Bug#412690: tomcat5.5: jsvc problem

[Michael Koch]

On Wed, May 07, 2008 at 11:24:20AM +0200, ROBERTOJIMENOCA at terra.es wrote:
> Michael Koch wrote:
> > On Tue, May 06, 2008 at 03:28:47PM +0200, ROBERTOJIMENOCA at terra.es wrote:
> > > As Peter points out it is probably a jsvc problem but I was not able to make it run by running dpkg-buildpackage on jsvc and reinstalling.
> > 
> > I hunted the issue down to being caused by linux-libc-dev. When
> > compiling againt linux-libc-dev 2.6.24-6 it works, when building against
> > 2.6.25-1 it doesn't. The capability.h header changed a lot. We have to
> > check how that influences jsvc.
> 
> I found out this thread at linux-kernel mailing list:
> 2.6.25 Kernel - Problems with capabilities
> http://marc.info/?t=120863077600002
> 
> I also saw at the capset man page:
> > These two functions are the raw kernel interface for getting  and set-
> > ting  capabilities.  Not only are these system calls specific to Linux,
> > but the kernel API is likely to change and use of these functions  (in
> > particular  the  format of the cap_user_*_t types) is subject to change
> > with each kernel revision.
> > 
> > The portable interfaces are  cap_set_proc(3)  and cap_get_proc(3);  if
> > possible  you should use those interfaces in applications.  If you wish
> > to use the Linux extensions in applications, you should use the easier-
> > to-use interfaces capsetp(3) and capgetp(3).
> 
> So at commons-daemon-1.0.2~svn20061127/src/native/unix/native/jsvc-unix.c
>     if (syscall(__NR_capset, &caphead, &cap) < 0) {
> may not be the supported interface to set capabilities.

Thanks for this info. With the help of this I was able to patch jsvc to
work compiled with new linux-libc-dev. The workaround was to use the
version instead of the version from the capability.h header. This will
be break again when the linux kernel drops this backward compatibility.
It would be good idea to rewrite that code to use libcap instead of
directly using a syscall.

I will prepare an upload for this later today with the now known
workaround.


Cheers,
Michael