Bug 646485

Summary:	Replace SETUID in spec file with the correct file capabilities.
Product:	[Fedora] Fedora	Reporter:	Daniel Walsh <dwalsh>
Component:	polkit	Assignee:	David Zeuthen <davidz>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	rawhide	CC:	bnocera, davidz, dwalsh, mclasen, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	646443	Environment:
Last Closed:	2011-04-05 16:38:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	693731

Description Daniel Walsh 2010-10-25 13:34:48 UTC

+++ This bug was initially created as a clone of Bug #646443 +++

Description of problem:

Please remove setuid setup of files in your package with file capabilities.

This is to satisfy the F15 feature.

https://fedoraproject.org/wiki/Features/RemoveSETUID

An example of how this was done for X is.


%if 0%{?fedora} < 15
%define Xorgperms %attr(4711, root, root)
%else
%define Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe)
%endif

Comment 1 Daniel Walsh 2011-04-05 13:19:14 UTC

Any movement on this?

Comment 2 David Zeuthen 2011-04-05 16:25:56 UTC

Pretty much the same as what Colin said in bug 646450 comment 2. E.g. pkexec(1) is used to launch arbitrary programs so it needs to have all the capabilities anyway... so removing its setuid bit and replacing it with file capabilities doesn't buy anything and actually might just give a false sense of security since e.g. "hardening" scripts scanning for setuid helpers might miss it....

Comment 3 Daniel Walsh 2011-04-05 16:38:16 UTC

Ok then lets close it WONT FIX.