diff mbox series

[2/3] rsyslog: add disabled PACKAGECONFIG to drop capabilities

Message ID 20230302002427.1935420-2-Randy.MacLeod@windriver.com
State Under Review
Headers show
Series [1/3] rsyslog: update from 8.2212.0 to 8.2302.0 | expand

Commit Message

Randy MacLeod March 2, 2023, 12:24 a.m. UTC
Add PACKAGECONFIG to enable dropping capabilities but leave it as disabled
to follow upstream and avoid a systemd issue described below.

rsyslog-8.2302 added a configure option to drop capabilities from
full to:
   chown, dac_override, setgid, setuid, setpcap, net_bind_service,
   net_admin, ipc_lock, sys_chroot, sys_admin, sys_resource, lease,
   syslog, block_suspend
This works fine and passes ptests with sysvinit however
there is a bug when using systemd that breaks some tests:
Therefore only add a non-default PACKAGECONFIG option in keeping
with the rsyslog upstream.

One can install libcap-ng-bin to run pscap to see the capabilities.

Without this option the ptest result with systemd as init is:
    Version | Passed | Failed | Skipped
     8.2302 | 473    |      0 |       3

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
 meta-oe/recipes-extended/rsyslog/rsyslog_8.2302.0.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series


diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2302.0.bb b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2302.0.bb
index 727e23111..39d9516d0 100644
--- a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2302.0.bb
+++ b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2302.0.bb
@@ -76,6 +76,8 @@  PACKAGECONFIG[mmjsonparse] = "--enable-mmjsonparse,--disable-mmjsonparse,"
 PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5,"
 PACKAGECONFIG[postgresql] = "--enable-pgsql,--disable-pgsql,postgresql,"
 PACKAGECONFIG[libdbi] = "--enable-libdbi,--disable-libdbi,libdbi,"
+# For libcap-ng, see commit log and  https://github.com/rsyslog/rsyslog/issues/5091
+PACKAGECONFIG[libcap-ng] = "--enable-libcap-ng,--disable-libcap-ng,libcap-ng,"
 PACKAGECONFIG[mail] = "--enable-mail,--disable-mail,,"
 PACKAGECONFIG[valgrind] = ",--without-valgrind-testbench,valgrind,"
 PACKAGECONFIG[imhttp] = "--enable-imhttp,--disable-imhttp,civetweb,"