1

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the scanner part as root, as otherwise I will have only limited access to other processes' /proc/pid/ information. I would like to avoid running the scanner as root if possible, and I would like to avoid the hassle of dropping privileges.

Which Linux capability do I need to set for my scanner program so it can be run by non-root users and still see the complete /proc/pid/ tree?

1

I think the narrowest capability which fits the bill is CAP_DAC_READ_SEARCH, which grants the ability to read anything, ignoring DAC permissions (the traditional user/group/other permissions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.