Arch Linux

conf/install-sh detection of root user capabilities fails. Setting rootflag=TRUE and removing detection of root capabilities seems to resolve the issue.
Edit:
As the sed call deletes lines it should be in prepare() instead of build() so it is only executed once.

There seems to be the same problem for K3B.

Of course, because k3b calls cdrecord as a process, so you run in the same error. If you change the permissions of cdrecord, k3b also keep working.

OK Thx, i forgot to set the rw right on cdrecord, can someone fix the package ?

It's not the rw-right, it's the suid bit.

Just issue as root a "chmod 4711 cdrecord" to set it (in fact change from 0711 to 4711).

However, I am waiting also for a package fix, since the diff has already been supplied a month ago.

Hello Maintainers,

When would you consider fixing this?

It seems the fix is attached. Nothing consuming to do. I cannot use sudo as the files created are owned by root. If you do not fix it, then provide some help how to use cdda2wav now seamlessly. I just hate setting suid manually on /usr/bin/cdda2wav.

Thx for your time.

Gábor

I don't understand, whats your point. Why are you hate to set the suid bit? It's the same behavior that the binaries in packagerelease 3.02a09-2 had. Or build your own package (as I did) using the attached patch, or downgrade to the previous version and pin it in pacman to prevent an upgrade. But in result it's all the same, it sets the suid bit.

Btw. it didn't work for me if I place the sed command as suggested in a prepare-section, and also not if I patch the install-sh directly, only sed in the build-section did it for me.

However, you can send a mail to Jerome to ask him, why he neither fix it with the attached patch, nor close the bug with a good reason. Actually we have the expression that nobody takes care of it.

But again, it does not really bother me since we have several working solutions for the problem.

I wanted to make the executables suid in the package, and not me making them suid manually after installing. Basically, it is a broken package.

I looked into this. Apparently some of the executables can run user content (not sure what). So libcap, which this depends on i.e. Linux Capabilities is a better way than suid. Indeed, when looking the source, it does use libcap, and it drops capabilities wheneven possible. So, I assume, when user content read and executed it is done with the least capabilities. Not sure what that "user content" might be, but this is superior to suid as the latter runs as root throughout. The source even tells us what "setcap" commands to run to make them usable. I clued myself up on Linux Capabilities, and, indeed, they make sense. Just "grep -r setcap" to find the commands.

Based on those I have made the attached patch and tested. I tested only cdda2wav as I have no CD to write, but this works like a charm.

I will ping Jerome to apply that.

@gabor_zoka not all file-systems support file caps, have you considered the approach used by shadow [1]? To setuid in the PKGBUILD then remove it in the .install if setcap succeeds.

[1] https://github.com/archlinux/svntogit-packages/blob/packages/shadow/trunk/shadow.install

I wanted to make the executables suid in the package, and not me making them suid manually after installing. Basically, it is a broken package.

I looked into this. Apparently some of the executables can run user content (not sure what). So libcap, which this depends on i.e. Linux Capabilities is a better way than suid. Indeed, when looking the source, it does use libcap, and it drops capabilities wheneven possible. So, I assume, when user content read and executed it is done with the least capabilities. Not sure what that "user content" might be, but this is superior to suid as the latter runs as root throughout. The source even tells us what "setcap" commands to run to make them usable. I clued myself up on Linux Capabilities, and, indeed, they make sense. Just "grep -r setcap" to find the commands.

Based on those I have made the attached patch and tested. I tested only cdda2wav as I have no CD to write, but this works like a charm.

I will ping Jerome to apply that.

@loqs

Good idea. Too late now, but at worst at the weekend I will prep another patch along those lines.

Thx!