* [meta-gnome][PATCH] gnome-keyring: set file capabilities in pkg_postinst
@ 2021-03-08 13:53 dwagenknecht
2021-03-08 19:22 ` [oe] " Andreas Müller
0 siblings, 1 reply; 3+ messages in thread
From: dwagenknecht @ 2021-03-08 13:53 UTC (permalink / raw)
To: openembedded-devel; +Cc: Daniel Wagenknecht
file capabilities need to be set on gnome-keyring-daemon. This is now
possible using pkg_postinst function on the build host. Previous
workarounds are not needed anymore.
Signed-off-by: Daniel Wagenknecht <dwagenknecht@emlix.com>
---
.../recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
index 52c254b28..be6d922bc 100644
--- a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
+++ b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
@@ -43,9 +43,7 @@ FILES_${PN} += " \
${libdir}/pkcs11/gnome-keyring-pkcs11.so \
"
-# fix | gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
-# This does not make it through pseudo so perform on-target - sigh
-pkg_postinst_ontarget_${PN} () {
- setcap cap_ipc_lock+ep `which gnome-keyring-daemon`
+pkg_postinst_${PN} () {
+ setcap cap_ipc_lock+ep $D/${bindir}/gnome-keyring-daemon
}
-RDEPENDS_${PN} += "libcap-bin"
+PACKAGE_WRITE_DEPS += "libcap-native"
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [oe] [meta-gnome][PATCH] gnome-keyring: set file capabilities in pkg_postinst
2021-03-08 13:53 [meta-gnome][PATCH] gnome-keyring: set file capabilities in pkg_postinst dwagenknecht
@ 2021-03-08 19:22 ` Andreas Müller
2021-03-09 0:15 ` Khem Raj
0 siblings, 1 reply; 3+ messages in thread
From: Andreas Müller @ 2021-03-08 19:22 UTC (permalink / raw)
To: Daniel Wagenknecht; +Cc: openembeded-devel
On Mon, Mar 8, 2021 at 2:55 PM Daniel Wagenknecht
<dwagenknecht@emlix.com> wrote:
>
> file capabilities need to be set on gnome-keyring-daemon. This is now
> possible using pkg_postinst function on the build host. Previous
> workarounds are not needed anymore.
>
> Signed-off-by: Daniel Wagenknecht <dwagenknecht@emlix.com>
> ---
> .../recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> index 52c254b28..be6d922bc 100644
> --- a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> +++ b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> @@ -43,9 +43,7 @@ FILES_${PN} += " \
> ${libdir}/pkcs11/gnome-keyring-pkcs11.so \
> "
>
> -# fix | gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
^ Please leave this part of the comment - it is still valid and
explaining why setcap is necessary
> -# This does not make it through pseudo so perform on-target - sigh
> -pkg_postinst_ontarget_${PN} () {
> - setcap cap_ipc_lock+ep `which gnome-keyring-daemon`
> +pkg_postinst_${PN} () {
> + setcap cap_ipc_lock+ep $D/${bindir}/gnome-keyring-daemon
> }
> -RDEPENDS_${PN} += "libcap-bin"
> +PACKAGE_WRITE_DEPS += "libcap-native"
> --
Cheers
Andreas
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [oe] [meta-gnome][PATCH] gnome-keyring: set file capabilities in pkg_postinst
2021-03-08 19:22 ` [oe] " Andreas Müller
@ 2021-03-09 0:15 ` Khem Raj
0 siblings, 0 replies; 3+ messages in thread
From: Khem Raj @ 2021-03-09 0:15 UTC (permalink / raw)
To: Andreas Müller; +Cc: Daniel Wagenknecht, openembeded-devel
On Mon, Mar 8, 2021 at 11:23 AM Andreas Müller <schnitzeltony@gmail.com> wrote:
>
> On Mon, Mar 8, 2021 at 2:55 PM Daniel Wagenknecht
> <dwagenknecht@emlix.com> wrote:
> >
> > file capabilities need to be set on gnome-keyring-daemon. This is now
> > possible using pkg_postinst function on the build host. Previous
> > workarounds are not needed anymore.
> >
> > Signed-off-by: Daniel Wagenknecht <dwagenknecht@emlix.com>
> > ---
> > .../recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb | 8 +++-----
> > 1 file changed, 3 insertions(+), 5 deletions(-)
> >
> > diff --git a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> > index 52c254b28..be6d922bc 100644
> > --- a/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> > +++ b/meta-gnome/recipes-gnome/gnome-keyring/gnome-keyring_3.34.0.bb
> > @@ -43,9 +43,7 @@ FILES_${PN} += " \
> > ${libdir}/pkcs11/gnome-keyring-pkcs11.so \
> > "
> >
> > -# fix | gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
> ^ Please leave this part of the comment - it is still valid and
> explaining why setcap is necessary
right, since its a comment I have edited the patch and staged it in master-next.
> > -# This does not make it through pseudo so perform on-target - sigh
> > -pkg_postinst_ontarget_${PN} () {
> > - setcap cap_ipc_lock+ep `which gnome-keyring-daemon`
> > +pkg_postinst_${PN} () {
> > + setcap cap_ipc_lock+ep $D/${bindir}/gnome-keyring-daemon
> > }
> > -RDEPENDS_${PN} += "libcap-bin"
> > +PACKAGE_WRITE_DEPS += "libcap-native"
> > --
> Cheers
>
> Andreas
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-09 0:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-08 13:53 [meta-gnome][PATCH] gnome-keyring: set file capabilities in pkg_postinst dwagenknecht
2021-03-08 19:22 ` [oe] " Andreas Müller
2021-03-09 0:15 ` Khem Raj
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.