Administrator/XenOrchestraInstallerUpdater-MIRROR
1
0
Fork 0
mirror of https://github.com/ronivay/XenOrchestraInstallerUpdater.git synced 2026-11-09 17:55:10 -06:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #371 from bnerickson/setcap_change

Browse Source 
Replace manual cap_net_bind_service setting with bounded capability setting in the systemd service file
This commit is contained in:
Roni Väyrynen
2026-10-07 10:12:10 +03:00
committed by GitHub
parent 7ac3798d96 6f9cab30d6
commit b309a5e4c7
1 changed files with 2 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
xo-install.sh
View File

@@ -324,14 +324,6 @@ function InstallDependenciesDeb {
printok "Installing libfuse2t64"
fi
# install setcap for non-root port binding if missing
if [[ -z $(runcmd_stdout "command -v setcap") ]]; then
echo
printprog "Installing setcap"
runcmd "apt-get install -y libcap2-bin"
printok "Installing setcap"
fi
# only run automated node install if executable not found
if [[ -z $(runcmd_stdout "command -v node") ]] || [[ -z $(runcmd_stdout "command -v npm") ]]; then
echo
@@ -756,21 +748,8 @@ function InstallXO {
runcmd "sed -i \"/SyslogIdentifier=.*/a User=$XOUSER\" $INSTALLDIR/xo-builds/xen-orchestra-$TIME/packages/xo-server/xo-server.service"
if [ "$PORT" -le "1024" ]; then
local NODEBINARY=$(runcmd_stdout "command -v node")
if [[ -L "$NODEBINARY" ]]; then
local NODEBINARY=$(runcmd_stdout "readlink -e $NODEBINARY")
fi
if [[ -n "$NODEBINARY" ]]; then
printprog "Attempting to set cap_net_bind_service permission for $NODEBINARY"
runcmd "setcap 'cap_net_bind_service=+ep' $NODEBINARY" && printok "Attempting to set cap_net_bind_service permission for $NODEBINARY" ||
{
printfail "Attempting to set cap_net_bind_service permission for $NODEBINARY"
echo " Non-privileged user might not be able to bind to <1024 port. xo-server won't start most likely"
}
else
printfail "Can't find node executable, or it's a symlink to non existing file. Not trying to setcap. xo-server won't start most likely"
fi
printinfo "Adding AmbientCapabilities to systemd config"
runcmd "sed -i \"/SyslogIdentifier=.*/a AmbientCapabilities=CAP_NET_BIND_SERVICE\" $INSTALLDIR/xo-builds/xen-orchestra-$TIME/packages/xo-server/xo-server.service"
fi
fi