Why sudo isn't acceptable?

Question

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo.

I have a script like;

brctl addbr br-lan
ifconfig lo up

I have tried to set capabilities to my script with

sudo ./setcap cap_net_raw,cap_net_admin,cap_dac_override+eip 
./myscript.sh

But it didn't change anything.

To call './myscript.sh' returns the following output;

add bridge failed: Operation not permitted
SIOCSIFFLAGS: Operation not permitted

What should I do to run my script without root rights or which capabilities should I define to my script?

Tx.

Answer 1

You cannot assign capabilities to a script, because it's the interpreter that requires them, not the script. If you can't use sudo you need to find some other way of running the script with root privileges.

Perhaps if you update your question to include some context (for example, mentioning why you can't use sudo, or why the script won't be naturally run under a root account) someone here might be able to provide some additional suggestions.

Answer 2

• Did you knew that sudo has fine-grained permissions. E.g. you can give one user permission to do one thing (with or without password). It is not all or nothing.

• Consider writing in golang or other high-level, compiled language. It will allow capabilities.

• Consider using docker and giving some sudo privileges to manage this container. Beware container/image renames, may allow privilege escalation (not all containers/images with this name are the same), so beware of what you allow.