pure setuid-wrappers in nix store

[lucabrunox]

Proposal:
Create a wrapper for needed setuid programs which:

1. Copies the binary to tmp
2. Makes it setuid
3. Runs it and deletes it

Slow but no more impure setuid-wrappers. Any security concerns about this?

[abbradar]

Hm, I see a chicken-and-egg issue -- if a user (not root) runs that wrapper it needs to be setuid itself to make the copied binary setuid.

[vcunat]

Well, running the wrapper as a non-root makes this impossible. (Assuming the host system is sane; think of what you could do.)

[Profpatsch]

(triage) what’s the way to go forward?

[grahamc]

Closing due to inactivity, and the additional pcap wrappers.