2

Calling dhclient as root works beautifully on my debian machine. However, I would like to allow some users to execute dhclient, too. So far, I have tried these two examples:

Example 1: When a normal user calls

user@box:~$ dhclient

..., the result is:

bash: dhclient: command not found

Example 2: I have also tried

user@box:~$ /sbin/dhclient

..., and got

[...]

can't create /var/lib/dhcp3/dhclient.leases: Permission denied
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
SIOCSIFFLAGS: Permission denied
Open a socket for LPF: Operation not permitted

Now... I have the feeling it is neither a good a idea (or would work) to chmod the entire /sbin directory for user access, nor does it appear to be elegant to chmod everything dhclient complains about in the second example above. What is the best and safest way to attack this issue?

5

Install and use sudo. It's the one and most sane way of doing these things. dhclient really needs root privileges, there's no way around it.

Allow specific users to execute a single command with root privileges. This can be configured in a /etc/sudoers file like this (edit using visudo):

Cmnd_Alias     DHCP = /usr/sbin/dhclient
User_Alias     DCHPUSERS = millert, mikef, dowdy

DCHPUSERS      ALL = NOPASSWD: DHCP

Above is just one way of configuring sudo. If you have a lot of users to administer like this, I suggest to use a local user group instead of specifying individual users.

4

I know this has already been answered, but I found this question when searching and the proposed answer was not appropriate for my case.

I managed to run dhcpd as a normal user by attributing special capabilities to the dhcpd binary:

sudo setcap CAP_NET_BIND_SERVICE,CAP_NET_RAW=+ep $(which dhcpd)

Here's a small description of the attributed capabilities:

CAP_NET_BIND_SERVICE allows binding ports lower than 1024
CAP_NET_RAW allows using RAW and Packet sockets and address binding (for LPF socket).

see man capabilities for an extended description. Later I was able to run dhcpd as follows:

Triglav-Control-Engine-1v1% sudo setcap CAP_NET_BIND_SERVICE,CAP_NET_RAW=+ep $(which dhcpd)
Triglav-Control-Engine-1v1% dhcpd -4 -f -d -s 169.254.13.1 -cf dhcpd.conf -lf leases
Internet Systems Consortium DHCP Server 4.3.4
Copyright 2004-2016 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Config file: dhcpd.conf
Database file: /home/roosemberth/.config/dhcpd/leases
PID file: /var/run/dhcpd.pid
Source compiled to use binary-leases
Wrote 0 leases to leases file.

Listening on LPF/enp0s31f6/<MAC>/169.254.13.0/24
Sending on   LPF/enp0s31f6/<MAC>/169.254.13.0/24
Sending on   Socket/fallback/fallback-net
Can't create PID file /var/run/dhcpd.pid: Permission denied.
Server starting service.
DHCPDISCOVER from 50:7b:9d:af:e8:59 via enp0s31f6
  • I suspect this would be reset if you upgrade the DHCP client software, so be prepared to re-run setcap. Otherwise, this is a decent idea; very little software truly needs root, it usually only needs a subset of root capabilities and for that, setcap is a good way to give the required permissions. Principle of least privilege. – a CVn Aug 7 '16 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.