Review Request 117125: start_kdeinit: Use capabilities instead of SUID
Alex Merry
alex.merry at kde.org
Thu Mar 27 20:38:57 UTC 2014
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/117125/#review54374
-----------------------------------------------------------
Can you have a look at the documentation about writing a CMake find module in extra-cmake-modules/docs?
In particular, it should be called FindLibcap, include the license directly (rather than in a separate file) and use imported targets.
- Alex Merry
On March 27, 2014, 7:57 p.m., Hrvoje Senjan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://git.reviewboard.kde.org/r/117125/
> -----------------------------------------------------------
>
> (Updated March 27, 2014, 7:57 p.m.)
>
>
> Review request for KDE Frameworks and David Faure.
>
>
> Bugs: https://bugzilla.novell.com/show_bug.cgi?id=862953
> https://bugs.kde.org/show_bug.cgi?id=https://bugzilla.novell.com/show_bug.cgi?id=862953
>
>
> Repository: kinit
>
>
> Description
> -------
>
> The issue came up on security review of kinit package (yes, same is valid for kdelibs4...)
> SUSE security team is not happy with kdeinit being SUID helper, thus capabilities are utilized first (if available)
> I've just tried to integrate the suggested patch (from the report) with the CMake bits
>
>
> Diffs
> -----
>
> CMakeLists.txt 335ed08
> cmake/COPYING-CMAKE-SCRIPTS PRE-CREATION
> cmake/FindCap.cmake PRE-CREATION
> src/config-kdeinit.h.cmake c89c713
> src/start_kdeinit/CMakeLists.txt 6bfc496
> src/start_kdeinit/start_kdeinit.c 3c733e7
>
> Diff: https://git.reviewboard.kde.org/r/117125/diff/
>
>
> Testing
> -------
>
> Built:
> with setcap & libcap present - installed as advertised;
> without one/both of them - the old procedure is in place (using SUID for the helper)
>
> I am not sure how to test the OOM killer, fortunately it never kicked in kdelibs4 variant, so can't also say did it work as planned before...
>
>
> Thanks,
>
> Hrvoje Senjan
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/kde-frameworks-devel/attachments/20140327/ffe91128/attachment.html>
More information about the Kde-frameworks-devel
mailing list