On Fri, Mar 29, 2013 at 01:38:39AM +0100, Tobias Grimm wrote:
> CAP_SYS_TIME is required to update the system time with the time
> from the DVB broadcasters. This behavior is optional, disabled by
> default and if setting the time fails, this just gets logged to the
> syslog.
Most systems should have some sort of ntp daemon installed, so updating
with a less acurate source is bad anyway. But okay.
> CAP_SYS_NICE is required to set the thread priority. I think VDR is
> correct here to exit with an error level if CAP_SYS_NICE is not
> available.
CAP_SYS_NICE is necessary to _higher_ the priority (aka lower the
niceness). I was not able to find any rlimit calls at all in the vdr
source.
> I'm not sure why CAP_NET_RAW is required. The only networking stuff
> happening is at the SVDRP interface.
CAP_NET_RAW is necessary to setup AF_RAW or AF_PACKET socket and set
some options that can be used to do nasty stuff. I see nothing in vdr
itself or the streamdev plugin.
> What do you suggest to solve this? Ignore CAP_SYS_TIME if it can't be set?
Right now I use the seccomp filter to filter away all prctl and setcap
syscalls. Nothing really fails, so at least in this setup none of the
capabilities are really needed. I use the streamdev-server plugin.
Bastian
--
There are always alternatives.
-- Spock, "The Galileo Seven", stardate 2822.3
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
