0

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo.

I have a script like;

brctl addbr br-lan
ifconfig lo up

I have tried to set capabilities to my script with

sudo ./setcap cap_net_raw,cap_net_admin,cap_dac_override+eip 
./myscript.sh

But it didn't change anything.

To call './myscript.sh' returns the following output;

add bridge failed: Operation not permitted
SIOCSIFFLAGS: Operation not permitted

What should I do to run my script without root rights or which capabilities should I define to my script?

Tx.

|improve this question
  • Did you knew that sudo has fine-grained permissions. E.g. you can give one user permission to do one thing (with or without password). It is not all or nothing. – ctrl-alt-delor Jan 31 at 19:30
  • Why won't you consider using sudo? – roaima Feb 1 at 17:02
  • You should state your goal in addition to the mean, this is to avoid an XY problem. There are other methods. For example you can ask the part of your system handling network to setup the bridge, without this script. etc. We don't know why you want to do this. – A.B Feb 2 at 12:04
3

You cannot assign capabilities to a script, because it's the interpreter that requires them, not the script. If you can't use sudo you need to find some other way of running the script with root privileges.

Perhaps if you update your question to include some context (for example, mentioning why you can't use sudo, or why the script won't be naturally run under a root account) someone here might be able to provide some additional suggestions.

|improve this answer
  • As you say I can not set capabilities to my .sh script and now I am trying to set capabilities to ifconfig and brctl commands that is used in the sh script. – SayMyName Feb 1 at 15:56
  • 2
    If you add capabilities to those commands you will enable ANY USER on your system to run them. That's a really bad idea. Really bad. Why not edit your question to explain why sudo isn't acceptable - because it's by far the easiest option on the table. – roaima Feb 1 at 15:57
  • So what if I compile my own ifconfig and brctl codes and give them that capabilities is it bad idea too ? – SayMyName Feb 1 at 16:08
  • Yes it's a really bad idea. Why won't you consider using sudo? Both of us here are telling you the same thing. – roaima Feb 1 at 17:03
  • Platform dependency is my reason to use the setcap method.As you say I am going to try to set capabilities to just my executable files. Also, thank you for your answers. – SayMyName Feb 3 at 9:14
1

  • Did you knew that sudo has fine-grained permissions. E.g. you can give one user permission to do one thing (with or without password). It is not all or nothing.

  • Consider writing in golang or other high-level, compiled language. It will allow capabilities.

  • Consider using docker and giving some sudo privileges to manage this container. Beware container/image renames, may allow privilege escalation (not all containers/images with this name are the same), so beware of what you allow.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.