Add capabilities to artifacts #815

Stevenjin8 · 2025-10-24T14:11:10Z

What this PR does / why we need it:

This allows for setting capabilities for binaries in artifacts. This is helpful in contexts that do not allow for privilege escalation.

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #

Special notes for your reviewer:

Copilot

Pull Request Overview

This PR adds support for setting POSIX capabilities on artifacts in Dalec package specifications. This feature enables binaries to have specific Linux capabilities (like cap_net_raw) without requiring privilege escalation, which is useful in restricted security contexts.

Key changes:

Added Capabilities field to ArtifactConfig struct for specifying capability strings
Implemented capability setting in both RPM and DEB packaging backends using setcap commands
Added integration test verifying capability setting works end-to-end

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
artifacts.go	Added `Capabilities` field to ArtifactConfig struct with documentation
docs/spec.schema.json	Updated JSON schema to include the new capabilities field
packaging/linux/rpm/template.go	Implemented `getArtifactCapabilities()` to generate setcap commands in RPM %post scriptlet
packaging/linux/deb/debroot.go	Implemented `setArtifactCapabilitiesPostInst()` to generate setcap commands in DEB postinst script
test/linux_target_test.go	Added `testArtifactCapabilities` integration test that verifies capability setting on a binary

test/linux_target_test.go

packaging/linux/deb/debroot.go

test/linux_target_test.go

MorrisLaw · 2025-10-24T14:18:27Z

packaging/linux/deb/debroot.go

+	apply(artifacts.ConfigFiles, ConfigFilesPath)
+	apply(artifacts.Manpages, filepath.Join(ManpagesPath, spec.Name))
+	apply(artifacts.Headers, HeadersPath)
+	apply(artifacts.Licenses, filepath.Join(LicensesPath, spec.Name))


I think copilot is right about not needing to set something like "capabilities" on non-binaries.

its a little weird, but you could say the same thing about making files here executable, and that's perfectly allowed. So it seems inconsistent to be able to make a license or manpage executable, but not give it any capabilities

that's a fair point

You could make the argument the other way around though, caps are only relevant to actual binaries while permissions are relevant to everything. Up to you, I don't feel strongly

The undocumented macro for RPM just lands in the files section. I think this is ok, document that it isn;t supported?

docs/spec.schema.json

artifacts.go

jeremyrickard · 2025-10-27T15:27:11Z

packaging/linux/deb/debroot.go

+			}
+			resolved := cfg.ResolveName(key)
+			p := filepath.Join(root, cfg.SubPath, resolved)
+			fmt.Fprintf(w, "setcap %s \"$DESTDIR%s\"\n", cfg.Capabilities, p)


can we do this with the RPM macro?

see other comment

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

test/linux_target_test.go

artifacts.go

packaging/linux/deb/debroot.go

packaging/linux/rpm/template.go

test/linux_target_test.go

cpuguy83 · 2025-11-04T17:57:51Z

artifacts.go

 	// Group is the group name that should own the artifact
 	Group string `yaml:"group,omitempty" json:"group,omitempty"`
+	// Capabilities is the list of POSIX capabilities to set on the artifact
+	Capabilities []ArtifactCapability `yaml:"capabilities,omitempty" json:"capabilities,omitempty"`


Nit: LinuxCapabilities

Ping @Stevenjin8

I swear I fixed this

@cpuguy83 fixed. Sorry about that.

cpuguy83 · 2025-11-25T20:56:28Z

Needs a go generate ./...

Signed-off-by: Steven Jin Xuan <[email protected]>

Co-authored-by: Copilot <[email protected]> Signed-off-by: Steven Jin <[email protected]>

Signed-off-by: Steven Jin Xuan <[email protected]>

Stevenjin8 · 2025-11-26T14:39:16Z

@cpuguy83 I rebased, but 2373892 is the first new commit.

cpuguy83

Seems to be missing the last change to swtich to linux_capabilities

Signed-off-by: Steven Jin Xuan <[email protected]>

Copilot AI review requested due to automatic review settings October 24, 2025 14:11

Copilot AI reviewed Oct 24, 2025

View reviewed changes

test/linux_target_test.go Outdated Show resolved Hide resolved

packaging/linux/deb/debroot.go Outdated Show resolved Hide resolved

test/linux_target_test.go Outdated Show resolved Hide resolved

MorrisLaw reviewed Oct 24, 2025

View reviewed changes

docs/spec.schema.json Outdated Show resolved Hide resolved

Stevenjin8 requested a review from MorrisLaw October 24, 2025 15:19

Stevenjin8 force-pushed the feature/artifact-caps branch 2 times, most recently from c2896eb to 9776fc9 Compare October 24, 2025 15:40

Stevenjin8 commented Oct 27, 2025

View reviewed changes

artifacts.go Outdated Show resolved Hide resolved

jeremyrickard reviewed Oct 27, 2025

View reviewed changes

Stevenjin8 force-pushed the feature/artifact-caps branch from 3f3d1e8 to 8fb567c Compare October 28, 2025 16:00

Stevenjin8 requested review from Copilot and jeremyrickard October 28, 2025 16:01

Copilot AI reviewed Oct 28, 2025

View reviewed changes

Stevenjin8 force-pushed the feature/artifact-caps branch 2 times, most recently from 331e0ac to 63a5a68 Compare October 28, 2025 17:51

Stevenjin8 requested a review from cpuguy83 October 31, 2025 19:10

Stevenjin8 force-pushed the feature/artifact-caps branch from 226d13c to ef7af3a Compare November 3, 2025 17:53

cpuguy83 reviewed Nov 4, 2025

View reviewed changes

Stevenjin8 force-pushed the feature/artifact-caps branch from 5596177 to 2b546b7 Compare November 4, 2025 18:25

Stevenjin8 requested a review from cpuguy83 November 6, 2025 04:15

Stevenjin8 force-pushed the feature/artifact-caps branch from a310dee to dbcc92c Compare November 6, 2025 04:38

Stevenjin8 force-pushed the feature/artifact-caps branch from 049ba54 to 2b88f81 Compare November 25, 2025 20:54

cpuguy83 approved these changes Nov 25, 2025

View reviewed changes

Stevenjin8 temporarily deployed to deploy-docs November 26, 2025 01:10 — with GitHub Actions Inactive

Stevenjin8 force-pushed the feature/artifact-caps branch from bc4ec94 to 429459e Compare November 26, 2025 01:34

Stevenjin8 temporarily deployed to deploy-docs November 26, 2025 01:34 — with GitHub Actions Inactive

Stevenjin8 added 3 commits November 25, 2025 20:37

Add capabilities

431d65c

Signed-off-by: Steven Jin Xuan <[email protected]>

Fix tests

49bf261

Signed-off-by: Steven Jin Xuan <[email protected]>

lint

eb887dd

Signed-off-by: Steven Jin Xuan <[email protected]>

Stevenjin8 and others added 16 commits November 25, 2025 20:37

better cap api

fe45d62

Signed-off-by: Steven Jin Xuan <[email protected]>

typo

4b37894

Signed-off-by: Steven Jin Xuan <[email protected]>

Update test/linux_target_test.go

de3a4ec

Co-authored-by: Copilot <[email protected]> Signed-off-by: Steven Jin <[email protected]>

correct setcap syntax

cf02f8f

Signed-off-by: Steven Jin Xuan <[email protected]>

Fix tests

ab72d90

Signed-off-by: Steven Jin Xuan <[email protected]>

use rpm macro for caps (sometimes)

8bfba42

Signed-off-by: Steven Jin Xuan <[email protected]>

coreutils in caps test

7987537

Signed-off-by: Steven Jin Xuan <[email protected]>

validate that caps can't be in weird places

bf4e05b

Signed-off-by: Steven Jin Xuan <[email protected]>

typo

5f0668f

Signed-off-by: Steven Jin Xuan <[email protected]>

lint

453dcb5

Signed-off-by: Steven Jin Xuan <[email protected]>

remove extra code

8d962f0

Signed-off-by: Steven Jin Xuan <[email protected]>

Dont use chmod in deb builds if possible

aaa6bc9

Signed-off-by: Steven Jin Xuan <[email protected]>

nit

2373892

Signed-off-by: Steven Jin Xuan <[email protected]>

generate

df614b9

Signed-off-by: Steven Jin Xuan <[email protected]>

fixup test

e07acd7

Signed-off-by: Steven Jin Xuan <[email protected]>

Fix users on debian and add postinstall reqs

d4a7096

Signed-off-by: Steven Jin Xuan <[email protected]>

Stevenjin8 force-pushed the feature/artifact-caps branch from 429459e to d4a7096 Compare November 26, 2025 01:37

cpuguy83 requested changes Nov 26, 2025

View reviewed changes

Change capabilities field name to LinuxCapabilities

350425a

Signed-off-by: Steven Jin Xuan <[email protected]>

Stevenjin8 force-pushed the feature/artifact-caps branch from fc7be1e to 350425a Compare November 26, 2025 19:05

Stevenjin8 requested a review from cpuguy83 November 26, 2025 19:18

naming...

f70fba5

Signed-off-by: Steven Jin Xuan <[email protected]>

Stevenjin8 force-pushed the feature/artifact-caps branch from d2dbb2e to f70fba5 Compare November 26, 2025 19:33

cpuguy83 approved these changes Nov 26, 2025

View reviewed changes

cpuguy83 merged commit 6e30f3f into project-dalec:main Nov 26, 2025
44 of 45 checks passed

Add capabilities to artifacts #815

Add capabilities to artifacts #815

Conversation

Stevenjin8 commented Oct 24, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cpuguy83 commented Nov 25, 2025

Uh oh!

Stevenjin8 commented Nov 26, 2025

Uh oh!

cpuguy83 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants