2

I'm writing application where I need to scan one of wireless interfaces. In the past, my program was run with sudo and I used (in code):

iwlist wlanX scan

But now I want to allow to run program without root privileges. Will it be relatively safe if I change capabilities of /sbin/iwlist to cap_net_admin+eip? Iwlist is only for showing detailed wireless informations so broader access to this command probably is not very dangereous, right?

  • Why not simply modify your script to run sudo iwlist wlanX scan and configure sudo to run the command without asking for a password? – garethTheRed Nov 21 '14 at 11:25
  • Is this better solution? Why? Do you mean modify sudoers file, right? If my application will be installed from deb on other computer how should I do this change (I don't know the name of user)? – trivelt Nov 21 '14 at 11:38
2

You can configure sudo so that members of a group can run a command without a password. Use visudo to edit the sudoers file:

# visudo

Add something similar to:

%mygroup ALL = (root) NOPASSWD: iwlist wlanX scan

to the bottom of the file (where mygroup is the name of your group preceded with a percent symbol).

You could also allow a single user to run this by changing %mygroup to myuser, where myuser is the username (note the lack of a percent symbol).

Or, you could allow everyone to scan by replacing %mygroup with ALL.

Using capabilities allows cap_net_admin for all iwlist commands wheras using sudo configured as above limits it to just one command with specific options. That has to be more secure.

Another (general) reason is that configuring sudo would be more portable than using capabilites, although that isn't relevant in this instance if you're just using to Linux.

  • >>> /etc/sudoers: syntax error near line 32 <<< Line 32 is mat ALL = (root) NOPASSWD: iwlist wlan0 scan – mjaggard Sep 5 '16 at 6:50
  • 1
    Check lines before 32? It does say near :-) – garethTheRed Sep 5 '16 at 7:01
  • The error is on line 32 - if I remove that line then it works. All of the rest of my sudoers file is the default. – mjaggard Sep 6 '16 at 12:02
  • I got rid of that error by using this mat ALL=(root) NOPASSWD: /sbin/iw but now I just get command failed: Operation not permitted (-1) when I run /sbin/iw wlan0 scan – mjaggard Sep 6 '16 at 12:04
  • 1
    I've tried again. Used mat ALL=(root) NOPASSWD: /sbin/iw wlan0 scan this time and it worked. One thing I didn't realise before is that you still have to specify sudo it just doesn't ask for a password anymore. – mjaggard Sep 6 '16 at 12:09
1

You can configure sudo to not ask for a password.

Type in visudo and add lines such as this:

myuser ALL=(root) NOPASSWD: /sbin/iw wlan0 scan
myuser ALL=(root) NOPASSWD: /sbin/iwlist wlan0 scan

or

%mygroup ALL=(root) NOPASSWD: /sbin/iw wlan0 scan
%mygroup ALL=(root) NOPASSWD: /sbin/iwlist wlan0 scan

Note that you need to specify the full path to iw and that you still need to run using sudo but now you won't be prompted for your password.

sudo iw wlan0 scan

Thanks @garethTheRed for part of this answer.

0

The solution I found for this, a one-liner, was to set the setuid bit on the binary I wanted to execute (in my case, iwconfig):

sudo chmod u+s /sbin/iwconfig
0

If Network Manager is used on the system, then sudo privilege is not needed. Simply run:

nmcli dev wifi rescan

Immediately following this command (for maybe 30 seconds), the full list of available WiFi networks is visible, even to other tools.

For example, in my test:

iwlist scan             # lists 1 AP
nmcli dev wifi rescan
iwlist scan             # lists 8 APs
0

if not obsessed with iwlist scan and wpa_supplicant is installed, you may try:

wpa_cli -i wlan0 scan > /dev/null; sleep 5; wpa_cli -i wlan0 scan_results

It does not require root privilege to run. And its output is similar to csv format which makes it easy to be parsed.

bssid / frequency / signal level / flags / ssid
aa:bb:cc:dd:ee:aa   5220    -26 [WPA2-PSK-CCMP][WPS][ESS]   AP-5G
aa:bb:cc:dd:ee:bb   5745    -62 [WPA-PSK-CCMP][WPA2-PSK-CCMP][ESS]  AP2
aa:bb:cc:dd:ee:cc   2412    -50 [WPA-PSK-CCMP][WPA2-PSK-CCMP][ESS]  AP3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.