diff options
| author | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2010-04-26 14:55:46 -0700 |
|---|---|---|
| committer | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2010-04-26 14:55:46 -0700 |
| commit | 59cae244d055a7b5ba9de460d3ebbb5700d6ab17 (patch) | |
| tree | 7cfef113f521c527c762ca1073108180652382a7 | |
| parent | 5e55ab28a732d0082c803f1e473936a3d9c92f22 (diff) | |
| download | vyatta-cfg-system-59cae244d055a7b5ba9de460d3ebbb5700d6ab17.tar.gz vyatta-cfg-system-59cae244d055a7b5ba9de460d3ebbb5700d6ab17.zip | |
Set capabilities on standard utilities
This sets extended capablities on some common utilities
| -rw-r--r-- | debian/control | 1 | ||||
| -rw-r--r-- | debian/vyatta-cfg-system.postinst.in | 11 |
2 files changed, 12 insertions, 0 deletions
diff --git a/debian/control b/debian/control index c1d19a95..57fdb2c7 100644 --- a/debian/control +++ b/debian/control @@ -28,6 +28,7 @@ Depends: acpid, vyatta-keepalived (>= 1.1.15-1-vyatta-5), bridge-utils, ethtool, + libcap2-bin, ssh (>= 1:5.1p1-5), openssh-server (>= 1:5.1p1-5), ed, diff --git a/debian/vyatta-cfg-system.postinst.in b/debian/vyatta-cfg-system.postinst.in index b2719bc5..288ea7c5 100644 --- a/debian/vyatta-cfg-system.postinst.in +++ b/debian/vyatta-cfg-system.postinst.in @@ -154,6 +154,17 @@ dpkg-reconfigure -f noninteractive openssh-server rm -f /etc/ssh/*.broken update-rc.d -f ssh remove >/dev/null +# +# Set extended capabilities on some files +setcap cap_net_admin+e /usr/sbin/ethtool +setcap cap_sys_admin+e /sbin/sysctl +setcap cap_audit_write+e /bin/vbash +setcap cap_net_admin+e /sbin/ip +setcap cap_net_admin+e /sbin/tc cap_net_admin+e /sbin/ip +setcap cap_net_admin+e /usr/sbin/arp +setcap cap_net_admin+e /sbin/iptables cap_net_admin+e /sbin/ip6tables +setcap cap_net_admin+e /usr/sbin/conntrack + # Fix up PAM configuration for login so that invalid users are prompted # for password sed -i 's/requisite[ \t][ \t]*pam_securetty.so/required pam_securetty.so/' $rootfsdir/etc/pam.d/login |