On 10/11/17 16:07, nicolas.mailhot(a)laposte.net wrote:
I'm building the prometheus blackbox exporter that needs the
CAP_NET_RAW capability to conduct ICMP probes (I don't want to run it as root)
I've done the naïve
setcap cap_net_raw+ep
/builddir/build/BUILDROOT/prometheus-blackbox-exporter-0.10.0-1.fc28.llt.x86_64/usr/bin/prometheus-blackbox-exporter
in the specfile, but that makes mock barf
unable to set CAP_SETFCAP effective capability: Operation not permitted
What is the correct way to handle this?
Set it in the file list with %cap as iputils does for ping etc:
https://src.fedoraproject.org/rpms/iputils/blob/master/f/iputils.spec#_142
Tom
--
Tom Hughes (tom(a)compton.nu)
http://compton.nu/