Re: Ubuntu 14.04 user level capture permissions from source

[Jaap Keuter <jaap.keuter () xs4all nl>]

On 06/17/2014 03:44 PM, Jeff Morriss wrote:
> On 06/17/14 08:27, Alan Marchiori wrote:
> > I'm trying to build wireshark (1.10.6) from source on my Ubuntu 14.04
> > machine to work on a plugin. I also have the ubuntu wireshark package
> > installed and working properly from my user account and am able to
> > capture packets on eth0 (using the wireshark group). However, when I
> > build from source, my user account cannot capture on eth0.
> >
> > I have tried various options with the configure script, eg:
> > ./configure --enable-dumpcap --enable-setcap-install
> > --with-dumpcap-group=wireshark
> >
> > And set the capture properties to match the ubuntu package's dumpcap:
> > $ getcap /usr/local/bin/dumpcap
> > /usr/local/bin/dumpcap = cap_net_admin,cap_net_raw+eip
> >
> > src/wireshark-1.10.6$ getcap ./dumpcap
> > ./dumpcap = cap_net_admin,cap_net_raw+eip
> >
> > but still my compiled wireshark/dumpcap cannot access eth0.
> >
> > Any ideas?
>
> When you compile from source ./dumpcap isn't an binary executable, it's a
> (libtool) shell script.  Linux doesn't allow shell scripts to have capabilities
> nor be setuid so when you run it, it'll run as you and without the necessary
> capabilities.
>
> Unfortunately the only ways around this are to install what you've built (e.g.,
> "make install" or build a package and install it) or run as root (not a great
> idea--and if you're using a real plugin as opposed to a built-in dissector, your
> plugin won't get loaded while running as root from the build directory).


Ah, no, there's a way:

1) Run your own build of Wireshark once (which cannot show interfaces)
2) sudo /sbin/setcap cap_net_raw,cap_net_admin=eip .libs/lt-dumpcap
3) Run your Wireshark again, presto, interfaces listed

Enjoy,
Jaap


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe