3

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option.

My attempt:

sudo setcap 'CAP_NET_BIND_SERVICE,CAP_NET_RAW=+ep' /sbin/dhclient

I then confirmed with getcap the the capabilities were in fact set properly. But when I run I get an Operation not permitted. I then ran it under strace and that shows several socket(PF_NETLINK, SOCK_RAW, 0) = 4 among other syscalls and ends with socket(PF_PACKET, SOCK_RAW, 768) = -1 EPERM (Operation not permitted) Everything I read on PF_PACKET says it should just need cap_net_raw.

Linux 3.16.0-77-generic #99~14.04.1-Ubuntu SMP Tue Jun 28 19:17:10 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

  • When you launch a program using strace, it can't get extra privs (setuid or whatever). strace uses the same powers as debuggers like gdb, which have complete power over the sub-process, so you could do whatever you wanted and this would be a security hole. Hopefully you can get more useful results sudo strace setpriv --reuid=Daniel --regid=Daniel --clear-groups /sbin/dhclient .... I.e. when the tracing program is fully privileged already, it's allowed to trace whatever it likes. – sourcejedi Mar 14 '18 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.