CentOS7 restoring file capabilities

Tags
advanced, capabilities, centos, file, os, solved

 
Thread Tools Search this Thread
# 1  
Old 11-09-2018
CentOS7 restoring file capabilities

Quite an obscure question I think.

We have a rebuild process for remote sites that allows us to PXE rebuild a till (actually a PC with a touch screen and various fancy bits) running CentOS. The current CentOS5 tills work just fine with a tar image restore and some personalisation. Sadly, CentOS7 introduces file capabilities on some critical stuff, such as ping so on the original source till, getcap /usr/bin/ping gives us this:-
Code:
# getcap /usr/bin/ping
/usr/bin/ping = cap_net_admin,cap_net_raw+p

After a tar and restore, these are lost, so ordinary users cannot use ping, which is a shame because the the till believes it cannot post the sales information to the central servers. The actual till software is proprietary, so we can't get into that to change it.

Does anyone know how to take a file and all it's file capabilities so that it can be restored?

An alternate would be to use yum or rpm to either list before or re-apply the required capabilities after the recovery, but I can't find a way to do that either of these. At worst, I might have to use getcap in a massive loop to collect them all then apply them manually after recovery, but I'd rather use the appropriate tools to do it properly.


Does anyone have any suggestions?



Many thanks, in advance,
Robin
# 2  
Old 11-10-2018
I would suggest using extra switch while using tar --xattrs

Perhaps even add the selinux and ACL options as well to avoid additional problems.

Regards
Peasant.
# 3  
Old 11-10-2018
Yes, we'd tried that without success. I hadn't considered the other file attributes options though. Sadly, it seems no better. A simple test just on CentOS7 gives me this:-
Code:
# tar -cvpzf - --xattrs --acl --selinux /usr/bin/ping | (cd /tmp;tar -xzvp --xattrs --acl --selinux  -f -)
tar: Removing leading `/' from member names
/usr/bin/ping
usr/bin/ping
# getcap -v /usr/bin/ping /tmp/usr/bin/ping
/usr/bin/ping = cap_net_admin,cap_net_raw+p
/tmp/usr/bin/ping

Am I doing something daft? At worst I've scanned all local files and collected the capabilities into a file that then is part of the tarball. On recovery I can apply them within my kickstart file. It's just more steps to wory about.

I have found that simply copying a file loses the capabilities, one has to cp --preserve=xattr source target Maybe I don't understand where these are stored. Maybe I don't need to know, just understand the rules I need to follow Smilie

I know I can achieve it with rsync but I can't neatly use that when doing a PXE recovery and I'd have to get the files out to all the remote locations individually too, which would be a nightmare.

I will keep digging. Any other suggestions to explore very welcome.



Kind regards,
Robin
# 4  
Old 11-11-2018
Give this a shot, i've tried it in KVM box with success.
Code:
[root@proxygw ~]# uname -a
Linux proxygw 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@proxygw ~]# cat /etc/redhat-release 
CentOS Linux release 7.5.1804 (Core) 
[root@proxygw ~]# getcap /usr/bin/ping
/usr/bin/ping = cap_net_admin,cap_net_raw+p
[root@proxygw ~]# cat rb.sh
tar --acl --selinux --anchored --xattrs --xattrs-include='security.capability' -cvpzf - /usr/bin/ping | ( cd /tmp && tar -xzvp --acl --selinux --anchored --xattrs --xattrs-include='security.capability' -f - )
[root@proxygw ~]# ./rb.sh
tar: Removing leading `/' from member names
/usr/bin/ping
usr/bin/ping
[root@proxygw ~]# getcap /usr/bin/ping /tmp/usr/bin/ping 
/usr/bin/ping = cap_net_admin,cap_net_raw+p
/tmp/usr/bin/ping = cap_net_admin,cap_net_raw+p

Hope that helps
Regards
Peasant.
These 2 Users Gave Thanks to Peasant For This Post:
Corona688 (11-26-2018) rbatte1 (11-26-2018)
# 5  
Old 11-23-2018
Hello Peasant,

Sorry for the delay, I've been in court for two weeks Smilie . Don't worry, it was only jury service Smilie

Yes! This works wonderfully. I've trimmed it down so finding that the necessary part was just --xattrs-include='security.capability' so I can now prove it with:-
Code:
# tar -cvpzf - --xattrs-include='security.capability' /usr/bin/ping | ( cd /tmp && tar -xzvp --xattrs-include='security.capability' -f - )
tar: Removing leading `/' from member names
/usr/bin/ping
usr/bin/ping

# getcap /tmp/usr/bin/ping
/tmp/usr/bin/ping = cap_net_admin,cap_net_raw+p

This command now works perfectly and I can incorporate it into our kickstart called recovery process with a minor adjustment to the procedure to build the image.

Fantastic.

One wonders why they create so many additional attributes for files and then the default doesn't recover them. I presume it is so that it you try to extract to a server that tar is not expecting them, you don't get horrible errors, but it is frustrating. Oh well Smilie


Thank you very much once again,
Robin
This User Gave Thanks to rbatte1 For This Post:
Corona688 (11-23-2018)

|
Thread Tools Search this Thread
Search this Thread:
Advanced Search

More UNIX and Linux Forum Topics You Might Find Helpful
Smb & nmb not starting at boot - CentOS7 momed131 UNIX for Advanced & Expert Users 2 02-22-2017 03:58 PM
Move NIS Server Solaris 10 to CentOS7 Penguin99 UNIX for Advanced & Expert Users 2 08-04-2016 02:53 AM
Restoring deleted file with rm -rf galford UNIX for Dummies Questions & Answers 5 04-12-2016 01:13 PM
CentOS7 systemd-timer shean Linux 2 01-21-2016 09:57 AM
Snmpd dying on centos7.1 shekar777 Red Hat 1 10-13-2015 11:26 AM
Restoring a file to its original location tastybrownies Shell Programming and Scripting 7 03-05-2013 04:07 PM
Issues restoring a large dump file Nobody_knows_me Red Hat 0 10-03-2012 03:45 PM
Restoring a Root File System that was on a metadevice feg Solaris 4 06-07-2011 01:38 PM
restoring file to its default location... AbhijitIT Shell Programming and Scripting 2 12-07-2009 12:15 AM
Restoring back a deleted file in unix. siba.s.nayak UNIX for Dummies Questions & Answers 1 12-11-2008 04:51 AM
Restoring a file zoolz Shell Programming and Scripting 4 11-11-2005 07:43 PM
Blocksize problem restoring file from tape citrowske UNIX for Dummies Questions & Answers 11 10-17-2005 05:22 PM
Restoring TAR'd file to different location FredSmith Solaris 1 10-03-2005 12:06 PM
Restoring a single file...??? Jonathan UNIX for Dummies Questions & Answers 1 05-08-2002 10:24 AM
Restoring a file from Tape mfischer UNIX for Dummies Questions & Answers 3 06-29-2001 04:57 AM