apps.plugin now runs with linux capabilites instead of setuid to root
Costa Tsaousis committed
May 14, 2016 at 00:10 UTC
06c43af4d934e0ae890af83076f9fe56243bfdf9
3 files changed
+235
-200
CMakeLists.txt
+2
@@ -57,6 +57,8 @@ set(NETDATA_SOURCE_FILES
57
src/proc_stat.c
58
src/proc_sys_kernel_random_entropy_avail.c
59
src/proc_vmstat.c
60
+ src/registry.c
61
+ src/registry.h
62
src/rrd2json.c
63
src/rrd2json.h
64
src/rrd.c
netdata-installer.sh
+227
-197
@@ -30,48 +30,48 @@ NETDATA_PREFIX=
30
ZLIB_IS_HERE=0
31
32
usage() {
33
- cat <<USAGE
33
+ cat <<-USAGE
34
35
-${ME} <installer options>
35
+ ${ME} <installer options>
36
37
-Valid <installer options> are:
37
+ Valid <installer options> are:
38
39
- --install /PATH/TO/INSTALL
39
+ --install /PATH/TO/INSTALL
40
41
- If your give: --install /opt
42
- netdata will be installed in /opt/netdata
41
+ If your give: --install /opt
42
+ netdata will be installed in /opt/netdata
43
44
- --dont-start-it
44
+ --dont-start-it
45
46
- Do not (re)start netdata.
47
- Just install it.
46
+ Do not (re)start netdata.
47
+ Just install it.
48
49
- --dont-wait
49
+ --dont-wait
50
51
- Do not wait for the user to press ENTER.
52
- Start immediately building it.
51
+ Do not wait for the user to press ENTER.
52
+ Start immediately building it.
53
54
- --zlib-is-really-here
54
+ --zlib-is-really-here
55
56
- If you get errors about missing zlib,
57
- but you know it is available,
58
- you have a broken pkg-config.
59
- Use this option to allow it continue
60
- without checking pkg-config.
56
+ If you get errors about missing zlib,
57
+ but you know it is available,
58
+ you have a broken pkg-config.
59
+ Use this option to allow it continue
60
+ without checking pkg-config.
61
62
-Netdata will by default be compiled with gcc optimization -O3
63
-If you need to pass different CFLAGS, use something like this:
62
+ Netdata will by default be compiled with gcc optimization -O3
63
+ If you need to pass different CFLAGS, use something like this:
64
65
- CFLAGS="<gcc options>" $ME <installer options>
65
+ CFLAGS="<gcc options>" ${ME} <installer options>
66
67
-For the installer to complete successfully, you will need
68
-these packages installed:
67
+ For the installer to complete successfully, you will need
68
+ these packages installed:
69
70
- gcc make autoconf automake pkg-config zlib1g-dev uuid-dev
70
+ gcc make autoconf automake pkg-config zlib1g-dev uuid-dev
71
72
-For the plugins, you will at least need:
72
+ For the plugins, you will at least need:
73
74
- curl node
74
+ curl nodejs
75
76
USAGE
77
}
@@ -107,26 +107,26 @@ do
107
fi
108
done
109
110
-cat <<BANNER
110
+cat <<-BANNER
111
112
-Welcome to netdata!
113
-Nice to see you are giving it a try!
112
+ Welcome to netdata!
113
+ Nice to see you are giving it a try!
114
115
-You are about to build and install netdata to your system.
115
+ You are about to build and install netdata to your system.
116
117
-It will be installed at these locations:
117
+ It will be installed at these locations:
118
119
- - the daemon at ${NETDATA_PREFIX}/usr/sbin/netdata
120
- - config files at ${NETDATA_PREFIX}/etc/netdata
121
- - web files at ${NETDATA_PREFIX}/usr/share/netdata
122
- - plugins at ${NETDATA_PREFIX}/usr/libexec/netdata
123
- - cache files at ${NETDATA_PREFIX}/var/cache/netdata
124
- - db files at ${NETDATA_PREFIX}/var/lib/netdata
125
- - log files at ${NETDATA_PREFIX}/var/log/netdata
126
- - pid file at ${NETDATA_PREFIX}/var/run
119
+ - the daemon at ${NETDATA_PREFIX}/usr/sbin/netdata
120
+ - config files at ${NETDATA_PREFIX}/etc/netdata
121
+ - web files at ${NETDATA_PREFIX}/usr/share/netdata
122
+ - plugins at ${NETDATA_PREFIX}/usr/libexec/netdata
123
+ - cache files at ${NETDATA_PREFIX}/var/cache/netdata
124
+ - db files at ${NETDATA_PREFIX}/var/lib/netdata
125
+ - log files at ${NETDATA_PREFIX}/var/log/netdata
126
+ - pid file at ${NETDATA_PREFIX}/var/run
127
128
-This installer allows you to change the installation path.
129
-Press Control-C and run the same command with --help for help.
128
+ This installer allows you to change the installation path.
129
+ Press Control-C and run the same command with --help for help.
130
131
BANNER
132
@@ -134,40 +134,40 @@ if [ "${UID}" -ne 0 ]
134
then
135
if [ -z "${NETDATA_PREFIX}" ]
136
then
137
- cat <<NONROOTNOPREFIX
137
+ cat <<-NONROOTNOPREFIX
138
139
-Sorry! This will fail!
139
+ Sorry! This will fail!
140
141
-You are attempting to install netdata as non-root, but you plan to install it
142
-in system paths.
141
+ You are attempting to install netdata as non-root, but you plan to install it
142
+ in system paths.
143
144
-Please set an installation prefix, like this:
144
+ Please set an installation prefix, like this:
145
146
- $0 ${@} --install /tmp
146
+ $0 ${@} --install /tmp
147
148
-or, run the installer as root:
148
+ or, run the installer as root:
149
150
- sudo $0 ${@}
150
+ sudo $0 ${@}
151
152
-We suggest to install it as root, or certain data collectors will not be able
153
-to work. Netdata drops root privileges when running. So, if you plan to keep
154
-it, install it as root to get the full functionality.
152
+ We suggest to install it as root, or certain data collectors will not be able
153
+ to work. Netdata drops root privileges when running. So, if you plan to keep
154
+ it, install it as root to get the full functionality.
155
156
NONROOTNOPREFIX
157
exit 1
158
159
else
160
- cat <<NONROOT
160
+ cat <<-NONROOT
161
162
-IMPORTANT:
163
-You are about to install netdata as a non-root user.
164
-Netdata will work, but a few data collection modules that
165
-require root access will fail.
162
+ IMPORTANT:
163
+ You are about to install netdata as a non-root user.
164
+ Netdata will work, but a few data collection modules that
165
+ require root access will fail.
166
167
-If you installing permanently on your system, run the
168
-installer like this:
167
+ If you installing permanently on your system, run the
168
+ installer like this:
169
170
- sudo $0 ${@}
170
+ sudo $0 ${@}
171
172
NONROOT
173
fi
@@ -208,22 +208,22 @@ then
208
else
209
cat <<-"EOF"
210
211
- -------------------------------------------------------------------------------
212
- autotools 2.60 or later is required
211
+ -------------------------------------------------------------------------------
212
+ autotools 2.60 or later is required
213
214
- Sorry, you do not seem to have autotools 2.60 or later, which is
215
- required to build from the git sources of netdata.
214
+ Sorry, you do not seem to have autotools 2.60 or later, which is
215
+ required to build from the git sources of netdata.
216
217
- You can either install a suitable version of autotools and automake
218
- or download a netdata package which does not have these dependencies.
217
+ You can either install a suitable version of autotools and automake
218
+ or download a netdata package which does not have these dependencies.
219
220
- Source packages where autotools have already been run are available
221
- here:
222
- https://firehol.org/download/netdata/
220
+ Source packages where autotools have already been run are available
221
+ here:
222
+ https://firehol.org/download/netdata/
223
224
- The unsigned/master folder tracks the head of the git tree and released
225
- packages are also available.
226
- EOF
224
+ The unsigned/master folder tracks the head of the git tree and released
225
+ packages are also available.
226
+EOF
227
exit 1
228
fi
229
fi
@@ -239,30 +239,30 @@ if [ ${DONOTWAIT} -eq 0 ]
239
fi
240
241
build_error() {
242
- cat <<EOF
242
+ cat <<-EOF
243
244
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
244
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
245
246
-Sorry! NetData failed to build...
246
+ Sorry! NetData failed to build...
247
248
-You many need to check these:
248
+ You many need to check these:
249
250
-1. The package zlib1g-dev has to be installed.
250
+ 1. The package uuid-dev has to be installed.
251
252
- If your system cannot find ZLIB, although it is installed
253
- run me with the option: --zlib-is-really-here
252
+ 2. The package zlib1g-dev has to be installed.
253
255
-2. The package uuid-dev has to be installed.
254
+ If your system cannot find ZLIB, although it is installed
255
+ run me with the option: --zlib-is-really-here
256
257
-3. You need basic build tools installed, like:
257
+ 3. You need basic build tools installed, like:
258
259
- gcc make autoconf automake pkg-config
259
+ gcc make autoconf automake pkg-config
260
261
- Autoconf version 2.60 or higher is required.
261
+ Autoconf version 2.60 or higher is required.
262
263
-If you still cannot get it to build, ask for help at github:
263
+ If you still cannot get it to build, ask for help at github:
264
265
- https://github.com/firehol/netdata/issues
265
+ https://github.com/firehol/netdata/issues
266
267
268
EOF
@@ -271,15 +271,28 @@ EOF
271
}
272
273
run() {
274
+ printf >>netdata-installer.log "# "
275
+ printf >>netdata-installer.log "%q " "${@}"
276
+ printf >>netdata-installer.log " ... "
277
+
278
printf >&2 "\n"
279
printf >&2 ":-----------------------------------------------------------------------------\n"
280
printf >&2 "Running command:\n"
281
printf >&2 "\n"
282
printf >&2 "%q " "${@}"
283
printf >&2 "\n"
280
- printf >&2 "\n"
284
285
"${@}"
286
+
287
+ local ret=$?
288
+ if [ ${ret} -ne 0 ]
289
+ then
290
+ printf >>netdata-installer.log "FAILED!\n"
291
+ else
292
+ printf >>netdata-installer.log "OK\n"
293
+ fi
294
+
295
+ return ${ret}
296
}
297
298
if [ ${ZLIB_IS_HERE} -eq 1 ]
@@ -452,9 +465,15 @@ done
465
466
if [ ${UID} -eq 0 ]
467
then
455
- # fix apps.plugin to be setuid to root
468
run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
457
- run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
469
+ run chmod 0755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
470
+ run setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
471
+ if [ $? -ne 0 ]
472
+ then
473
+ # fix apps.plugin to be setuid to root
474
+ run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
475
+ run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
476
+ fi
477
fi
478
479
# -----------------------------------------------------------------------------
@@ -487,6 +506,9 @@ isnetdata() {
506
}
507
508
509
+echo >&2
510
+echo >&2 "-------------------------------------------------------------------------------"
511
+echo >&2
512
printf >&2 "Stopping a (possibly) running netdata..."
513
ret=0
514
count=0
@@ -583,36 +605,36 @@ fi
605
# Check for KSM
606
607
ksm_is_available_but_disabled() {
586
- cat <<KSM1
608
+ cat <<-KSM1
609
588
--------------------------------------------------------------------------------
589
-Memory de-duplication instructions
610
+ -------------------------------------------------------------------------------
611
+ Memory de-duplication instructions
612
591
-I see you have kernel memory de-duper (called Kernel Same-page Merging,
592
-or KSM) available, but it is not currently enabled.
613
+ I see you have kernel memory de-duper (called Kernel Same-page Merging,
614
+ or KSM) available, but it is not currently enabled.
615
594
-To enable it run:
616
+ To enable it run:
617
596
-echo 1 >/sys/kernel/mm/ksm/run
597
-echo 1000 >/sys/kernel/mm/ksm/sleep_millisecs
618
+ echo 1 >/sys/kernel/mm/ksm/run
619
+ echo 1000 >/sys/kernel/mm/ksm/sleep_millisecs
620
599
-If you enable it, you will save 40-60% of netdata memory.
621
+ If you enable it, you will save 40-60% of netdata memory.
622
623
KSM1
624
}
625
626
ksm_is_not_available() {
605
- cat <<KSM2
627
+ cat <<-KSM2
628
607
--------------------------------------------------------------------------------
608
-Memory de-duplication not present in your kernel
629
+ -------------------------------------------------------------------------------
630
+ Memory de-duplication not present in your kernel
631
610
-It seems you do not have kernel memory de-duper (called Kernel Same-page
611
-Merging, or KSM) available.
632
+ It seems you do not have kernel memory de-duper (called Kernel Same-page
633
+ Merging, or KSM) available.
634
613
-To enable it, you need a kernel built with CONFIG_KSM=y
635
+ To enable it, you need a kernel built with CONFIG_KSM=y
636
615
-If you can have it, you will save 40-60% of netdata memory.
637
+ If you can have it, you will save 40-60% of netdata memory.
638
639
KSM2
640
}
@@ -632,18 +654,18 @@ fi
654
655
if [ ! -s web/version.txt ]
656
then
635
-cat <<VERMSG
657
+ cat <<-VERMSG
658
637
--------------------------------------------------------------------------------
638
-Version update check warning
659
+ -------------------------------------------------------------------------------
660
+ Version update check warning
661
640
-The way you downloaded netdata, we cannot find its version. This means the
641
-Update check on the dashboard, will not work.
662
+ The way you downloaded netdata, we cannot find its version. This means the
663
+ Update check on the dashboard, will not work.
664
643
-If you want to have version update check, please re-install it
644
-following the procedure in:
665
+ If you want to have version update check, please re-install it
666
+ following the procedure in:
667
646
-https://github.com/firehol/netdata/wiki/Installation
668
+ https://github.com/firehol/netdata/wiki/Installation
669
670
VERMSG
671
fi
@@ -653,23 +675,31 @@ fi
675
676
if [ "${UID}" -ne 0 ]
677
then
656
-cat <<SETUID_WARNING
678
+ cat <<-SETUID_WARNING
679
658
--------------------------------------------------------------------------------
659
-apps.plugin needs privileges
680
+ -------------------------------------------------------------------------------
681
+ apps.plugin needs privileges
682
+
683
+ Since you have installed netdata as a normal user, to have apps.plugin collect
684
+ all the needed data, you have to give it the access rights it needs, by running
685
+ either of the following sets of commands:
686
+
687
+ To run apps.plugin with escalated capabilities:
688
+
689
+ sudo chown root:${NETDATA_USER} "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
690
+ sudo chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
691
+ sudo setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
692
661
-Since you have installed netdata as a normal user, to have apps.plugin collect
662
-all the needed data, you have to give it the access rights it needs, by running
663
-these commands:
693
+ or, to run apps.plugin as root:
694
665
- sudo chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
666
- sudo chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
695
+ sudo chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
696
+ sudo chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
697
668
-The commands allow apps.plugin to run as root.
698
+ These commands allow apps.plugin to run as root.
699
670
-apps.plugin is performing a hard-coded function of data collection for all
671
-running processes. It cannot be instructed from the netdata daemon to perform
672
-any task, so it is pretty safe to do this.
700
+ apps.plugin is performing a hard-coded function of data collection for all
701
+ running processes. It cannot be instructed from the netdata daemon to perform
702
+ any task, so it is pretty safe to do this.
703
704
SETUID_WARNING
705
fi
@@ -677,80 +707,80 @@ fi
707
# -----------------------------------------------------------------------------
708
# Keep un-install info
709
680
-cat >netdata-uninstaller.sh <<UNINSTALL
681
-#!/bin/bash
710
+cat >netdata-uninstaller.sh <<-UNINSTALL
711
+ #!/bin/bash
712
683
-# this script will uninstall netdata
713
+ # this script will uninstall netdata
714
685
-if [ "\$1" != "--force" ]
686
- then
687
- echo >&2 "This script will REMOVE netdata from your system."
688
- echo >&2 "Run it again with --force to do it."
689
- exit 1
690
-fi
715
+ if [ "\$1" != "--force" ]
716
+ then
717
+ echo >&2 "This script will REMOVE netdata from your system."
718
+ echo >&2 "Run it again with --force to do it."
719
+ exit 1
720
+ fi
721
+
722
+ echo >&2 "Stopping a possibly running netdata..."
723
+ killall netdata
724
+ sleep 2
725
692
-echo >&2 "Stopping a possibly running netdata..."
693
-killall netdata
694
-sleep 2
726
+ deletedir() {
727
+ if [ ! -z "\$1" -a -d "\$1" ]
728
+ then
729
+ echo
730
+ echo "Deleting directory '\$1' ..."
731
+ rm -I -R "\$1"
732
+ fi
733
+ }
734
696
-deletedir() {
697
- if [ ! -z "\$1" -a -d "\$1" ]
735
+ if [ ! -z "${NETDATA_PREFIX}" -a -d "${NETDATA_PREFIX}" ]
736
then
699
- echo
700
- echo "Deleting directory '\$1' ..."
701
- rm -I -R "\$1"
702
- fi
703
-}
737
+ # installation prefix was given
738
705
-if [ ! -z "${NETDATA_PREFIX}" -a -d "${NETDATA_PREFIX}" ]
706
- then
707
- # installation prefix was given
739
+ deletedir "${NETDATA_PREFIX}"
740
709
- deletedir "${NETDATA_PREFIX}"
741
+ else
742
+ # installation prefix was NOT given
743
711
-else
712
- # installation prefix was NOT given
744
+ if [ -f "${NETDATA_PREFIX}/usr/sbin/netdata" ]
745
+ then
746
+ echo "Deleting ${NETDATA_PREFIX}/usr/sbin/netdata ..."
747
+ rm -i "${NETDATA_PREFIX}/usr/sbin/netdata"
748
+ fi
749
714
- if [ -f "${NETDATA_PREFIX}/usr/sbin/netdata" ]
715
- then
716
- echo "Deleting ${NETDATA_PREFIX}/usr/sbin/netdata ..."
717
- rm -i "${NETDATA_PREFIX}/usr/sbin/netdata"
750
+ deletedir "${NETDATA_PREFIX}/etc/netdata"
751
+ deletedir "${NETDATA_PREFIX}/usr/share/netdata"
752
+ deletedir "${NETDATA_PREFIX}/usr/libexec/netdata"
753
+ deletedir "${NETDATA_PREFIX}/var/lib/netdata"
754
+ deletedir "${NETDATA_PREFIX}/var/cache/netdata"
755
+ deletedir "${NETDATA_PREFIX}/var/log/netdata"
756
fi
757
720
- deletedir "${NETDATA_PREFIX}/etc/netdata"
721
- deletedir "${NETDATA_PREFIX}/usr/share/netdata"
722
- deletedir "${NETDATA_PREFIX}/usr/libexec/netdata"
723
- deletedir "${NETDATA_PREFIX}/var/lib/netdata"
724
- deletedir "${NETDATA_PREFIX}/var/cache/netdata"
725
- deletedir "${NETDATA_PREFIX}/var/log/netdata"
726
-fi
727
-
728
-getent passwd netdata > /dev/null
729
-if [ $? -eq 0 ]
730
- then
731
- echo
732
- echo "You may also want to remove the user netdata"
733
- echo "by running:"
734
- echo " userdel netdata"
735
-fi
758
+ getent passwd netdata > /dev/null
759
+ if [ $? -eq 0 ]
760
+ then
761
+ echo
762
+ echo "You may also want to remove the user netdata"
763
+ echo "by running:"
764
+ echo " userdel netdata"
765
+ fi
766
737
-getent group netdata > /dev/null
738
-if [ $? -eq 0 ]
739
- then
740
- echo
741
- echo "You may also want to remove the group netdata"
742
- echo "by running:"
743
- echo " groupdel netdata"
744
-fi
767
+ getent group netdata > /dev/null
768
+ if [ $? -eq 0 ]
769
+ then
770
+ echo
771
+ echo "You may also want to remove the group netdata"
772
+ echo "by running:"
773
+ echo " groupdel netdata"
774
+ fi
775
746
-getent group docker > /dev/null
747
-if [ $? -eq 0 -a "${NETDATA_ADDED_TO_DOCKER}" = "1" ]
748
- then
749
- echo
750
- echo "You may also want to remove the netdata user from the docker group"
751
- echo "by running:"
752
- echo " gpasswd -d netdata docker"
753
-fi
776
+ getent group docker > /dev/null
777
+ if [ $? -eq 0 -a "${NETDATA_ADDED_TO_DOCKER}" = "1" ]
778
+ then
779
+ echo
780
+ echo "You may also want to remove the netdata user from the docker group"
781
+ echo "by running:"
782
+ echo " gpasswd -d netdata docker"
783
+ fi
784
785
UNINSTALL
786
chmod 750 netdata-uninstaller.sh
@@ -764,32 +794,32 @@ else
794
access="${NETDATA_BIND}"
795
fi
796
767
-cat <<END
797
+cat <<-END
798
799
770
--------------------------------------------------------------------------------
800
+ -------------------------------------------------------------------------------
801
772
-OK. NetData is installed and it is running (listening to ${NETDATA_BIND}:${NETDATA_PORT}).
802
+ OK. NetData is installed and it is running (listening to ${NETDATA_BIND}:${NETDATA_PORT}).
803
774
--------------------------------------------------------------------------------
804
+ -------------------------------------------------------------------------------
805
806
777
-Hit http://${access}:${NETDATA_PORT}/ from your browser.
807
+ Hit http://${access}:${NETDATA_PORT}/ from your browser.
808
779
-To stop netdata, just kill it, with:
809
+ To stop netdata, just kill it, with:
810
781
- killall netdata
811
+ killall netdata
812
783
-To start it, just run it:
813
+ To start it, just run it:
814
785
- ${NETDATA_PREFIX}/usr/sbin/netdata
815
+ ${NETDATA_PREFIX}/usr/sbin/netdata
816
817
788
-Enjoy!
818
+ Enjoy!
819
790
- Give netdata a Github Star, at:
820
+ Give netdata a Github Star, at:
821
792
- https://github.com/firehol/netdata/wiki
822
+ https://github.com/firehol/netdata/wiki
823
824
825
END
src/Makefile.am
+6
-3
@@ -86,12 +86,15 @@ apps_plugin_SOURCES = \
86
install-data-hook:
87
if [ `id -u` == 0 ]; then \
88
chown root '$(DESTDIR)$(pluginsdir)/apps.plugin' && \
89
- chmod 4755 '$(DESTDIR)$(pluginsdir)/apps.plugin'; \
89
+ chmod 0755 '$(DESTDIR)$(pluginsdir)/apps.plugin' && \
90
+ setcap cap_dac_read_search,cap_sys_ptrace+ep '$(DESTDIR)$(pluginsdir)/apps.plugin'; \
91
else \
92
echo; \
93
echo "ATTENTION"; \
94
echo; \
94
- echo "setuid bit of $(pluginsdir)/apps.plugin must be set, please execute as root:"; \
95
- echo "chown root '$(pluginsdir)/apps.plugin' && chmod 4755 '$(pluginsdir)/apps.plugin'"; \
95
+ echo "$(pluginsdir)/apps.plugin requires escalated capabilities:"; \
96
+ echo "sudo chown root '$(DESTDIR)$(pluginsdir)/apps.plugin'"; \
97
+ echo "sudo chmod 4755 '$(DESTDIR)$(pluginsdir)/apps.plugin'"; \
98
+ echo "sudo setcap cap_dac_read_search,cap_sys_ptrace+ep '$(DESTDIR)$(pluginsdir)/apps.plugin'"; \
99
echo; \
100
fi