bug#55683: Support binaries that need "setcap" similar to "setuid-programs"

bug#55683: Support binaries that need "setcap" similar to "setuid-programs"

[Vagrant Cascadian]

[-- Attachment #1: Type: text/plain, Size: 921 bytes --]

I've been working on a package called lcsync:

  https://issues.guix.gnu.org/55682

But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
running:

  setcap cap_net_raw=eip /path/to/bin/lcsync

You could add lcsync to setuid-programs, but this would be a terrible
idea, as it's a file syncing tool and you would have root access to
writing any file in the filesystem...

Upstream lcsync is considering how to rewrite it to drop privledges so
that it would not be *terrible* to run setuid root, but ... ideally it
could just use setcap to provide the very limited root privledges that
it needs.

It seems like something very similar to setuid-programs could work for
programs that need particular capabilities... e.g. copy a binary from
the store, set the appropriate capabilities with "setcap", add this
special directory to PATH.

But maybe there's a better way to do this already? :)


live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

bug#55683: Support binaries that need "setcap" similar to "setuid-programs"

[Vagrant Cascadian]

[-- Attachment #1: Type: text/plain, Size: 780 bytes --]

On 2022-05-27, Vagrant Cascadian wrote:
> I've been working on a package called lcsync:
>
>   https://issues.guix.gnu.org/55682
>
> But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
> running:
>
>   setcap cap_net_raw=eip /path/to/bin/lcsync

Similar issues seem to have come up for other packages:

  https://issues.guix.gnu.org/27415
  https://issues.guix.gnu.org/39136
  https://issues.guix.gnu.org/39136

And possibly:

  https://issues.guix.gnu.org/search?query=setcap


Some programs *might* be able to handle this sort of thing in a service
definition, but lcsync at least should be callable by the user from the
commandline (sort of like rsync); it doesn't normally have a daemon
component that would make sense to run as a service.


live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

bug#55683: Support binaries that need "setcap" similar to "setuid-programs"

[Vagrant Cascadian]

[-- Attachment #1: Type: text/plain, Size: 684 bytes --]

On 2022-05-27, Vagrant Cascadian wrote:
> On 2022-05-27, Vagrant Cascadian wrote:
>> I've been working on a package called lcsync:
>>
>>   https://issues.guix.gnu.org/55682
>>
>> But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
>> running:
>>
>>   setcap cap_net_raw=eip /path/to/bin/lcsync
>
> Similar issues seem to have come up for other packages:
>
>   https://issues.guix.gnu.org/27415
>   https://issues.guix.gnu.org/39136
>   https://issues.guix.gnu.org/39136
>
> And possibly:
>
>   https://issues.guix.gnu.org/search?query=setcap

Patches working towards implementing the required functionality at:

  https://issues.guix.gnu.org/61462

live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]