Support binaries that need "setcap" similar to "setuid-programs"

  • Open
  • quality assurance status badge
Details
One participant
  • Vagrant Cascadian
Owner
unassigned
Submitted by
Vagrant Cascadian
Severity
normal
V
V
Vagrant Cascadian wrote on 27 May 2022 21:51
(address . bug-guix@gnu.org)
87k0a669ew.fsf@yucca
I've been working on a package called lcsync:


But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
running:

setcap cap_net_raw=eip /path/to/bin/lcsync

You could add lcsync to setuid-programs, but this would be a terrible
idea, as it's a file syncing tool and you would have root access to
writing any file in the filesystem...

Upstream lcsync is considering how to rewrite it to drop privledges so
that it would not be *terrible* to run setuid root, but ... ideally it
could just use setcap to provide the very limited root privledges that
it needs.

It seems like something very similar to setuid-programs could work for
programs that need particular capabilities... e.g. copy a binary from
the store, set the appropriate capabilities with "setcap", add this
special directory to PATH.

But maybe there's a better way to do this already? :)


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYpEr2AAKCRDcUY/If5cW
qjFHAP9RM7GiWjiOBlMNXtl7kg/Wvi0lzcD3TFxZgLM4A5X4SQD/Q/W2jaMvykBB
yYm3LTaiXORGAXBaz3B2mbw6eZ2kYAU=
=r9DB
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 27 May 2022 22:07
(address . 55683@debbugs.gnu.org)
87fsku68pn.fsf@yucca
On 2022-05-27, Vagrant Cascadian wrote:
Toggle quote (9 lines)
> I've been working on a package called lcsync:
>
> https://issues.guix.gnu.org/55682
>
> But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
> running:
>
> setcap cap_net_raw=eip /path/to/bin/lcsync

Similar issues seem to have come up for other packages:


And possibly:



Some programs *might* be able to handle this sort of thing in a service
definition, but lcsync at least should be callable by the user from the
commandline (sort of like rsync); it doesn't normally have a daemon
component that would make sense to run as a service.


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYpEvZQAKCRDcUY/If5cW
qjZoAP9AJY7bNJjrClE8XKwONxFKEyqeQz6uxJgJbqvQOpQoUgEAkMfSV8U2OpfW
6kK4PKPg0FiPLBZp5zvmSOb1HWHWOgw=
=0mpo
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 13 Feb 2023 20:52
(address . 55683@debbugs.gnu.org)
87v8k5l4wp.fsf@contorta
On 2022-05-27, Vagrant Cascadian wrote:
Toggle quote (20 lines)
> On 2022-05-27, Vagrant Cascadian wrote:
>> I've been working on a package called lcsync:
>>
>> https://issues.guix.gnu.org/55682
>>
>> But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
>> running:
>>
>> setcap cap_net_raw=eip /path/to/bin/lcsync
>
> Similar issues seem to have come up for other packages:
>
> https://issues.guix.gnu.org/27415
> https://issues.guix.gnu.org/39136
> https://issues.guix.gnu.org/39136
>
> And possibly:
>
> https://issues.guix.gnu.org/search?query=setcap

Patches working towards implementing the required functionality at:


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCY+qU5gAKCRDcUY/If5cW
qkTGAQDorFRWvfBpZIt0+V6PSOky8TN2Q0991VsmKRFCUyB+dwEAyhnCfQIYdqYK
C0kng9nQJBWt/JmGB5Wx59AYq0jgigQ=
=SUZ5
-----END PGP SIGNATURE-----

?