}/security/pam_cap.so %exclude %{_mandir}/man8/captree.8* @@ -120,6 +121,10 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog + +* Mon Apr 14 2025 Carlos Rodriguez-Fernandez - 2.76-1 +- Update to version 2.76 (rhbz#2349318, rhbz#2352529) + * Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-2 - Update internal CI tests diff --git a/sources b/sources index ff42fc3..3859b1c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libcap-2.73.tar.gz) = 0311e2d955d1505eccd96a4b94d7153340d250c0b92be5b431e0f06759326d7d760e020bac92a8d46146782eaa99e1ef4a7576ac14d87571845174a929797c28 -SHA512 (libcap-2.73.tar.sign) = 2806018f3e6c145d558ac3623e3db8d453dec0cc837cf5710678ead5753865edf883d63915caff7fd174276ee76307c1f0bac0fd7058e5574a3525e88873eb2d +SHA512 (libcap-2.76.tar.gz) = 673ed11d46f0e7033f6094893f82e5a141be31fa23626e968b199baecf8f60b37a84248a826afc45a65851c1ce14ac25973ae982c8a3035823450259df4b4383 +SHA512 (libcap-2.76.tar.sign) = 277d64dc2e76ade6780e49d7fb4b8280cfabb1f4c2e553d97c0b35ae7fee8aafb660d8dd9962427525a2fd8111b019ff642448b4caa598afad736779f5f37520 From 2f86af5298c99109581e26220ef71a780d657ecd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 19:25:57 +0000 Subject: [PATCH 23/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 87af783..16a21c8 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.76 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -121,6 +121,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.76-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Apr 14 2025 Carlos Rodriguez-Fernandez - 2.76-1 - Update to version 2.76 (rhbz#2349318, rhbz#2352529) From 4f902f16663cf5bacfa59889d6721daea5183dd7 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 18:24:12 -0500 Subject: [PATCH 24/26] Rebuild for golang-1.25.0 --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 16a21c8..408c4d1 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.76 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -121,6 +121,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Aug 15 2025 Maxwell G - 2.76-3 +- Rebuild for golang-1.25.0 + * Thu Jul 24 2025 Fedora Release Engineering - 2.76-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 73dd02815788e408af9b5503457aff9c0887a539 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Fri, 10 Oct 2025 17:10:46 +0200 Subject: [PATCH 25/26] rebuild --- libcap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcap.spec b/libcap.spec index 408c4d1..0606c1e 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap Version: 2.76 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -121,6 +121,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Fri Oct 10 2025 Alejandro Sáez - 2.76-4 +- rebuild + * Fri Aug 15 2025 Maxwell G - 2.76-3 - Rebuild for golang-1.25.0 From d3979ba09dfa5020ce71a12147eec800295dc5ae Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez-Fernandez Date: Thu, 30 Oct 2025 16:31:38 -0700 Subject: [PATCH 26/26] Update to 2.77 --- _makenames-build.patch | 13 +++++++++++++ gating.yaml | 2 -- libcap.spec | 8 ++++++-- sources | 4 ++-- 4 files changed, 21 insertions(+), 6 deletions(-) create mode 100644 _makenames-build.patch diff --git a/_makenames-build.patch b/_makenames-build.patch new file mode 100644 index 0000000..460de75 --- /dev/null +++ b/_makenames-build.patch @@ -0,0 +1,13 @@ +diff --git a/libcap/Makefile b/libcap/Makefile +index f0eb87e..e90a950 100644 +--- a/libcap/Makefile ++++ b/libcap/Makefile +@@ -80,7 +80,7 @@ $(PSXTITLE).pc: $(PSXTITLE).pc.in + $< >$@ + + _makenames: _makenames.c cap_names.list.h +- $(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ $(BUILD_LDFLAGS) ++ $(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ + + cap_names.h: _makenames + ./_makenames > cap_names.h diff --git a/gating.yaml b/gating.yaml index fba44d0..3738107 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,7 +4,6 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} @@ -14,7 +13,6 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/libcap.spec b/libcap.spec index 0606c1e..3476fd1 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,6 +1,6 @@ Name: libcap -Version: 2.76 -Release: 4%{?dist} +Version: 2.77 +Release: 1%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ License: BSD-3-Clause OR GPL-2.0-only @@ -8,6 +8,7 @@ License: BSD-3-Clause OR GPL-2.0-only Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc +Patch0: _makenames-build.patch BuildRequires: pam-devel gcc BuildRequires: make @@ -121,6 +122,9 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %endif %changelog +* Tue Oct 28 2025 Carlos Rodriguez-Fernandez - 2.77-1 +- Update to version 2.77 (rhbz#2406446) + * Fri Oct 10 2025 Alejandro Sáez - 2.76-4 - rebuild diff --git a/sources b/sources index 3859b1c..3dbe9ea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libcap-2.76.tar.gz) = 673ed11d46f0e7033f6094893f82e5a141be31fa23626e968b199baecf8f60b37a84248a826afc45a65851c1ce14ac25973ae982c8a3035823450259df4b4383 -SHA512 (libcap-2.76.tar.sign) = 277d64dc2e76ade6780e49d7fb4b8280cfabb1f4c2e553d97c0b35ae7fee8aafb660d8dd9962427525a2fd8111b019ff642448b4caa598afad736779f5f37520 +SHA512 (libcap-2.77.tar.gz) = e5471afc4f149a8330e6df07effe58cac44d8a773b1fff0686e7039c41888e33402e1942fe5271a142e159a6088abbdbb7a82133389b3a9351749c2bf797b6b8 +SHA512 (libcap-2.77.tar.sign) = c362eefb80bbc110b7d7c676cc2b37e04bd3dab1b8b4577d62a0774b6300258743156c57102e8dc11c35d2ea876053dc57eae44197137273413b959df33ef0c0