how can I give a normal user write access to a network interface?

Question

I have a program that reads and writes packets to/from network interfaces, and normally I would add myself in the sudoers file and run the program like this:

sudo ./bridge

But now I need multiple users to run this program, but without giving them sudo rights, such that they could run the program like this:

./bridge

Does anyone know how can I accomplish this? I am running Scientific Linux 6.1 on a 64bit platform, if it helps.

Thanks, Claudiu

Answer 1

Add a sudo rule to allow that user to run your script. Run visudo and add something like this to the sudoers file:

Defaults!/path/to/bridge env_reset
alice, bill  ALL = (root) /path/to/bridge

Note that his allows the users to pass any argument to the /path/to/bridge program. Add "" at the end of the line to forbid passing any arguments.

For easier user management, you may prefer to define a group of users who are allowed to control the bridge. Replace alice, bill by %bridgers where bridgers is the name of the group.

Inside the bridge program, $SUDO_UID is the user ID of the user who invoked sudo. If the program requires that user to be in the USER variable, write a small wrapper shell script that sets USER=$SUDO_UID.

Answer 2

You can restrict in sudoers the commands that are allowed to run with sudo.

Write a small script ./bridge that call sudo ./real-bridge and give the users the right to run ./real-bridge as root via sudo.

Answer 3

I'm not sure if it works with eth devices, but this people do with tun devices.

$ tail -n1 /etc/udev/rules.d/20-kvm.rules 
KERNEL=="tun",          NAME="net/%k", GROUP="mygoodusers", MODE="0660"

See - GROUP="mygoodusers", MODE="0660" - on that line. Of course you have to put each user into that group.

udevadm control --reload-rules

but until reboot you have to chmod/chown manually.