Bug 1914908

Summary: rpm -a --setugids removes sticky bit
Product: Red Hat Enterprise Linux 8 Reporter: Dominik Holler <dholler>
Component: rpmAssignee: Packaging Maintenance Team <packaging-team-maint>
Status: CLOSED NOTABUG QA Contact: swm-qe
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.3CC: pmatilai
Target Milestone: rc   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-01-11 13:24:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
terminal log none

Description Dominik Holler 2021-01-11 13:12:23 UTC
Created attachment 1746248 [details]
terminal log

Description of problem:
'rpm -a --setugids' removes the sticky bits, which is very unpleasant, because sudo relies on this bits.


Version-Release number of selected component (if applicable):
rpm-4.14.3-4.el8.x86_64

How reproducible:
100%

Steps to Reproduce:
1.
ls -l /usr/bin/sudo
---s--x--x. 1 root root 165608 May 18  2020 /usr/bin/sudo

2.
rpm -a --setugids


Actual results:
ls -l /usr/bin/sudo
---x--x--x. 1 root root 165608 May 18  2020 /usr/bin/sudo


Expected results:
ls -l /usr/bin/sudo
---s--x--x. 1 root root 165608 May 18  2020 /usr/bin/sudo



Additional info:

Comment 1 Panu Matilainen 2021-01-11 13:24:30 UTC
Yes, this is actually even documented, from rpm(8):

       rpm --setugids PACKAGE_NAME
              sets  user/group  ownership  of files in the given package. This
              command can change permissions and capabilities of files in that
              package. In most cases it is better to use --restore instead.

       rpm --setcaps PACKAGE_NAME
              sets  capabilities of files in the given package. Consider using
              --restore instead.

       rpm --restore PACKAGE_NAME
              The option restores owner, group, permissions  and  capabilities
              of files in the given package.

       Options --setperms, --setugids, --setcaps and
              --restore are mutually exclusive.

In other words, use --restore instead.

--setugids is rather an unfortunate demo of popt alias capabilities (search '--setugids' from /usr/lib/rpm/rpmpopt*) that we can't fix than a genuinely useful feature...