Supplementary groups' special permissions

Question

After installing Wireshark I had to add my user to the wireshark group to be able to capture packets without root access.

AFAIK Wireshark uses the libpcap library which itself uses the Netlink protocol to get the packets from the kernel infrastructures.And also Netlink requires constructing RAW sockets which needs root access.

My assumptions was :

1. Either wireshark group has special permissions which makes it (and also each user in that group) able to capture packets without the need of being root or being a sudoer.
   
2. Or it's much simpler. Wireshark just checks whether the current non-root user is in the wireshark group and if it is , then it can escalate it's privilege via something like setuid.

But the second assumption is false becuse the wireshark hasn't the setuid permission.

So what makes each user in the wireshark group able to capture packets without root access ? Or in a more general form : How does a supplementary group get such permissions ?

Thanks in advance.

Answer 1

It’s neither of these options; the permissions are carried by dumpcap, which takes care of the packet capture, and has the appropriate capabilities:

$ sudo getcap /usr/bin/dumpcap
/usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip

It is owned by root:wireshark, and executable only by its owner and group, so only usable by users in the wireshark group.

See /usr/share/wireshark/README.Debian.gz on your system for details.