linux - yocto 的 Linux 功能

Question

我想给几个文件 Linux 功能（例如 CAP_NET_ADMIN）。我正在使用 Yocto，我的文件系统应该是只读的，并且在刷新软件后不得更改（这意味着通常无法使用带有 setcap 的 pkg_postinst）。

有没有其他方法可以在启动目标后不更改文件结构的情况下赋予文件功能？

Answer 1

pkg_postinst 脚本在构建只读 rootfs 时已经执行，因此这种方法有效。但是，您必须确保您在脚本中调用的命令在构建主机中可用，否则脚本的执行将失败并推迟到设备上的第一次启动。如何确保 setcap 命令可用取决于 Yocto 版本，这将在 Yocto 2.3 中更改。这是一个完整的示例配方：

LICENSE = "MIT"

do_install () {
    install -d ${D}/${bindir}
    touch ${D}/${bindir}/foobar
}

pkg_postinst_${PN} () {
    setcap cap_chown+e "$D/${bindir}/foobar"
}
# Dependency when installing on the target.
RDEPENDS_${PN} = "libcap"
# Dependency for rootfs construction, Yocto > 2.3.
PACKAGE_WRITE_DEPS = "libcap-native"
# Dependency for rootfs construction, Yocto <= 2.3 (untested).
# Enabling this makes builds slightly less efficient with
# Yocto > 2.3 because it implies that libcap-native is
# needed for building this recipe, which isn't the case.
# DEPENDS += "libcap-native"

小心保存 xattrs。默认的 .tar 图像格式会删除它们。从https://github.com/01org/meta-intel-iot-security/blob/master/meta-security-framework/classes/xattr-images.bbclass的顶部：

# xattr support is expected to be compiled into mtd-utils. We just need to
# use it.
EXTRA_IMAGECMD_jffs2_append = " --with-xattr"

# By default, OE-core uses tar from the host, which may or may not have the
# --xattrs parameter which was introduced in 1.27. For image building we
# use a recent enough tar instead.
#
# The GNU documentation does not specify whether --xattrs-include is necessary.
# In practice, it turned out to be not needed when creating archives and
# required when extracting, but it seems prudent to use it in both cases.
IMAGE_DEPENDS_tar_append = " tar-replacement-native"
EXTRANATIVEPATH += "tar-native"
IMAGE_CMD_TAR = "tar --xattrs --xattrs-include=*"

如果重要，请将其放入您的图像配方中。

Answer 2

最后我通过将 mtd-utils 更新为 mtd-utils-2.0.0 解决了这个问题（mkfs.ubifs 支持扩展属性）。

此外，我现在使用 IMAGE_PREPROCESS_COMMAND 在处理图像之前直接设置功能。