Bug 2272034 - libcap RPM need to include an information about how to write capability.conf
Summary: libcap RPM need to include an information about how to write capability.conf
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libcap
Version: 40
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Carlos Rodriguez-Fernandez
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-03-28 10:31 UTC by masanari iida
Modified: 2024-06-14 00:47 UTC (History)
5 users (show)

Fixed In Version: libcap-2.69-8.fc40
Clone Of:
Environment:
Last Closed: 2024-04-19 21:30:42 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description masanari iida 2024-03-28 10:31:22 UTC
RPM: libcap-2.69-3.fc40.x86_64.rpm 

Currently, libcap RPM doesn't include an information about capability.conf,
and pam_cap.so module arguments.
So users don't understand what is the meaning of "^", "!" or "@",
or "keepcaps", "defer" and so on.

The upstream web page has such information.
https://sites.google.com/site/fullycapable/pam_cap-so

So my suggestion is libcap mainainer should add these information into
/usr/share/doc or  man page (such as capablity.conf or pam_cap.so)


As I see contents of libcap-devel RPM, these are information for developer.
What I expect is an information for admin user.


Reproducible: Always

Steps to Reproduce:
1. Install Fedora
2. rpm -ql libcap-2.69-3.fc40.x86_64.rpm 
Actual Results:  
Find inforamtion about how to write capability.conf or pam_cap.so.

Expected Results:  
No such document included in the RPM.

man page capabilities(7) does not include an information such as
what does "^", "!" or "@" mean. so this man page doesn't help.

Red Hat KB (https://access.redhat.com/solutions/1264083) 
it include information how to configure capability.conf.
But the Author only wrote an example without explain what is "^" 
or "keepcaps defer" in the KB.

Comment 1 Carlos Rodriguez-Fernandez 2024-03-28 15:54:10 UTC
Thank you masanari iida for the feedback. I'll be looking into this.

Comment 2 Andrew G. Morgan 2024-04-04 01:23:13 UTC
Patch applied upstream (will be included in libcap-2.70):

https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=caab6200d2420616604c4851b2b3a3065f07b447

Comment 3 Christian Horn 2024-04-04 08:38:30 UTC
Iida-san, are you ok with the changes in the commit?
If so, I will then work on requests into RHEL.

Comment 4 masanari iida 2024-04-04 11:28:28 UTC
One comment.
In KB#1264083, the KB author wrote following example.

# cat /etc/security/capability.conf 
^cap_net_raw,^cap_sys_nice      user1
none                            *

In capability.conf man page patch, it doesn't tell if we can use
astarisk in <WHO>. 

If It can use, add the information.

Comment 5 Carlos Rodriguez-Fernandez 2024-04-05 23:52:03 UTC
Thank you for catching that masanari iida. I'm providing a patch for that one as well.
The fix will be coming in Fedora 40.

Comment 6 Fedora Update System 2024-04-06 02:41:13 UTC
FEDORA-2024-fbfda3f679 (libcap-2.69-8.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-fbfda3f679

Comment 7 Fedora Update System 2024-04-07 02:12:05 UTC
FEDORA-2024-fbfda3f679 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-fbfda3f679`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-fbfda3f679

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 masanari iida 2024-04-08 01:48:55 UTC
Thanks for the additional patch (56ee609f672487cdc15b0df6004764bf46552f06).

Comment 9 Fedora Update System 2024-04-19 21:30:42 UTC
FEDORA-2024-fbfda3f679 (libcap-2.69-8.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Christian Horn 2024-06-14 00:47:22 UTC
Test, please ignore.


Note You need to log in before you can comment on or make changes to this bug.