yggdrasil: setpriv: libcap-ng is too old for "all" caps

[whoizit]

System

• xuname:
  output of xuname (part of xtools)

~ $ xuname 
Do you want to import this public key? [Y/n] Y
Void 5.8.18_1 x86_64 AuthenticAMD notuptodate rF

• package:
  affected package(s) including the version: xbps-query -p pkgver <pkgname>
  yggdrasil-0.3.14_2

Expected behavior

Actual behavior

Steps to reproduce the behavior

~ $ doas /etc/sv/yggdrasil/run 
setpriv: libcap-ng is too old for "all" caps
~ $ xrs libcap
[*] libcap-2.45_1           POSIX.1e capabilities suite
[-] libcap-devel-2.45_1     POSIX.1e capabilities suite - development files
[*] libcap-ng-0.8_2         Alternate POSIX capabilities library
[-] libcap-ng-devel-0.8_2   Alternate POSIX capabilities library - development files
[-] libcap-ng-progs-0.8_2   Alternate POSIX capabilities library - utilities
[-] libcap-ng-python-0.8_2  Alternate POSIX capabilities library - transitional dummy pkg
[-] libcap-ng-python3-0.8_2 Alternate POSIX capabilities library - Python3 bindings
[-] libcap-pam-2.34_1       POSIX.1e capabilities suite - PAM module
[*] libcap-progs-2.45_1     POSIX.1e capabilities suite - utilities

[Piraty]

@jcgruenhage

[jcgruenhage]

The bug is not in yggdrasil or our package. It needs to be fixed by rebuilding some lib with newer kernel headers, but tbh, I don't know enough about that.

The 0.3.15 update PR disables the dropping of all privileges, which works around this, but it's not merged yet

[ericonr]

The plan was to wait on the 5.10 release for a new kernel-libc-headers package. We could queue a libcap rebuild then.

[ericonr]

The bug is not in yggdrasil or our package.

It is our package, more specifically the yggdrasil service.

[jcgruenhage]

@ericonr Isn't this a bug in util-linux which causes things to break in our service?

[ericonr]

Kinda? I'm not sure if it's a bug or intended, so I reached out to upstream util-linux, which might end up with me reaching out to upstream libcap-ng as well.

But still, we were the ones who added setpriv to the service.

[ericonr]

This has been temporarily fixed; I will see about backporting the util-linux changes so we can re-enable dropping capabilities in the service.