0

I'm trying to use the capabilities (CAP_SYS_TIME) but when I run this command:

setcap CAP_SYS_TIME+ep /user/mybinaryprogram

on my system, I get the following error:

Failed to set capabilities on file '/bin/date' (Invalid argument)
usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) 
<filenameN> ]
Note <filename> must be a regular (non-symlink) file.

My system: Linux t2080rdb 4.1.35-rt41 ppc64 GNU/Linux
I have obtained the linux image with Yocto Project SDK 2.0 Effectively when doing 'ls -la' in the bin directory, date appears as a symlink

According to the tests I have been doing I always get the same error when trying to do a setcap.

I solved the problem, the command did not work because the kernel did not have the 'Security Labels' enabled

  • please copy-paste the exact command you were using; the one from your question will cause a different error message. If you have the right permissions, you can set that cap with setcap CAP_SYS_TIME+ep /path/to/file. But setting that capability on /bin/date (or the real executable that's a symlink to) is a horrible idea; why do you want to do that? – mosvy Nov 6 '18 at 13:22
  • The exact command that I am trying to make is: set_cap CAP_SYS_TIME+ep /bin/date And the error is the one described in the question. What I want to do is that a restricted privilege user can use an application that uses the linux functions gettimeofday() and settimeofday(). Any suggestions on how to do it? – Sandra Nov 7 '18 at 8:42
  • [I assume that set_cap is setcap and not something else I don't know about] You cannot set that capability on a symlink, but on the real executable it points to; and letting everyone mess with the system time is a bad idea, so you should restrict who can run it. Example (untested): cp /bin/date /p/t/date; chgrp setdate /p/t/date; chmod 750 /p/t/date; setcap CAP_SYS_TIME+ep /p/t/date. But I really don't see the point of it; the time should not be user-modifiable; it should be set via ntp or some gps device or, as a last resort, asked when booting up. – mosvy Nov 7 '18 at 21:03
  • Notice that no privileges are needed to use gettimeofday(); everyone can use it. – mosvy Nov 7 '18 at 21:04
  • Yes, set_cap is setcap. The problem is that when I try to enable CAP_SYS_TIME on any regular file I always get the same error. I think it is a problem of the command or that in my system it is necessary to enable something to get enable capabilities. – Sandra Nov 9 '18 at 8:35
0

The command did not work because the kernel did not have the 'Security Labels' enabled. To install these modules in the kernel I have performed the command

$ bitbake -c menuconfig virtual / kernel

and I have navigated through the menu to enable

  • Ext2 extended attributes and * Ext2 Security Labels

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.