I'm trying to add NET_ADMIN capability to an executable that needs to
create a tun inteface. AFACIT, this is the command to do that:
$ sudo setcap cap_net_admin+ep example_app
Failed to set capabilities on file `example_app' (Operation not supported)
The only possible cause for that message Google has been able fo find
is that the FS doesn't have xattr support.
On 2021-09-30, Grant Edwards <grant.b.edwards@gmail.com> wrote:
I'm trying to add NET_ADMIN capability to an executable that needs to
create a tun inteface. AFACIT, this is the command to do that:
$ sudo setcap cap_net_admin+ep example_app
Failed to set capabilities on file `example_app' (Operation not supported)
The only possible cause for that message Google has been able fo find
is that the FS doesn't have xattr support.
Is Posix ACL support required for setcap?
I can't find any documentation of such a requirement, but it's the
only other thing I can think of...
On 2021-09-30, Grant Edwards <grant.b.edwards@gmail.com> wrote:
On 2021-09-30, Grant Edwards <grant.b.edwards@gmail.com> wrote:
I'm trying to add NET_ADMIN capability to an executable that needs to
create a tun inteface. AFACIT, this is the command to do that:
$ sudo setcap cap_net_admin+ep example_app
Failed to set capabilities on file `example_app' (Operation not supported)
The only possible cause for that message Google has been able fo find
is that the FS doesn't have xattr support.
Is Posix ACL support required for setcap?
I can't find any documentation of such a requirement, but it's the
only other thing I can think of...
That's not it. I rebuilt my kernel with POSIX ACL support enabled for
ext4, rebooted, and verified that ACLs now work.
Still can't figure out how to get setcap to work
# file example_app
example_app: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped
# setcap cap_net_admin,cap_net_raw+eip example_app
Failed to set capabilities on file `example_app' (Operation not supported)
--
Grant
On 30/09/2021 13:58, Grant Edwards wrote:
Still can't figure out how to get setcap to work
Not sure if this is it, but do you have CONFIG_EXT4_FS_SECURITY enabled?
Doesn't it require xattrs?
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 285 |
Nodes: | 16 (2 / 14) |
Uptime: | 72:18:25 |
Calls: | 6,489 |
Calls today: | 2 |
Files: | 12,096 |
Messages: | 5,275,731 |