3

I've been using nethogs for a while now, having to sudo every time, while ping has the setuid bit set. Today I set it for nethogs and it works:

$ ls -l $(which nethogs) $(which ping)
-rwxr-xr-x 1 root root  64496 Nov  2  2011 /usr/sbin/nethogs
-rwsr-xr-x 1 root root 44168 May  7 17:21 /bin/ping

$ sudo chmod u+s  $(which nethogs)

$ ls -l $(which nethogs)
-rwsr-xr-x 1 root root 64496 Nov  2  2011 /usr/sbin/nethogs

$ nethogs

Can you think of any reason not to install it by default like this?

6

ping is setuid because it, while fairly "safe", requires the ability to open raw sockets. Consequently it needs the CAP_NET_RAW capability, or to be root.

nethogs is different for a few reasons: notably, it not only requires privileged access to the networking stack, but it shows information about other users. On a multi-user system you may not want just any user to be able to see who's using what.

Another reason is that nethogs is a fairly complicated program. Programs that run setuid need to be extra-secure: a buffer overflow, say, could lead to arbitrary privilege elevation. ping takes quite some care to be secure, and even detects who's actually running it to behave differently (ping -f only works if you're actually root, for example). It's easier to be confident about that in a small non-interactive program than in a larger tool like nethogs.

Requiring the user to have root access already avoids those sorts of concerns, or delegates them to sudo. There's no(t as much) concern about privilege elevation when you're already root. In general, programs aren't made setuid-by-default unless it's vitally necessary to their function, like passwd.

That said, on a single-user system, or one where you're not concerned about those issues, making it setuid for your own convenience isn't a significant problem.

  • That's close to what I suspected (complexity and being able to snoop on other users' activity). It's good to have some educated confirmation. Thanks! – arielCo Jul 4 '14 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.