Linux capabilities with yocto -

i want give several files linux capabilities (e.g. cap_net_admin). using yocto , file system should read-only , must not changed after flashing software (this means pkg_postinst setcap work not possible).

is there other way give capabilities files without changing file structure after booting target?

pkg_postinst scripts executed while building read-only rootfs, approach works. must ensure commands call in script available in build host, though, otherwise execution of script fail , gets deferred first boot on device. how ensure setcap command available depends on yocto release, change in yocto 2.3. here's complete example recipe:

license = "mit"  do_install () {     install -d ${d}/${bindir}     touch ${d}/${bindir}/foobar }  pkg_postinst_${pn} () {     setcap cap_chown+e "$d/${bindir}/foobar" } # dependency when installing on target. rdepends_${pn} = "libcap" # dependency rootfs construction, yocto > 2.3. package_write_deps = "libcap-native" # dependency rootfs construction, yocto <= 2.3 (untested). # enabling makes builds less efficient # yocto > 2.3 because implies libcap-native # needed building recipe, isn't case. # depends += "libcap-native" 

be careful preserve xattrs. default .tar image format drops them. top of https://github.com/01org/meta-intel-iot-security/blob/master/meta-security-framework/classes/xattr-images.bbclass:

# xattr support expected compiled mtd-utils. need # use it. extra_imagecmd_jffs2_append = " --with-xattr"  # default, oe-core uses tar host, may or may not have # --xattrs parameter introduced in 1.27. image building # use recent enough tar instead. # # gnu documentation not specify whether --xattrs-include necessary. # in practice, turned out not needed when creating archives , # required when extracting, seems prudent use in both cases. image_depends_tar_append = " tar-replacement-native" extranativepath += "tar-native" image_cmd_tar = "tar --xattrs --xattrs-include=*" 

put image recipe, if matters.