+++ This bug was initially created as a clone of Bug #646443 +++ Description of problem: Please remove setuid setup of files in your package with file capabilities. This is to satisfy the F15 feature. https://fedoraproject.org/wiki/Features/RemoveSETUID An example of how this was done for X is. %if 0%{?fedora} < 15 %define Xorgperms %attr(4711, root, root) %else %define Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) %endif
Any update on this bug
I don't understand how this small change in spec file can provide root write permissions for plugin-install program. Please reopen if I'm wrong but I don't think it's useful for nspluginwrapper package.
The problem with using traditional capabilities is the process in this case nspluginwrapper starts with full capabilities and then the programmer is responsible for removing the capabilities that the program does not need. There have been several mistakes and bugs that have led to program escalation. By using file capabilties, you would start with a much smaller subset of capabilities and then you should still remove these once you are done with them, but if you have a bug in your code then the potential escalation would be less then with a full capability program.
No good for everyone that this feature was closed as don't fix IMHO