I need to add an iptables rule from the inside of a C Linux program.

How should I do? Do I need root privilege or can I just grant some capabilities?

I tried granting CAP_NET_RAW+iep and using popen(), system() and execve() to set iptables but it doesn't work.

It obviously works when I sudo but I would like not to grant root privilege.

Thank you.

  • Looking at this (specifically 4.6.3 underneath "set") it seems to imply NET_ADMIN is the capability responsible for that. What happens when you give that capability to the iptables executable (/sbin/iptables-multi-1.4.7 on my system) and try to run it as non-root? – Bratchley Oct 5 '15 at 19:13
  • But for the "can I just grant some capabilities" the answer is almost always "yes" for things like that. Unless you need it to be the "root" user for specifically for some reason, it's usually just a matter of figuring out what capability root has that your regular users don't in regards to the operation. – Bratchley Oct 5 '15 at 19:16
  • iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) – the structure Oct 5 '15 at 19:19
  • I'm afraid it's something about inheritance since I'm not calling iptables directly. – the structure Oct 5 '15 at 19:29

You don't need to grant root privilege to a user. you can edit your sudoers file and you can limit which commands a user can run via sudo. also, you can provide a NOPASSWD option in sudoers file.

MY_USER_NAME  ALL = NOPASSWD: /sbin/iptables

after editing your sudoers file MY_USER_NAME is able to run "sudo iptables" command. and can't run any other privilege needed commands.

use "visudo" command to edit your sudoers file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.