should not remove suid/guid from binaries when confinement is devmode
Metadata
Current evaluation
Requests that snapcraft keep suid/sgid bits on extracted binaries when building devmode snaps (oxide/chrome-sandbox aborted). Maintainers say stripping is intentional; workarounds are userns sandbox, browser-support allow-sandbox:true, or OXIDE_NO_SANDBOX.
Suggested action: close not a bug
Reason: jdstrand explicitly stated the behaviour is by design ('snapcraft is correctly stripping this') because snaps are packed with -all-root and unconditional suid/sgid support 'would need very careful design', and gave documented workarounds ('allow-sandbox: true' in browser-support, unsquash + re-set bits, or OXIDE_NO_SANDBOX=1). The real fix was pushed to oxide's userns sandbox (bugs #1447345 / #1651166), which the reporter agreed with. Stripping still exists today in craft-parts' craft_parts/packages/normalize.py::_fix_filemode with no devmode handling, so nothing regressed. Uncertainty remains because no maintainer explicitly closed it and the issue is still open after 10 years.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
28
Quick Win:
6
Complexity:
45
Confidence:
74
Actionability:
40
|
close not a bug | Requests that snapcraft keep suid/sgid bits on extracted binaries when building devmode snaps (oxide/chrome-sandbox aborted). Maintainers say stripping is intentional; workarounds are userns sandbox, browser-support allow-sandbox:true, or OXIDE_NO_SANDBOX. | |
| stealth/space-bunny-alpha |
Impact:
28
Quick Win:
2
Complexity:
78
Confidence:
91
Actionability:
32
|
close not a bug | Request to preserve setuid/setgid bits in devmode snaps was rejected; maintainers said stripping was correct and recommended user-namespace or disabled Chromium sandbox alternatives. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
11
Complexity:
55
Confidence:
70
Actionability:
60
|
keep open | Feature request to preserve suid/guid bits on binaries when building snaps in devmode confinement, as they are currently unconditionally stripped during package normalization in craft-parts. | |
| qwen/qwen3.8-27b |
Impact:
35
Quick Win:
19
Staleness:
92
Complexity:
45
Confidence:
55
Support Request:
25
|
needs triage | Snapcraft strips SUID/SGID bits during pack, breaking oxide chrome-sandbox in devmode. Request to preserve bits when confinement is devmode. Open 10 years, no labels, no comments, never triaged. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
15
Confidence:
70
Support Request:
10
|
needs triage | Request to preserve SUID/GUID bits during snapcraft builds in devmode for unconfined testing. Unlabelled, zero comments, and inactive for over nine years. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
65
Confidence:
90
Support Request:
20
|
close stale | Unaddressed request to preserve SUID/GUID bits during snapcraft builds in devmode for unconfined testing. Issue remains open with zero maintainer interaction after over 10 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
90
Support Request:
10
|
close stale | Feature request to preserve SUID/GUID bits during snapcraft builds in devmode to support testing unconfined packages. Issue is over 9 years old with no maintainer engagement or comments. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Blocked By:
oxide#1651166
(confidence 55%)
jdstrand and reporter agreed the preferred fix is an oxide snapcraft part/userns sandbox support tracked in oxide bug #1651166.
-
Blocked By:
snapd#1586547
(confidence 45%)
Cited by jdstrand as the underlying snapd userns sandbox support needed to replace the setuid sandbox.
Related issues
No related issues found above the similarity threshold.