Support binaries that need "setcap" similar to "setuid-programs"

OpenSubmitted by Vagrant Cascadian.
Details
One participant
  • Vagrant Cascadian
Owner
unassigned
Severity
normal
V
V
Vagrant Cascadian wrote on 27 May 21:51 +0200
(address . bug-guix@gnu.org)
87k0a669ew.fsf@yucca
I've been working on a package called lcsync:


But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
running:

setcap cap_net_raw=eip /path/to/bin/lcsync

You could add lcsync to setuid-programs, but this would be a terrible
idea, as it's a file syncing tool and you would have root access to
writing any file in the filesystem...

Upstream lcsync is considering how to rewrite it to drop privledges so
that it would not be *terrible* to run setuid root, but ... ideally it
could just use setcap to provide the very limited root privledges that
it needs.

It seems like something very similar to setuid-programs could work for
programs that need particular capabilities... e.g. copy a binary from
the store, set the appropriate capabilities with "setcap", add this
special directory to PATH.

But maybe there's a better way to do this already? :)


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYpEr2AAKCRDcUY/If5cW
qjFHAP9RM7GiWjiOBlMNXtl7kg/Wvi0lzcD3TFxZgLM4A5X4SQD/Q/W2jaMvykBB
yYm3LTaiXORGAXBaz3B2mbw6eZ2kYAU=
=r9DB
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 27 May 22:07 +0200
(address . 55683@debbugs.gnu.org)
87fsku68pn.fsf@yucca
On 2022-05-27, Vagrant Cascadian wrote:
Toggle quote (9 lines)
> I've been working on a package called lcsync:
>
> https://issues.guix.gnu.org/55682
>
> But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
> running:
>
> setcap cap_net_raw=eip /path/to/bin/lcsync

Similar issues seem to have come up for other packages:


And possibly:



Some programs *might* be able to handle this sort of thing in a service
definition, but lcsync at least should be callable by the user from the
commandline (sort of like rsync); it doesn't normally have a daemon
component that would make sense to run as a service.


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYpEvZQAKCRDcUY/If5cW
qjZoAP9AJY7bNJjrClE8XKwONxFKEyqeQz6uxJgJbqvQOpQoUgEAkMfSV8U2OpfW
6kK4PKPg0FiPLBZp5zvmSOb1HWHWOgw=
=0mpo
-----END PGP SIGNATURE-----

?