6

I'm trying to execute traceroute -d being authenticated as a "standard" user with sudo privileges. However if I run sudo traceroute -d it will be execute by the root user so I'm wondering how can I execute it as the standard user. I've tried several ways to make the user basically a super user (aka root) but without success.

The only thing that worked was to change the uid and group id to 0 on /etc/passwd but that changes the user "identity" to "root". E.g. if I run whoami I get "root" instead the "standard" user name.

The reason why i need this is that I have some networking routing based on the --uid-owner and now I'm trying to debug it but it doesn't make sense to run with sudo b/c it would be execute as "root" user which has other routings.

Improve this question
5
  • 3
    What about tracepath? tracepath doesn't need root.
    – muru
    Commented Dec 9, 2014 at 15:21
  • It's also possibile that traceroute only needs some capability. But I have never really understood the capabilities system.
    – muru
    Commented Dec 9, 2014 at 15:58
  • If you're having problems editing sudoers doesn't work, then you should fix that problem first, rather than trying to find a workaround. sudoers can be fixed pretty easily.
    – mikemaccana
    Commented Dec 9, 2014 at 16:49
  • I'm wondering if I can make the standard user work like a root user except its identity (.e.g username is myuser not root) even temporary
    – Me Mi
    Commented Dec 9, 2014 at 17:03
  • With a reasonably recent Linux kernel, you could make a namespace with its own network setup and where the user is root.
    – Gilles 'SO- stop being evil'
    Commented Dec 9, 2014 at 23:39

1 Answer 1

Reset to default
5

traceroute need not run as root; it just needs the capability CAP_NET_ADMIN. Thus you can set this as file capability for the file and then traceroute will always have this capability (for all users, though), if your kernel supports file capabilities and no Linux Security Module (SELinux, AppArmor) is blocking it:

setcap CAP_NET_ADMIN+ep /usr/sbin/traceroute

While traceroute is running you can see its capabilities with pscap. This does not affect the UID/EUID of the process.

I don't know how to do that but AFAIK it is possible, too, to use AppArmor (and probably SELinux) to run a process with certain capabilities. The main task is, of course, to limit the available capabilities.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .