snapcraft for maven project included setuid binary
Metadata
Current evaluation
Closed without resolution. Snapcraft was requested to strip setuid/setgid bits from packaged binaries to comply with snap security policies.
Suggested action: —
No scores available.
Issue body
I'm reporting this bug on behalf of someone in an email thread.
Currently, snaps are not allowed to ship setuid/setgid binaries. It isn't supported by the snappy install operation and the security policy does not allow CAP_SETUID and CAP_SETGID, so the review tools check for this to make sure everything is ok. (Perhaps one day we will want to support this, but IMO we should avoid this for as long as possible and very carefully think about how to support it (if at all) because things could get complicated in a hurry on a system like Ubuntu Personal.)
In that spirit, snapcraft for maven projects is pulling in fusermount and the review tools complains:
found errors in hashes.yaml: mode 'rwxr-xr-x' != 'rwsr-xr-x' for 'bin/fusermount', mode 'rwxr-xr-x' != 'rwsr-xr-x' for 'usr/lib/eject/dmcrypt-get-device' lint_file_mode
Snapcraft should strip the setuid/setgid bits of any files before calling snappy build.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. Snapcraft was requested to strip setuid/setgid bits from packaged binaries to comply with snap security policies. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The request to strip setuid/setgid bits during snapcraft builds was abandoned or superseded by upstream changes. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Abandoned. Closed without comments or resolution. The request to strip setuid/setgid bits from snapcraft maven builds was not addressed. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1990551 snapcraft 7 never drops permissions while doing builds invoked with sudo | snapcraft (launchpad) | closed | Closed without resolution due to inactivity. The report identifies a snapcraft 7 regression where sudo builds retain root privileges instead of dropping them, unlike snapcraft 6. No fix or discussion occurred. | |
| #1761598 Snapcraft modifies binaries | snapcraft (launchpad) | closed | Closed without resolution. Snapcraft 2.39.2 and 2.40.1 modified binaries by adding 4096 bytes, a regression from 2.35. The report was abandoned with no comments or fix applied. |