[yocto] Access Control List (ACL) permissions attributes not getting preserved in rootfs

[Kumar, Shrawan]

Hello Joshua,

We did not want bins like setfacl,setcap,chsmack  etc.. to be kept on target .

- wanted to understand "how does this postscript gets copied to target and at which path"?
-  I will have multiple recipe that will have this postscript to set respective packages bin's "acl" permissions and "smack" rules. Is it possible that after executing all the post script from   all the recipes , I shall be able to uninstall the acl and smack rpms ? Same applies for "setcap" rpms.

- Do you have near plan to fix these :) ?



Thanks and Regards
Shrawan

-----Original Message-----
From: Joshua G Lock [mailto:joshua.g.lock at linux.intel.com] 
Sent: Wednesday, August 17, 2016 1:22 AM
To: Kumar, Shrawan; yocto at yoctoproject.org
Subject: Re: [yocto] Access Control List (ACL) permissions attributes not getting preserved in rootfs

On Tue, 2016-08-16 at 11:55 +0000, Kumar, Shrawan wrote:
> Thanks Joshua,
> 
> "postinst"  works!!  I could see the attributes set under
> "poky/build_qemux86/tmp/work/qemux86-poky-linux/core-image-
> minimal/1.0-r0/rootfs/".
> 
>  However, I still could not see the attributes after booting qemu. It 
> seems during rootfs.ext4 (mkfs.ext4 command )creation when 
> "create_image_ext4.sh" is called , again this is getting   lost.
> 
> Any idea on this ?


I'm not sure why the attribute isn't preserved in the image, it could be a another missing piece for me to track in the quest to better support xattr.

There is a way to work around it, though — you can force the postinst to be run on the target at first boot, as documented in that same manual section. For example I have a test recipe with:

8<----snip--------

pkg_postinst_${PN}() {
    chown foo:foo $D${datadir}/xattrtest/xattrtest
    # Force setfacl to run on the target, not at image creation
    if [ x"$D" = "x" ]; then
        setfacl -m u:bar:r-- $D${datadir}/xattrtest/xattrtest
    else
        exit 1
    fi
}

USERADD_PACKAGES = "${PN}"
USERADD_PARAM_${PN} = "-m foo;-m bar"
RDEPENDS_${PN} += "acl"

8<----snip--------

which results in:

$ getfacl /usr/share/xattrtest/xattrtest
getfacl: Removing leading '/' from absolute path names # file /usr/share/xattrtest/xattrtest # owner: foo # group: foo
user::rw-
user:bar:r--
group::r--
mask::r--
other::r--

The downside here is that your image has to include postinst support and the acl package (per the RDEPENDS_${PN} line in the snippet above).

Regards,

Joshua

> 
> Regards
> Shrawan
> 
> 
> 
> 
> 
> -----Original Message-----
> From: Joshua G Lock [mailto:joshua.g.lock at linux.intel.com]
> Sent: Friday, August 12, 2016 7:22 PM
> To: Kumar, Shrawan; yocto at yoctoproject.org
> Subject: Re: [yocto] Access Control List (ACL) permissions attributes 
> not getting preserved in rootfs
> 
> On Fri, 2016-08-12 at 12:33 +0000, Kumar, Shrawan wrote:
> > 
> > Hello All,
> >  
> > I am  using  poky “ jethro”  , and  though  one of my recipe, I have 
> > created user1 & user2 and then trying to set ACL rules  on 
> > “helloworld” bin as below :
> >  
> >  
> > do_install() {
> >                     install -d ${D}${bindir}
> >                     install -m 0700 helloworld ${D}${bindir}
> >                     install -d ${D}/lib/systemd/system
> >                     install -m 0700 hello.service 
> > ${D}/lib/systemd/system/
> >                     chown    user1:group1 ${D}${bindir}/helloworld
> >                    setfacl -m u:user2:r-- ${D}${bindir}/helloworld }
> >  
> >  
> > è When I see   on the devshell ( bitbake HelloWorld –c devshell)  :
> > poky/build_qemux86/tmp/work/qemux86-poky-linux/core-image-
> > minimal/1.0-r0/rootfs/usr/bin# getfacl helloworld    , I could see 
> > that ACL permissions are set correctly as below :
> > -        # file: helloworld
> > -        # owner: user1
> > -        # group: group1
> > -        user::rwx
> > -        user:user2:r--
> > -        group::---
> > -        mask::r--
> > -        other::---
> >  
> > However, It does not seems to be getting preserved in rootfs. :
> > /poky/build_qemux86/tmp/work/qemux86-poky-linux/core-image-
> > minimal/1.0-r0/rootfs/usr/bin# getfacl helloworld # file:
> > helloworld #
> > owner: user1 # group: group1 user::rwx
> > group::---
> > other::---
> >  
> > quick help  here would be highly appreciated
> 
> This is due to the fact that we don't currently have a mechanism to 
> preserve xattr through to image construction[1].
> 
> The largest barrier for doig so is that the package managers 
> (certainly dpkg and rpm) don't have any support for xattrs in packages 
> (an image is populated via the package manager).
> 
> To the best of my knowledge the only option for adding some xattr/ACL 
> is to use a postinst[2] to set the attributes after the package has 
> been installed.
> 
> Regards,
> 
> Joshua
> 
> 1. https://bugzilla.yoctoproject.org/show_bug.cgi?id=9858
> 2. http://www.yoctoproject.org/docs/2.1/dev-manual/dev-manual.html#ne
> w-
> recipe-post-installation-scripts
>