snap-confine cannot be setuid root on openSUSE

[Zygmunt Krynicki]

OpenSUSE has a special system that (via the permissions package) that dictates which executable can be setuid root on the whole system. Extensions to that list are carefully managed through the core distribution. It would be good for snap-confine to work without requiring real root (e.g. through Linux capabilities) so that there's one less roadblock for becoming available to OpenSUSE users and developers.

NOTE: this is a clone of the following github issue https://github.com/snapcore/snapd/issues/2576

[Neal Gompa (ngompa13)]

This is technically also a problem for Fedora, too, but we're able to ignore it for the moment, because package linting is advisory rather than hard blocker to package builds.

But I'd like to switch Fedora back to file caps ASAP.

[Zygmunt Krynicki (zyga)]

This could use some kernel person hand-holding the caps build and
trying to figure out why the permission denied error is returned while
holding all the (seemingly) relevant capabilities.

On Tue, Apr 18, 2017 at 12:16 PM, Neal Gompa <email address hidden> wrote:
> This is technically also a problem for Fedora, too, but we're able to
> ignore it for the moment, because package linting is advisory rather
> than hard blocker to package builds.
>
> But I'd like to switch Fedora back to file caps ASAP.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1657098
>
> Title:
> snap-confine cannot be setuid root on openSUSE
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/snapd/+bug/1657098/+subscriptions

[Zygmunt Krynicki (zyga)]

I don't think we are going to realistically implement this anytime soon. Closing.