packaging: set capabilities

Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
canonical · bboozzoo · Nov 10, 2022 · Nov 9, 2022 · Nov 10, 2022 · Nov 10, 2022
commit 87cd9ae3671b61808e0be63a0a4c5d4355e7da44
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
@@ -8,7 +8,7 @@
 
 pkgname=snapd
 pkgdesc="Service and tools for management of snap packages."
-depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'apparmor')
+depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'libcap' 'apparmor')
 optdepends=('bash-completion: bash completion support'
             'xdg-desktop-portal: desktop integration')
 pkgver=2.68

diff --git a/packaging/arch/snapd.install b/packaging/arch/snapd.install
@@ -1,5 +1,9 @@
 ## arg 1:  the new package version
 post_install() {
+  /usr/bin/setcap \
+    cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p \
+    /usr/lib/snapd/snap-confine
+
   echo
   echo 'To use snapd start/enable the snapd.socket'
   echo

diff --git a/packaging/debian-sid/snapd.postinst b/packaging/debian-sid/snapd.postinst
@@ -36,6 +36,12 @@ case "$1" in
         fi
         # Ensure that the void directory has correct permissions.
         chmod 111 /var/lib/snapd/void
+
+        # TODO update caps
+        setcap \
+            cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p \
+            /usr/lib/snapd/snap-confine
+        ;;
 esac
 
 #DEBHELPER#
diff --git a/packaging/fedora/snapd.spec b/packaging/fedora/snapd.spec
@@ -901,8 +901,9 @@ make -C data -k check
 %license COPYING
 %dir %{_libexecdir}/snapd
 # For now, we can't use caps
-# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap!
-%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine
+# TODO:nonsetuid: update caps
+# TODO:nonsetuid: use define
+%caps(cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p) %{_libexecdir}/snapd/snap-confine
 %{_libexecdir}/snapd/snap-device-helper
 %{_libexecdir}/snapd/snap-discard-ns
 %{_libexecdir}/snapd/snap-gdb-shim
@@ -1004,7 +1005,6 @@ if [ $1 -eq 0 ]; then
 fi
 %endif
 
-
 %changelog
 * Thu Feb 13 2025 Ernest Lotter <ernest.lotter@canonical.com>
 - New upstream release 2.68

diff --git a/packaging/opensuse/permissions b/packaging/opensuse/permissions
@@ -1 +1,2 @@
-/usr/lib/snapd/snap-confine                             root:root         4755
+# TODO set caps
+/usr/lib/snapd/snap-confine root:root 0755 +capabilities cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p
diff --git a/packaging/opensuse/permissions.easy b/packaging/opensuse/permissions.easy
@@ -1 +1,2 @@
-/usr/lib/snapd/snap-confine                             root:root         4755
+# TODO set caps
+/usr/lib/snapd/snap-confine root:root 4755 +capabilities cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p
diff --git a/packaging/opensuse/permissions.paranoid b/packaging/opensuse/permissions.paranoid
@@ -1 +1 @@
-/usr/lib/snapd/snap-confine                             root:root         755
+/usr/lib/snapd/snap-confine root:root 755
diff --git a/packaging/opensuse/permissions.secure b/packaging/opensuse/permissions.secure
@@ -1 +1,2 @@
-/usr/lib/snapd/snap-confine                             root:root         4755
+# TODO set caps
+/usr/lib/snapd/snap-confine root:root 0755 +capabilities cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p
diff --git a/packaging/opensuse/snapd.spec b/packaging/opensuse/snapd.spec
@@ -462,7 +462,8 @@ fi
 %ghost %{_sharedstatedir}/snapd/state.json
 %ghost %{_sharedstatedir}/snapd/system-key
 %ghost %{snap_mount_dir}/README
-%verify(not user group mode) %attr(04755,root,root) %{_libexecdir}/snapd/snap-confine
+# TODO update caps
+%verify(not caps) %attr(0755,root,root) %{_libexecdir}/snapd/snap-confine
 %{_bindir}/snap
 %{_bindir}/snapctl
 %{_datadir}/applications/io.snapcraft.SessionAgent.desktop

diff --git a/packaging/ubuntu-16.04/snapd.postinst b/packaging/ubuntu-16.04/snapd.postinst
@@ -70,6 +70,13 @@ case "$1" in
         if dpkg --compare-versions "$2" lt-nl "2.45.2"; then
             pkill -f "snap userd" || true
         fi
+
+        # TODO update caps
+        setcap \
+            cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace,cap_setuid,cap_setgid=p \
+            /usr/lib/snapd/snap-confine
+
+        ;;
 esac
 
 #DEBHELPER#
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		/usr/lib/snapd/snap-confine root:root 755
		/usr/lib/snapd/snap-confine root:root 755