Subject: [Pkg-cacti-maint] Bug#904332: Enable Linux capabilities support

From: Sven Hartge <[email-masked]>
Date: Mon, 23 Jul 2018 13:31:23 +0200

Package: cacti-spine
Version: 0.8.8a-1
Severity: normal

Hi!

Please enable support for Linux capabilities in spine.

This is useful so one can use the "ICMP Ping" uptime checker in spine
without needing to set spine setuid-root, just cap_net_raw is enough to
get this working.

Currently this is not enabled because libcap-dev is missing as
build-dependency.

An additional dependency on libcap2-bin is necessary to allow "setcap
cap_net_raw+ep /usr/sbin/spine" to work in postinst.

Grüße,
Sven.

-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'unstable'), (500, 'testing'), (200, 'experimental'), (1, 'experimental-debug')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 4.16.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages cacti-spine depends on:
pn  cacti                  <none>
ii  dbconfig-mysql         2.0.9
ii  debconf [debconf-2.0]  1.5.68
ii  libc6                  2.27-5
ii  libmariadbclient18     1:10.1.29-6+b1
ii  libsnmp30              5.7.3+dfsg-3
ii  ucf                    3.0038

cacti-spine recommends no packages.

Versions of packages cacti-spine suggests:
pn  snmp-mibs-downloader  <none>

---

From: Paul Gevers <[email-masked]>
Date: Tue, 24 Jul 2018 14:32:40 +0200

Hi Sven,

> Please enable support for Linux capabilities in spine.

Thanks for the suggestion.

> without needing to set spine setuid-root, just cap_net_raw is enough to

Sounds cool. I have zero knowledge of Linux capabilities though. Could
you provide a link to some good (for the noob) documentation on this?

> Currently this is not enabled because libcap-dev is missing as

Is that all that's needed?

> cap_net_raw+ep /usr/sbin/spine" to work in postinst.

Can you elaborate? I guess you mean the binary package needs that
dependency manually added by me. And I guess that I should add some code
to the postinst. Where should it go (or doesn't it matter)? Any
drawbacks of doing this for all systems?

Paul

---

From: Sven Hartge <[email-masked]>
Date: Tue, 24 Jul 2018 17:30:46 +0200

> Thanks for the suggestion.

Find the changes I suggest on Salsa here:
https://salsa.debian.org/hartge-guest/cacti-spine

I did a test build in a clean chroot for sid-amd64, the resulting
packages look correct from a quick glance.

Grüße,
Sven.

---

From: Sven Hartge <[email-masked]>
Date: Tue, 24 Jul 2018 17:14:44 +0200 (CEST)

> you provide a link to some good (for the noob) documentation on this?

As "usual" with core concepts in Linux, the documentation is a bit sparse.
A good starting point is capabilities(7).

TL,DR: capabilites allow non-privileged programs to do stuff normally only
root is allowed to do, for example use raw sockets or bind to ports <1024,
etc.

> Is that all that's needed?

For spine? Yes. When libcap-dev is present and "--enable-lcap" is passed
to configure, it will enable it.

Beware: libcap is a Linux-only thing, kFreeBSD/Hurd would need special handling, like:

ifeq ($(DEB_HOST_ARCH_OS),linux)
CONF_LCAP        += --enable-lcap
endif

override_dh_auto_configure::
        ./configure --host=$(DEB_HOST_GNU_TYPE) \
                       --build=$(DEB_BUILD_GNU_TYPE) \
                       --prefix=/usr \
                       --bindir=/usr/sbin \
                       $(CONF_LCAP) \
                       $(shell dpkg-buildflags --export=configure)

> drawbacks of doing this for all systems?

"libcap2-bin [linux-any]" has to be added manually, either as a hard Depends: or
Recommends:, there is not fancy debhelper automatism doing this.

iputils-ping does the latter and then checks in its postinst if setcap is
available:

,----
| if [ "$1" = configure ]; then
|     # If we have setcap is installed, try setting cap_net_raw+ep,
|     # which allows us to install our binaries without the setuid
|     # bit.
|     if command -v setcap > /dev/null; then
|         if setcap cap_net_raw+ep /bin/ping; then
|             chmod u-s /bin/ping
|         else
|             echo "Setcap failed on /bin/ping, falling back to setuid" >&2
|             chmod u+s /bin/ping
|         fi
|     else
|         echo "Setcap is not installed, falling back to setuid" >&2
|         chmod u+s /bin/ping
|     fi
| fi
`----

This approach would also work without changes for the !Linux archs out
there, if you decide to use a hard "Depends:".

You can of course skip the "chmod u+s" part, then without setcap present
spine would behave just like it does today.

I have build a local test-package without the postinst code to test if the
capabilities support for spine works as designed and confirm it working
correctly after manually setting cap_net_raw+ep.

Grüße,
Sven.

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Wed, 25 Jul 2018 13:39:04 +0000

Your message dated Wed, 25 Jul 2018 13:34:19 +0000
with message-id <[email-masked]>
and subject line Bug#904332: fixed in cacti-spine 1.1.37-2
has caused the Debian Bug report #904332,
regarding Enable Linux capabilities support
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
904332: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904332
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: Enable Linux capabilities support
From: Sven Hartge <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Mon, 23 Jul 2018 13:31:23 +0200

Package: cacti-spine
Version: 0.8.8a-1
Severity: normal

Hi!

Grüße,
Sven.

-- System Information:

Subject: Bug#904332: fixed in cacti-spine 1.1.37-2
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Wed, 25 Jul 2018 13:34:19 +0000

Source: cacti-spine
Source-Version: 1.1.37-2

We believe that the bug you reported is fixed in the latest version of
cacti-spine, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti-spine package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Wed, 25 Jul 2018 13:44:33 +0200
Source: cacti-spine
Binary: cacti-spine
Architecture: source
Version: 1.1.37-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti-spine - Multi-Threading poller for cacti
Closes: 904332
Changes:
 cacti-spine (1.1.37-2) unstable; urgency=medium
 .
   [ Sven Hartge ]
   * Enable usage of Linux capabilities (Closes: #904332)
 .
   [ Paul Gevers]
   * Update Vcs-* fields
Checksums-Sha1:
 23d633aa8bf0a8a5daab1225e2d145359d5e32f0 1689 cacti-spine_1.1.37-2.dsc
 c63a5632c7da13511b60aed3b395d466c4eb5715 14988 cacti-spine_1.1.37-2.debian.tar.xz
Checksums-Sha256:
 bad4de8a50b72ac92c89bc4be4efde51810f540426927b2affbfeab854798eb0 1689 cacti-spine_1.1.37-2.dsc
 4850e08a8764233ef6de973301002e5af543df6666a62a677e004f5afc9ed019 14988 cacti-spine_1.1.37-2.debian.tar.xz
Files:
 c6155d3c682030a3294905753064f097 1689 web optional cacti-spine_1.1.37-2.dsc
 49952b715bee486f45f1a8a967a6d8f4 14988 web optional cacti-spine_1.1.37-2.debian.tar.xz