Bug 646466 - Replace SETUID in spec file with the correct file capabilities.
Summary: Replace SETUID in spec file with the correct file capabilities.
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: fping
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
Assignee: Charles R. Anderson
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: removesuid16
TreeView+ depends on / blocked
 
Reported: 2010-10-25 13:18 UTC by Daniel Walsh
Modified: 2012-02-25 19:35 UTC (History)
4 users (show)

Fixed In Version:
Clone Of: 646443
Environment:
Last Closed: 2012-02-18 20:18:38 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Daniel Walsh 2010-10-25 13:18:08 UTC 
+++ This bug was initially created as a clone of Bug #646443 +++

Description of problem:

Please remove setuid setup of files in your package with file capabilities.

This is to satisfy the F15 feature.

https://fedoraproject.org/wiki/Features/RemoveSETUID

An example of how this was done for X is.


%if 0%{?fedora} < 15
%define Xorgperms %attr(4711, root, root)
%else
%define Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe)
%endif
Comment 1 Daniel Walsh 2011-04-05 13:22:58 UTC 
Any movement on this?
Comment 2 Fedora Admin XMLRPC Client 2011-07-12 22:36:34 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 3 Charles R. Anderson 2011-07-12 23:22:35 UTC 
Putting a note in here for myself to keep track of #706682 for SUID-less and CAP_NET_RAW-less kernel support and check if anything else in fping needs SUID.
Comment 4 Jon Stanley 2012-02-09 16:31:19 UTC 
Any progress here?

Apparently fping is hard-coded to check if your UID is 0 and if not bail (I haven't looked at the code myself).
Comment 5 Charles R. Anderson 2012-02-18 20:18:38 UTC 
Closing, since F17 is using cap_net_raw instead of set-uid root.  Will backport to F16 as well.
Comment 6 Jon Stanley 2012-02-25 19:35:24 UTC 
Is it possible to backport to EL6 as well?
Note You need to log in before you can comment on or make changes to this bug.