Compare commits

...

2 Commits

Author SHA1 Message Date
ahmed sassi
3b8c6b965a test:PCI-45
Signed-off-by: ahmed sassi <ahmed.sassi_ext@softathome.com>
2025-02-28 15:18:51 +01:00
Petr Štetiar
d0cca925e7 libamxrt: fix libcap-ng issues on F2FS, JFFS2 and UBIFS based overlays
Commit 3dc4681f9b ("Integrating libamxp to master_v2.1.1") added
handling of subprocess capabilities via libcap-ng, which on targets
utilizing ext4 filesystem needs EXT4_FS_SECURITY kernel config symbol
enabled for proper support of extended filesystem attributes via
fsetxattr():

 amxp_subproc_start()
 `-amxp_subproc_vstart()
   `-amxp_subproc_exec_child()
     `-amxp_subproc_set_capabilities()
       `-capng_apply_caps_fd()
         `-fsetxattr()

 open("/usr/sbin/unbound", O_RDWR|O_LARGEFILE) = 3
 ...
 fsetxattr(3, "security.capability", "\1\0\0\2\0\0\0\0*$\0\200\0\0\0\0\0\0\0", 20, 0) = -1 EOPNOTSUPP (Not supported)

This failure then leads to missing CAP_NET_BIND_SERVICE capability and thus
unbound can't start:

 [1726337363] unbound[30984:0] error: can't bind socket: Permission denied for 0.0.0.0 port 53
 [1726337363] unbound[30984:0] error: can't bind socket: Permission denied for :: port 53
 [1726337363] unbound[30984:0] fatal error: could not open ports
 ...
 tr181-dns: dns     - [i]Started Unbound (1 times) - (start_unbound@modunbound_main.c:455)
 tr181-dns: dns     - [i]wait for wait:done - (start_unbound@modunbound_main.c:457)
 tr181-dns: dns     - [x]Unbound stopped! - (unbound_stopped@modunbound_main.c:373)

That was fixed in commit 995891f8ca ("libamxrt: fix libcap-ng issues
on ext4 by enabling EXT4_FS_SECURITY").

Lately it was found out, that on some targets, like RPI the same issue
appeared again. It was found out, that it was due to the fact, that RPI
is using f2fs based rootfs_data overlay, because procd/fstools creates
f2fs based rootfs_data overlays if the available storage space is bigger
then 100MiB, in other cases its going to use ext4 filesystem.

So lets fix it for good for all the targets supported by underlying
OpenWrt system, by selecting the corresponding KERNEL_*_FS_SECURITY
config symbols. Unfortunatelly for f2fs we can't use target's specific
USES_F2FS as its not available, but we could probably use mkf2fs for
that purpose as every target seems to include it, so it should work.

Cc: stable-3.1
Fixes: PCF-1456
References: PCF-1411, PPW-74
Fixes: 3dc4681f9b ("Integrating libamxp to master_v2.1.1")
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
(cherry picked from commit fcf51b9865)
2025-02-06 10:33:21 +01:00
2 changed files with 9 additions and 4 deletions

View File

@@ -4,10 +4,11 @@ PKG_NAME:=amxo-cg
PKG_VERSION:=v1.6.3
SHORT_DESCRIPTION:=Object Definition Language Compiler/Generator
PKG_SOURCE:=amxo-cg-v1.6.3.tar.gz
PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/components/ambiorix/applications/amxo-cg/-/archive/v1.6.3
PKG_HASH:=670d7e4958eb9d9ac209be4fb5c78607a3d485ff9bc5cd2f6cd98814f3643e6a
PKG_BUILD_DIR:=$(BUILD_DIR)/amxo-cg-v1.6.3
PKG_SOURCE_PROTO:=git
PKG_SOURCE_VERSION:=bugfix/PCI-45-align-mapping-bug
PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/components/ambiorix/applications/amxo-cg.git
PKG_MIRROR_HASH:=skip
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/$(PKG_VERSION)
PKG_MAINTAINER:=Soft At Home <support.opensource@softathome.com>
PKG_LICENSE:=BSD-2-Clause-Patent
PKG_LICENSE_FILES:=LICENSE

View File

@@ -9,6 +9,10 @@ menu "Select libamxrt build options"
config SAH_LIB_AMXRT
bool "Build libamxrt"
select KERNEL_EXT4_FS_SECURITY if USES_EXT4 || PACKAGE_kmod-fs-ext4
select KERNEL_JFFS2_FS_SECURITY if USES_JFFS2 || USES_JFFS2_NAND
select KERNEL_UBIFS_FS_SECURITY if USES_UBIFS
select KERNEL_F2FS_FS_SECURITY if PACKAGE_mkf2fs
default y
config SAH_AMXRT_RWDATAPATH