iwlist scanning without root privileges

Question

I'm writing application where I need to scan one of wireless interfaces. In the past, my program was run with sudo and I used (in code):

iwlist wlanX scan

But now I want to allow to run program without root privileges. Will it be relatively safe if I change capabilities of /sbin/iwlist to cap_net_admin+eip? Iwlist is only for showing detailed wireless informations so broader access to this command probably is not very dangereous, right?

Answer 1

You can configure sudo so that members of a group can run a command without a password. Use visudo to edit the sudoers file:

# visudo

Add something similar to:

%mygroup ALL = (root) NOPASSWD: iwlist wlanX scan

to the bottom of the file (where mygroup is the name of your group preceded with a percent symbol).

You could also allow a single user to run this by changing %mygroup to myuser, where myuser is the username (note the lack of a percent symbol).

Or, you could allow everyone to scan by replacing %mygroup with ALL.

Using capabilities allows cap_net_admin for all iwlist commands wheras using sudo configured as above limits it to just one command with specific options. That has to be more secure.

Another (general) reason is that configuring sudo would be more portable than using capabilites, although that isn't relevant in this instance if you're just using to Linux.

Answer 2

if not obsessed with iwlist scan and wpa_supplicant is installed, you may try:

wpa_cli -i wlan0 scan > /dev/null; sleep 5; wpa_cli -i wlan0 scan_results

It does not require root privilege to run. And its output is similar to csv format which makes it easy to be parsed.

bssid / frequency / signal level / flags / ssid
aa:bb:cc:dd:ee:aa   5220    -26 [WPA2-PSK-CCMP][WPS][ESS]   AP-5G
aa:bb:cc:dd:ee:bb   5745    -62 [WPA-PSK-CCMP][WPA2-PSK-CCMP][ESS]  AP2
aa:bb:cc:dd:ee:cc   2412    -50 [WPA-PSK-CCMP][WPA2-PSK-CCMP][ESS]  AP3

Answer 3

You can configure sudo to not ask for a password.

Type in visudo and add lines such as this:

myuser ALL=(root) NOPASSWD: /sbin/iw wlan0 scan
myuser ALL=(root) NOPASSWD: /sbin/iwlist wlan0 scan

or

%mygroup ALL=(root) NOPASSWD: /sbin/iw wlan0 scan
%mygroup ALL=(root) NOPASSWD: /sbin/iwlist wlan0 scan

Note that you need to specify the full path to iw and that you still need to run using sudo but now you won't be prompted for your password.

sudo iw wlan0 scan

Thanks @garethTheRed for part of this answer.

Answer 4

The solution I found for this, a one-liner, was to set the setuid bit on the binary I wanted to execute (in my case, iwconfig):

sudo chmod u+s /sbin/iwconfig

Answer 5

If Network Manager is used on the system, then sudo privilege is not needed. Simply run:

nmcli dev wifi rescan

Immediately following this command (for maybe 30 seconds), the full list of available WiFi networks is visible, even to other tools.

For example, in my test:

iwlist scan             # lists 1 AP
nmcli dev wifi rescan
iwlist scan             # lists 8 APs