Bug 2126532
| Summary: | [RHEL 8.6] libcap does not correctly display the capabilities. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Ameya Patil <amepatil> |
| Component: | libcap | Assignee: | Anderson Sasaki <ansasaki> |
| Status: | CLOSED MIGRATED | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.4 | CC: | rsroka |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-30 15:05:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hello, I believe this was caused by a change in the output format introduced upstream in the commit 177cd418031b1acfcf73fe3b1af9f3279828681c [1]. If this is the case, this is not a bug but an intentional change. In the old format, what was: "= cap_foo+..." Is now in the new format: "cap_foo=..." This change was brought as part of the latest rebase to upstream version 2.48. [1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=177cd418031b1acfcf73fe3b1af9f3279828681c Moving to RHEL 9 as we do not plan to do any other non-critical bugfixes in RHEL8. Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. Users watching this BZ may not be automatically added to the Jira ticket. Be sure to add yourself to the Watchers field in the Jira issue if you desire to continue following this issue. |
Description of problem: In RHEL 8.6 with the new libcap-2.48-2 , the capabilities are not displayed correctly from what is set. When we assign capabilities to a binary file as per below where we set `+ep` , the getcap however returns the output as `=ep` Current output. ~~~ # setcap cap_dac_read_search,cap_sys_ptrace+ep /usr/bin/ls # getcap /usr/bin/ls /usr/bin/ls cap_dac_read_search,cap_sys_ptrace=ep ~~~ Expected output is supposed to be as below ~~~ # getcap /usr/bin/ls /usr/bin/ls cap_dac_read_search,cap_sys_ptrace+ep ~~~ We found that this issue is not seen with older version of libcap rpm i.e. `libcap-2.26-5.el8.x86_64` does not show this issue , while new version `libcap-2.48-2.el8.x86_64` does show this issue. What we see is that , if I set capabilities with setcap with the new rpm installed I will see the wrong capabilities displayed with getcap, however just downgrading rpm (without changing any capabilities with setcap) shows correct output in getcap. The same is true vice versa i.e. the capabilities which is showing correct with the older rpm, on upgrade of libcap (without changing any capabilities with setcap) , we get wrong output in getcap for the same binary. Due to this this feel like it is only an issue with how its displayed and not changing the actual capabilities because the filesystem attribute `security.capability` during the upgrade and downgrade of libcap for `/usr/bin/ls` is remaining the same. ~~~ # getfattr -m - --dump /usr/bin/ls getfattr: Removing leading '/' from absolute path names # file: usr/bin/ls security.capability=0sAQAAAgQACAAAAAAAAAAAAAAAAAA= security.selinux="system_u:object_r:bin_t:s0" ~~~ Version-Release number of selected component (if applicable): libcap-2.48-2.el8.x86_64 libcap-ng-0.7.11-1.el8.x86_64 libcap-devel-2.48-2.el8.x86_64 How reproducible: Everytime Steps to Reproduce: 1.No initial capabilities set ~~~ # getcap /usr/bin/ls >> (No output) ~~~ 2. Set the capabilities for "+ep" and verify that the command is successful. ~~~ # setcap cap_dac_read_search,cap_sys_ptrace+ep /usr/bin/ls # echo $? 0 ~~~ 3. We see that the getcap output show the capabilities as "=ep" ~~~ # getcap /usr/bin/ls /usr/bin/ls cap_dac_read_search,cap_sys_ptrace=ep ~~~ Actual results: We see capabilities display wrong with "=ep" ~~~ # getcap /usr/bin/ls /usr/bin/ls cap_dac_read_search,cap_sys_ptrace=ep ~~~ Expected results: We should see the "+ep" being display since we set it with setcap ~~~ # getcap /usr/bin/ls /usr/bin/ls = cap_dac_read_search,cap_sys_ptrace+ep ~~~ Additional info: