5

I'm trying to execute traceroute -d being authenticated as a "standard" user with sudo privileges. However if I run sudo traceroute -d it will be execute by the root user so I'm wondering how can I execute it as the standard user. I've tried several ways to make the user basically a super user (aka root) but without success.

The only thing that worked was to change the uid and group id to 0 on /etc/passwd but that changes the user "identity" to "root". E.g. if I run whoami I get "root" instead the "standard" user name.

The reason why i need this is that I have some networking routing based on the --uid-owner and now I'm trying to debug it but it doesn't make sense to run with sudo b/c it would be execute as "root" user which has other routings.

  • 3
    What about tracepath? tracepath doesn't need root. – muru Dec 9 '14 at 15:21
  • It's also possibile that traceroute only needs some capability. But I have never really understood the capabilities system. – muru Dec 9 '14 at 15:58
  • If you're having problems editing sudoers doesn't work, then you should fix that problem first, rather than trying to find a workaround. sudoers can be fixed pretty easily. – mikemaccana Dec 9 '14 at 16:49
  • I'm wondering if I can make the standard user work like a root user except its identity (.e.g username is myuser not root) even temporary – Me Mi Dec 9 '14 at 17:03
  • With a reasonably recent Linux kernel, you could make a namespace with its own network setup and where the user is root. – Gilles Dec 9 '14 at 23:39
4

traceroute need not run as root; it just needs the capability CAP_NET_ADMIN. Thus you can set this as file capability for the file and then traceroute will always have this capability (for all users, though), if your kernel supports file capabilities and no Linux Security Module (SELinux, AppArmor) is blocking it:

setcap CAP_NET_ADMIN+ep /usr/sbin/traceroute

While traceroute is running you can see its capabilities with pscap. This does not affect the UID/EUID of the process.

I don't know how to do that but AFAIK it is possible, too, to use AppArmor (and probably SELinux) to run a process with certain capabilities. The main task is, of course, to limit the available capabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.