CODEWITHSUNDEEP
linuxdockerpermissionscentoscentos7
olelink
olelink

Reputation: 23

setcap cap_net_admin in linux containers prevents user access to every file

I have a tcpdump application in a CentOS container. I was trying to run tcpdump as nonroot. Following this forum post: https://askubuntu.com/questions/530920/tcpdump-permissions-problem (and some other documentation that reinforced this), I tried to use setcap cap_net_admin+eip /path/to/tcpdump in the container.

After running this, I tried to run tcpdump as a different user (with permissions to tcpdump) and I got "Operation Not Permitted". I then tried to run it as root which had previously been working and also got, "Operation Not Permitted". After running getcap, I verified that the permissions were what they should be. I thought it may be my specific use case so I tried running the setcap command against several other executables. Every single executable returned "Operation Not Permitted" until I ran setcap -r /filepath.

Any ideas on how I can address this issue, or even work around it without using root to run tcpdump?

Upvotes: 0

Views: 5123

Answers (1)

BMitch
BMitch

Reputation: 264701

The NET_ADMIN capability is not included in containers by default because it could allow a container process to modify and escape any network isolation settings applied on the container. Therefore explicitly setting this permission on a binary with setcap is going to fail since root and every other user in the container is blocked from that capability. To run a container with this, you would need to add this capability onto the container with the command used to start your container. e.g.

docker run --cap-add NET_ADMIN ...

However, I believe all you need is NET_RAW (setcap cap_net_raw) which is included in the default capabilities. From man capabilities:

   CAP_NET_RAW
          * Use RAW and PACKET sockets;
          * bind to any address for transparent proxying.

Upvotes: 4

Related Questions