[Slackbuilds-users] realtime capabilities for jack and its apps

[B Watson]

On 8/20/11, Felix Pfeifer <pfeifer.felix at googlemail.com> wrote:

> $ whatever.Slackbuild --disable-caps
>
> The default behavior then would be to include setcaps in the doinst.sh.

2 things there: it should be an environment variable, e.g. 'export
CAPS=no' (so it'll work like any other options, and so sbopkg won't
need to be modified)... and this is a doinst.sh thing, meaning that
the SlackBuild script would have to edit its own doinst.sh (probably
with sed), based on the option... Which is not a bad thing, but it's
definitely more work and more complexity.

If it were up to me, I'd just put the setcaps stuff in doinst.sh, not
make it optional, but I would make a note in the README... and maybe
I'd install the setcap'ed binaries 0750, owner root, group audio (so
only users in the audio group can execute them).

So in the SlackBuild itself, you'd have (after 'make install'), something
like this:

	chmod 0750 $PKG/usr/bin/$PRGNAM
	chown root.audio $PKG/usr/bin/$PRGNAM

(Add extra lines if there are extra binaries of course).

In doinst.sh:

	setcap cap_ipc_lock,cap_sys_nice=ep usr/bin/whatever

(Again, extra lines if there are extra binaries. setcap doesn't take
multiple filenames, so you can't say usr/bin/* here. Also notice the
lack of a leading / [it's usr/bin, not /usr/bin]).

In README:

	Note: This package installs binaries that execute with elevated resource
	limits. Only users in the audio group will be allowed to run them. [Insert
	URL of a longer explanation here, maybe].

That's my 2 cents worth (which is probably only worth $0.0002 due to
inflation).

What say ye, O List?