Replace setuid bit to cap_net_raw capability

[Andrei Dziahel]

Hello list,

I'm Ubuntu fugitive and frequent user of mtr utility
(https://build.opensuse.org/package/show/network:utilities/mtr). In
ubuntu mtr could be run by restricted user, but not in OpenSUSE,
complaining with "unable to get raw sockets" message.

By adding cap_net_raw capability to /usr/sbin/mtr with

sudo /sbin/setcap cap_net_raw+ep /usr/sbin/mtr

(found in libcap-progs package) and then fixing permissions by
removing suid bit and making all users run it with

sudo chmod -s+rx /usr/sbin/mtr

I've managed to successfully run mtr as unprivileged user.

I'm almost sure that capabilities cannot be transferred across rpm
which means I should add libcap-progs as a runtime dependency, and
update permissions/add capability during package installation. Am I
right?

Thanks in advance.

[Cristian Rodríguez]

Post by Andrei Dziahel
I'm almost sure that capabilities cannot be transferred across rpm

Yes, they can be set in the RPM spec with the %caps(<capabilities>)
attribute.

[Ludwig Nussel]

Post by Andrei Dziahel
I'm almost sure that capabilities cannot be transferred across rpm

Yes, they can be set in the RPM spec with the %caps(<capabilities>) attribute.

We don't use this in openSUSE. We have the mechanism the permissions
package provides for setting elevated privileges.

cu
Ludwig