CODEWITHSUNDEEP
linuxnetwork-programmingpermissionssystem-administration
Chris Rapier
Chris Rapier

Reputation: 2109

Setcap is not working for raw sockets on custom distro

I'm in the process of building a small linux distro based on Debian for automated network testing. I am running into a pretty annoying problem though. A number of applications like paris-traceroute, ping, dublin-traceroute and so forth are not working correctly. They return an error of being unable to open a raw ICMP socket. I have tried using 'setcap cap_net_raw+ep ./application' and it's not working even though getcap indicates that the bits have been set.

I'm also running into the same problem if I try to use them as setuid root. They only work under sudo. So I'm wondering if I screwed up permissions on some intervening library or if there is some other issue.

Anyone run into something like this or have a solution?

Thanks!

Upvotes: 0

Views: 584

Answers (1)

Chris Rapier
Chris Rapier

Reputation: 2109

In case anyone comes across this I'll explain why this is failing. What I didn't mention is that the applications (like ping, etc) are actually installed in /opt. In this distro /opt actually and encfs file system that is only mounted after the livecd has been authorized against a licensing type of server (there are valid reasons for this - it automatically tests network connections and send the results to network engineer. We only want it to run within a specific time frame that would be associated with the user trouble ticket). So /opt isn't a real filesystem - it's an encrypted file mounted via fuse to looks like a file system. As such setcap and setuid don't actually work and likely cannot work.

Upvotes: 0

Related Questions