Re: [ptxdist] [PATCH v2] iputils: update s20121221 -> s20161105

[Clemens Gruber <clemens.gruber@pqgruber.com>]

Hi,

On Thu, Jan 26, 2017 at 11:47:11AM +0100, Marc Kleine-Budde wrote:
> On 01/26/2017 11:40 AM, Michael Olbrich wrote:
> > On Wed, Jan 25, 2017 at 07:41:42AM +0100, Uwe Kleine-König wrote:
> >> On Wed, Jan 25, 2017 at 12:13:59AM +0100, Clemens Gruber wrote:
> >>> The current version of iputils ping can handle IPv4 and IPv6 but
> >>> requires a crypto library dependency for ICMPv6 NI queries.
> >>> Add all possible choices: libgcrypt, nettle, openssl or none
> >>>
> >>> tracepath works with IPv4 as well as IPv6 and it does not have to run as
> >>> root.
> >>> traceroute6 only works with IPv6 and requires superuser privileges.
> >>
> >> on Debian traceroute6.iputils isn't setuid root and works for me. It has
> >> caps set however:
> >>
> >> 	$ ls -l /usr/bin/traceroute6.iputils
> >> 	-rwxr-xr-x 1 root root 18936 Nov 10 07:23 /usr/bin/traceroute6.iputils
> >>
> >> 	$ /sbin/getcap /usr/bin/traceroute6.iputils
> >> 	/usr/bin/traceroute6.iputils = cap_net_raw+ep
> >>
> >> Would that work here, too?
> > 
> > In theory yes, but I think our image generation tools cannot handle this.
> 
> mk2fs from e2fsprogs can generate images with extended attributed. I
> used it to build imagea with ima/evm attributes.

OK, but we should probably do this in a separate patch and maybe not
only for traceroute6 but for all binaries for which ptxdist currently sets
the setuid bit?
(ping in inetutils, mtr, pppd, gst-ptp-helper in gstreamer1, ..)

Thanks,
Clemens

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de