{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/16654","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/16654/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/16654/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/16654/events","html_url":"https://github.com/NixOS/nixpkgs/pull/16654","id":163461046,"number":16654,"title":"Adding setcap-wrapper functionality to Nix","user":{"login":"ixmatus","id":30714,"avatar_url":"https://avatars.githubusercontent.com/u/30714?v=3","gravatar_id":"","url":"https://api.github.com/users/ixmatus","html_url":"https://github.com/ixmatus","followers_url":"https://api.github.com/users/ixmatus/followers","following_url":"https://api.github.com/users/ixmatus/following{/other_user}","gists_url":"https://api.github.com/users/ixmatus/gists{/gist_id}","starred_url":"https://api.github.com/users/ixmatus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ixmatus/subscriptions","organizations_url":"https://api.github.com/users/ixmatus/orgs","repos_url":"https://api.github.com/users/ixmatus/repos","events_url":"https://api.github.com/users/ixmatus/events{/privacy}","received_events_url":"https://api.github.com/users/ixmatus/received_events","type":"User","site_admin":false},"labels":[{"id":6314752,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/0.kind:%20enhancement","name":"0.kind: enhancement","color":"84b6eb","default":false},{"id":292322837,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/2.status:%20merge%20conflict","name":"2.status: merge conflict","color":"e6e6e6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/10","html_url":"https://github.com/NixOS/nixpkgs/milestone/10","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/10/labels","id":1971855,"number":10,"title":"17.03","description":"","creator":{"login":"domenkozar","id":126339,"avatar_url":"https://avatars.githubusercontent.com/u/126339?v=3","gravatar_id":"","url":"https://api.github.com/users/domenkozar","html_url":"https://github.com/domenkozar","followers_url":"https://api.github.com/users/domenkozar/followers","following_url":"https://api.github.com/users/domenkozar/following{/other_user}","gists_url":"https://api.github.com/users/domenkozar/gists{/gist_id}","starred_url":"https://api.github.com/users/domenkozar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenkozar/subscriptions","organizations_url":"https://api.github.com/users/domenkozar/orgs","repos_url":"https://api.github.com/users/domenkozar/repos","events_url":"https://api.github.com/users/domenkozar/events{/privacy}","received_events_url":"https://api.github.com/users/domenkozar/received_events","type":"User","site_admin":false},"open_issues":65,"closed_issues":32,"state":"open","created_at":"2016-08-30T09:12:25Z","updated_at":"2017-01-26T00:07:02Z","due_on":"2017-03-30T07:00:00Z","closed_at":null},"comments":50,"created_at":"2016-07-01T19:35:42Z","updated_at":"2017-01-26T09:37:39Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/16654","html_url":"https://github.com/NixOS/nixpkgs/pull/16654","diff_url":"https://github.com/NixOS/nixpkgs/pull/16654.diff","patch_url":"https://github.com/NixOS/nixpkgs/pull/16654.patch"},"body":"###### Motivation for this change\n\nResolves #6768 \n\nSetting capabilities on programs is desirable over `setuid` because it improves the granularity of security. Nix wasn't able to support `setcap-wrappers` in the style of `setuid-wrappers` until recently when the Linux 4.4 kernel was added. Linux 4.3 included a capability named Ambient which enables a wrapper program to propagate its capabilities to an execv'ed program.\n\nThis PR adds support for setcap-wrappers (with notable improvements to the wrapper program over `setuid-wrapper.c`) and adds a conditional task that sets `ping` and `ping6` to be setcap wrapped if the kernel is at-least 4.3, if not then we default to the setuid behavior.\n###### Things done\n- [X] Tested using sandboxing\n  ([nix.useChroot](http://nixos.org/nixos/manual/options.html#opt-nix.useChroot) on NixOS,\n    or option `build-use-chroot` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file)\n    on non-NixOS)\n- Built on platform(s)\n  - [X] NixOS\n  - [ ] OS X\n  - [X] Linux\n- [X] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run \"nox-review wip\"`\n- [X] Tested execution of all binary files (usually in `./result/bin/`), NOTE: only tested ping and ping6\n- [X] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).\n\n---\n\nI tested both a sub 4.3 kernel (it defaulted to the setuid'ed `ping` and `ping6`) and with a 4.4 kernel (it defaulted to setcap'ed `ping` and `ping6`).\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/275345282","html_url":"https://github.com/NixOS/nixpkgs/pull/16654#issuecomment-275345282","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/16654","id":275345282,"user":{"login":"ixmatus","id":30714,"avatar_url":"https://avatars.githubusercontent.com/u/30714?v=3","gravatar_id":"","url":"https://api.github.com/users/ixmatus","html_url":"https://github.com/ixmatus","followers_url":"https://api.github.com/users/ixmatus/followers","following_url":"https://api.github.com/users/ixmatus/following{/other_user}","gists_url":"https://api.github.com/users/ixmatus/gists{/gist_id}","starred_url":"https://api.github.com/users/ixmatus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ixmatus/subscriptions","organizations_url":"https://api.github.com/users/ixmatus/orgs","repos_url":"https://api.github.com/users/ixmatus/repos","events_url":"https://api.github.com/users/ixmatus/events{/privacy}","received_events_url":"https://api.github.com/users/ixmatus/received_events","type":"User","site_admin":false},"created_at":"2017-01-26T09:37:39Z","updated_at":"2017-01-26T09:37:39Z","body":"@teh I pulled in your changes and made quite a few. I totally forgot where I'd left off too but I believe I have a unified `setuid-wrapper` and `setcap-wrapper` module now.\r\n\r\nI've tested this on an EC2 machine (thank you for that idea):\r\n\r\n```\r\n[parnell@ip-172-30-0-194:/root/nixpkgs-awake]$ ping google.com\r\ncap_setpcap in set, skipping it\r\nraised cap_net_raw+p into the Ambient capability set\r\nPING google.com (172.217.7.142) 56(84) bytes of data.\r\n64 bytes from iad30s08-in-f142.1e100.net (172.217.7.142): icmp_seq=1 ttl=49 time=1.21 ms\r\n64 bytes from iad30s08-in-f142.1e100.net (172.217.7.142): icmp_seq=2 ttl=49 time=1.24 ms\r\n```"}}
{"actor":{"display_login":"ixmatus"}}