commit:     2e32af007cf8a21bd77002ca45c9bccc711a2bd0
Author:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Thu Aug  7 18:16:03 2025 +0000
Commit:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Thu Aug 14 16:27:44 2025 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2e32af00

fcaps.eclass: do not set suid bit as a fallback

This behavior often catches devs by suprise, leading to unintended suid
binaries. Pass -m u+s explicitly to maintain the previous behavior.

Bug: https://bugs.gentoo.org/811105
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>

 eclass/fcaps.eclass | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/eclass/fcaps.eclass b/eclass/fcaps.eclass
index 884b3c63c5f9..81c1ca62368c 100644
--- a/eclass/fcaps.eclass
+++ b/eclass/fcaps.eclass
@@ -84,13 +84,16 @@ esac
 # appropriate path var ($D/$ROOT/etc...) will be prefixed based on the current
 # ebuild phase.
 #
-# The caps mode (default 711) is used to set the permission on the file if
-# capabilities were properly set on the file.
+# The caps mode is used to set the permission on the file if capabilities
+# were properly set on the file.  No change is applied by default.
 #
 # If the system is unable to set capabilities, it will use the specified user,
-# group, and mode (presumably to make the binary set*id).  The defaults there
-# are 0:0 and 4711.  Otherwise, the ownership and permissions will be
-# unchanged.
+# group, and mode.  The user and group default to 0.  If mode is unspecified, 
no
+# change is applied.
+#
+# For example, "-m u+s" may be used to enable suid as a fallback when file caps
+# are unavailable.  This should be used with care, typically when the
+# application is written to handle dropping privileges itself.
 fcaps() {
        debug-print-function ${FUNCNAME} "$@"
 
@@ -102,7 +105,7 @@ fcaps() {
        # Process the user options first.
        local owner='0'
        local group='0'
-       local mode=u+s
+       local mode=
        local caps_mode=
 
        while [[ $# -gt 0 ]] ; do
@@ -181,11 +184,11 @@ fcaps() {
                fi
 
                # If we're still here, setcaps failed.
-               if [[ -n ${owner} || -n ${group} ]]; then
-                       debug-print "${FUNCNAME}: setting owner on '${file}'"
-                       chown "${owner}:${group}" "${file}" || die
-               fi
                if [[ -n ${mode} ]]; then
+                       if [[ -n ${owner} || -n ${group} ]]; then
+                               debug-print "${FUNCNAME}: setting owner on 
'${file}'"
+                               chown "${owner}:${group}" "${file}" || die
+                       fi
                        debug-print "${FUNCNAME}: setting mode on '${file}'"
                        chmod ${mode} "${file}" || die
                fi

Reply via email to