I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works.

[root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu
[root@lilegg johny]# exit
[johny@lilegg ~]$ wifi-menu 
wifi-menu needs root privileges

What's my mistake?

  • 1
    Capabilities won't help as the UID check is hard-coded into the wifi-menu script: (( EUID == 0 )) || exit_error "${1-$0} needs root privileges" Dec 10, 2019 at 17:15
  • Also note, that setting capabilities on the script itself is useless even if this check would be absent (and even if the kernel supports capabilities on scripts - I'm not sure that this is considered safe and is allowed): the capability won't be inherited by commands requiring the privileges (executed by the script). Dec 10, 2019 at 17:26
  • i thought eip can be set to bequeath same permissions to sub-calls. Seems it's usefulness would be pretty limited otherwise.
    – johny why
    Dec 10, 2019 at 18:46
  • @DanilaKiver "not sure that this is considered safe" -- I thought the whole point of setcap is that it's safer than blanket privileged access. "Capabilities allow system administrators to fine-tune what a process is allowed to do, which may help them significantly reduce security risks to their system" linuxjournal.com/article/5737
    – johny why
    Dec 10, 2019 at 18:50
  • @DanilaKiver "the UID check is hard-coded" - so, to overcome this, i can remove the UID and re-compile, correct?
    – johny why
    Dec 10, 2019 at 18:52


You must log in to answer this question.

Browse other questions tagged .