I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark:

root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground wgnet0
fatal error: Invalid argument
usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]

 Note <filename> must be a regular (non-symlink) file.

The man page doesn't seem very helpful and I can't find an option which will allow me to execute a binary with arbitrary arguments.

If I remove the arguments, everything works, but I need to pass these arguments.


setcap stores the given capabilities in the given file’s metadata (as extended attributes, see the Arch wiki for details):

setcap cap_net_admin+epi /usr/local/sbin/boringtun

means that boringtun will have those capabilities when it’s run thereafter:

/usr/local/sbin/boringtun --foreground wgnet0
  • Oh, fascinating; it actually writes to the file? – Naftuli Kay Apr 4 at 21:56
  • 1
    Not to the file itself, to its extended attributes. – Stephen Kitt Apr 5 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.