[yocto] Set linux capabilities on binary on a recipe in meta-oe layer

[Uwe Geuder]

Hi!


On Fri, Nov 9, 2018 at 12:16 PM Markus W markus4dev-at-gmail.com wrote:

> On Thu, 8 Nov 2018 at 22:53, Piotr Tworek <tworaz666 at gmail.com> wrote:
...
>> pkg_postinst_ontarget_${PN} () {
>>    setcap cap_net_raw+eip $D${bindir}/node
>> }
...
> How can this be achieved when the rootfs is created and not on first
> boot? I would like not to ship libcap binaries with the target in
> production.

Ideally I would do it "locally" in do_install of the node recipe (you can
append extra statements to the task in your own .bbappend in your own
layer, don't edit existing recipes)

That of course requires that the package manager preserves the
capabilites. I have no experience which package manager would do
or not do that.

"Globally" you can do it by appending a new function to ROOTFS_POSTPROCESS_COMMAND

https://www.yoctoproject.org/docs/2.5.1/mega-manual/mega-manual.html#var-
ROOTFS_POSTPROCESS_COMMAND

This is done in your image recipe.

Regards,

Uwe Geuder
Neuro Event Labs Oy
Tampere, Finland
uwe.gexder at neuroeventlabs.com (Bot check: fix one obvious typo)