[snap] Unable to run setuid/setgid commands from terminal

[stgraber]

Issue Type: Bug

Trying to run any command which is setuid/setgid like "sudo" or a command which indirectly goes through a setuid/setgid wrapper like another snap ("go" in my case) fails with confusing errors like:

stgraber@castiana:~$ sudo ls
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

or:

stgraber@castiana:~$ go
need to run as root or suid

The source of this issue is that Code and all its children run with the "No new privileges" kernel feature enabled. This effectively prevents any setuid/setgid bits or filesystem capabilities from taking effect and is causing this issue.

stgraber@castiana:~$ grep Priv /proc/self/status
NoNewPrivs:     1

As far as I can tell this is coming from Electron and there appears to be a related fix here for the built-in version of Chromium:
electron/electron#19953

This fix or some variant of it should be included in the Code snap such that one can build and run "go" commands when Go is installed as a snap.
Or also allow running anything through sudo.

VS Code version: Code 1.42.1 (c47d83b, 2020-02-11T14:50:36.977Z)
OS version: Linux x64 5.4.0-14-generic snap

System Info

Item	Value
CPUs	Intel(R) Core(TM) i5-7300U CPU @ 2.60GHz (4 x 3500)
GPU Status	2d_canvas: unavailable_software flash_3d: disabled_software flash_stage3d: disabled_software flash_stage3d_baseline: disabled_software gpu_compositing: disabled_software metal: disabled_off multiple_raster_threads: enabled_on oop_rasterization: disabled_off protected_video_decode: disabled_off rasterization: disabled_software skia_renderer: disabled_off surface_control: disabled_off surface_synchronization: enabled_on video_decode: disabled_software viz_display_compositor: enabled_on viz_hit_test_surface_layer: disabled_off webgl: unavailable_software webgl2: unavailable_software
Load (avg)	1, 1, 2
Memory (System)	15.39GB (2.38GB free)
Process Argv	--force-user-env --no-sandbox --unity-launch --no-sandbox
Screen Reader	no
VM	0%

Extensions (3)

Extension	Author (truncated)	Version
Go	ms-	0.13.0
vsliveshare	ms-	1.0.1615
material-theme	zhu	3.2.2

(1 theme extensions excluded)

[stgraber]

Hmm, well, that's weird, restarted code and now the issue is gone...
So I don't know if I inherited the NoNewPrivs from something else earlier or what, but closing for now.