Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running:

tcpdump -w output.pcap

because it can be only used with root :(

share|improve this question
up vote 2 down vote accepted

Apparently yes, from Wikipedia's OpenBSD entry (and this one):

Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the file system, prohibiting it from accessing areas that contain private or system files. Developers have applied these features to OpenBSD versions of common applications, including tcpdump and the Apache web server.

The article refers to the CVS log (this commit) for details. There is a mailing list discussion about this (which I haven't read), too.

Long story short, OpenBSD's tcpdump from the base system is privilege separated already. (And I can't comment on their solution vs. Capsicum.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.