Add support for setting RPMTAG_FILECAPS header #166
Conversation
|
It would be great if we could fill out support for reading filecaps also, so that we can write functional tests for this. https://github.com/rpm-rs/rpm/blob/master/src/rpm/package.rs#L836 |
|
I haven't checked the behavior of RPM, but if it doesn't set FILECAPS if none were used in the specfile, we should probably avoid setting that tag if the user didn't provide any as well. If it always sets the FILECAPS tag, then this is fine. |
|
I've got these changes on a separate branch at the moment. My understanding of the behaviour here is that if not present then the header isn't added. |
|
Feel free to put it all in one PR, IMO it would be a bit cleaner particularly w/r/t testing. You can keep commits separate if you want. |
README.md
Outdated
| @@ -50,6 +50,7 @@ let pkg = rpm::PackageBuilder::new("test", "1.0.0", "MIT", "x86_64", "some aweso | |||
| // you can set a custom mode and custom user too | |||
| rpm::FileOptions::new("/etc/awesome/second.toml") | |||
| .mode(rpm::FileMode::regular(0o644)) | |||
| .caps("cap_sys_admin,cap_net_admin=pe") | |||
There was a problem hiding this comment.
Is there any validation that can or should be done here? (Genuinely a question)
There was a problem hiding this comment.
Looked into the options, RPM verifies by calling libcap's cap_from_text().
There are several crates providing this mechanism I've gone with capctl as it provides a FileCaps struct that will verify the string provided by a user. Erroring if the capability is invalid.
I then convert back to String for the writing of the header, hope that's an acceptable solution?
There was a problem hiding this comment.
@dsteeley FYI, I think I will make this into a feature (probably a default one but I'm not certain yet) to restore the ability to compile on Windows
dsteeley
force-pushed
the
add_capabilities
branch
from
cc184ba to
c741969
Compare
|
There are some test failures but apart from that I like the way this looks. Once that's addressed go ahead and squash it all into one commit (or I can do that when merging it, I suppose) |
|
Fixed up the test, my switch to use FileCaps causes the default capability (in the case where the header is added) to be |
dsteeley
force-pushed
the
add_capabilities
branch
from
1040ea8 to
644e93b
Compare
|
@dralley The failing job is an issue compiling time-macros on rust 1.65. |
You can just pin |
|
@dsteeley Are you looking for a release soon or is waiting a few weeks OK? And just out of curiosity, are you actively using (or considering) this for building RPMs at MS? |
Not in a rush, although I'd like to get this plumbed through cargo-generate-rpm at some point. We are already using this (via cargo-generate-rpm) to package rust binaries as rpms and then containerise using rpmoci. |
|
@dralley Are you planning to squash this or do you want me to combine into one commit? |
|
Nah I got it. |
|
@dsteeley Thanks! |
This change adds support for setting the RPMTAG_FILECAPS header to add capabilities to the files packaged in the rpm.
📜 Checklist
--all-featuresenabled