Re: Documentation for F15's "Remove SETUID" Change?
by Michel Alexandre Salim
Hi Steve,
On Wed, Mar 02, 2022 at 07:11:42PM -0500, Steve Grubb wrote:
> Hello,
>
> On Tuesday, March 1, 2022 6:43:57 PM EST Michel Alexandre Salim wrote:
> > The subject of setuid came up in a private conversation recently, and to my
> > surprise we don't seem to have it documented in the packaging guidelines:
> >
> > https://docs.fedoraproject.org/en-US/packaging-guidelines/
> >
> > Per https://fedoraproject.org/wiki/Features/RemoveSETUID#Documentation
> >
> > "We should change documentation on packaging guidelines to talk about
> > using file capabilities."
> >
> > but the only mention of capabilities seem to be that, if you use it or
> > suid, PIE must be enabled:
> >
> > https://docs.fedoraproject.org/en-US/packaging-guidelines/#_pie
> >
> > Should this be documented somewhere, or if it's there but it's lost in
> > the wiki->docs migration, does anyone know where the documentation is?
>
> As someone involved in that change, the situation was much worse back in
> 2011. Almost everything was running as root. The inspection tools back then
> were non-existent, which is what I wrote pscap and netcap.
>
> Now, a lot of things use capabilities with a few still running as root when
> they don't need to be. But I have not looked at all daemons. The lesser used
> ones may need checking. But I think maybe some guidance could be good.
> Something like:
>
<snip>
That's really comprehensive, thanks. Can we document this? I'm a bit
worried about the situation where a packager and a reviewer don't have
the institutional memory of "we recommend capabilities over
setuid/setgid" and new setuid packages creeping in again.
Best regards,
--
Michel Alexandre Salim
identities: https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
