commit: 2e32af007cf8a21bd77002ca45c9bccc711a2bd0 Author: Mike Gilbert <floppym <AT> gentoo <DOT> org> AuthorDate: Thu Aug 7 18:16:03 2025 +0000 Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org> CommitDate: Thu Aug 14 16:27:44 2025 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2e32af00
fcaps.eclass: do not set suid bit as a fallback This behavior often catches devs by suprise, leading to unintended suid binaries. Pass -m u+s explicitly to maintain the previous behavior. Bug: https://bugs.gentoo.org/811105 Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org> eclass/fcaps.eclass | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/eclass/fcaps.eclass b/eclass/fcaps.eclass index 884b3c63c5f9..81c1ca62368c 100644 --- a/eclass/fcaps.eclass +++ b/eclass/fcaps.eclass @@ -84,13 +84,16 @@ esac # appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current # ebuild phase. # -# The caps mode (default 711) is used to set the permission on the file if -# capabilities were properly set on the file. +# The caps mode is used to set the permission on the file if capabilities +# were properly set on the file. No change is applied by default. # # If the system is unable to set capabilities, it will use the specified user, -# group, and mode (presumably to make the binary set*id). The defaults there -# are 0:0 and 4711. Otherwise, the ownership and permissions will be -# unchanged. +# group, and mode. The user and group default to 0. If mode is unspecified, no +# change is applied. +# +# For example, "-m u+s" may be used to enable suid as a fallback when file caps +# are unavailable. This should be used with care, typically when the +# application is written to handle dropping privileges itself. fcaps() { debug-print-function ${FUNCNAME} "$@" @@ -102,7 +105,7 @@ fcaps() { # Process the user options first. local owner='0' local group='0' - local mode=u+s + local mode= local caps_mode= while [[ $# -gt 0 ]] ; do @@ -181,11 +184,11 @@ fcaps() { fi # If we're still here, setcaps failed. - if [[ -n ${owner} || -n ${group} ]]; then - debug-print "${FUNCNAME}: setting owner on '${file}'" - chown "${owner}:${group}" "${file}" || die - fi if [[ -n ${mode} ]]; then + if [[ -n ${owner} || -n ${group} ]]; then + debug-print "${FUNCNAME}: setting owner on '${file}'" + chown "${owner}:${group}" "${file}" || die + fi debug-print "${FUNCNAME}: setting mode on '${file}'" chmod ${mode} "${file}" || die fi
