After installing Wireshark I had to add my user to the wireshark group to be able to capture packets without root access.
AFAIK Wireshark uses the libpcap library which itself uses the Netlink protocol to get the packets from the kernel infrastructures.And also Netlink requires constructing RAW sockets which needs root access.
My assumptions was :
- Either wireshark group has special permissions which makes it (and also each user in that group) able to capture packets without the need of being root or being a sudoer.
- Or it's much simpler. Wireshark just checks whether the current non-root user is in the wireshark group and if it is , then it can escalate it's privilege via something like setuid.
But the second assumption is false becuse the wireshark hasn't the setuid permission.
So what makes each user in the wireshark group able to capture packets without root access ? Or in a more general form : How does a supplementary group get such permissions ?
Thanks in advance.