linux file capabilities with extensions

[yvs]

Hi everyone,

is there a way to set some (linux) capabilities on a file with squashfs?

a bit more: I've built some net utility from git source and wrapped it in .tcz extension. It's kind of ping/traceroute (a mtr fork) utility, so that it needs to work with raw sockets.
It can be usually achieved in three ways:
1) a most common way: setcap cap_net_raw=ep on binary to allow all users to work with pings
2) it's allowed to user apps without any extra capabilities by default kernel settings (sysctl net.ipv4.ping_group_range)
3) granted by setuid on binary

On TinyCoreLinux installation setcap works on a regular fs (setcap from libcap.tcz extension) and it looks like linux caps are not supported on squashfs (it works there only with setuid setting).
Is there only way with setuid if that's wrapped in an extension?

[curaga]

Yes, I believe suid only.

[patrikg]

When installing tcz files in tiny core you can make a script file that being executed when you install the extension, maybe you can use that to set the file to corresponding access rights.
https://wiki.tinycorelinux.net/doku.php?id=wiki:creating_extensions#adding_custom_startup_scripts

[yvs]

> When installing tcz files in tiny core you can make a script file that being executed when you install the extension
>
  thank you for suggestion, but there's no need in a postinstall script, tcz squashfs can keep extended attributtes itself, it was q about howto make FS support them

[yvs]

> Yes, I believe suid only.
>
   There's a workaround and kinda straightforward solution:
1) workaround: using an extension from a regular FS like

tc@box:~$ mkdir /home/tc/mtr085
tc@box:~$ sudo unsquashfs -x -dest /home/tc/mtr085 /mnt/sda1/tce/optional/mtr085.tcz
tc@box:~$ getcap /home/tc/mtr085/usr/local/sbin/mtr
/home/tc/mtr085/usr/local/sbin/mtr = cap_net_raw+ep

2) It took some time to get it work with mount tools:
  - build squashfs module with xattr support (CONFIG_SQUASHFS_XATTR=y)
  - repack core with built squasfs module from previous step (or just reload squashfs module on booted system)
  in result it allows to use std `tce-load` script to mount it, in my experiments it was like

tc@box:~$ tce-load -i mtr085
tc@box:~$ getcap /tmp/tcloop/mtr085/usr/local/sbin/mtr
/tmp/tcloop/mtr085/usr/local/sbin/mtr = cap_net_raw+ep

[yvs]

to complete this extended file attribute topic

xattr support in current releases by arch:
- x86: by default there's neither support in kernel module nor support in squashfs-tools (it works with rebuild)
- x86_64: by default there's no support in kernel module but already supported with squashfs-tools (need to rebuild squashfs module only)
- armv7l: support is already present in squashfs kernel module and in squashfs-tools as well