Problem with linux capabilities and pcap
lazarus / 32-Linux

----------------------------------------------------------------------
niels.hansen · 2021-09-17 10:32

Hi,

I'm developing programs to monitor and test  specific devices on
network at the very lowest level.

I use pcap for this and it works really well. However my programs
under ubuntu / linux needs to to have elevated capabilities to run in
particular since im using the PROMISCUOUS mode i.e. i'm grabbing data
not really intended for me.

If I remove the linux sudo password check then I can put the below
line in the "Compiler Commands" "Execute after" line. This will make
the compiled programs work from command line with no additional
elevation.

/usr/bin/sudo /sbin/setcap cap_net_raw,cap_net_admin=eip 
"$TargetFile()"

My problem is that I cannot debug the program (when using "Run") since
it appears that the elevated capabilites are not yet set when the
debugger is invoked. Am I doing something wrong? - How do I make it
work?

Thanks

Niels

----------------------------------------------------------------------
MarkMLl · 2021-09-17 10:46

I use POSIX capabilities heavily, applying them using much the way
that you do... in fact somewhere in the bowels of the bug/wishlist
system I've got a patch to extent the IDE with a "run as" for that
specific task.

My experience is that I can't debug the generated code as an ordinary
user, I've not researched this in depth since I suspect that GDB and
capabilities are fundamentally and intentionally incompatible. So what
I do is (notes from comment text follow

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i (* This
requires that the program be running with sufficient capabilities to
be *)(* able to create a unix-domain socket in /var/run and to bind to
a port < 1024,*)(* however immediately after these operations it goes
to a lot of trouble to    *)(* relinquish as many privileges as
possible.                                   *)(*                     
                                                       *)(*  *   If
linked with gtk2, it is not possible to run setuid root but explicit
*)(*      capabilities may be added during installation:             
           *)(*                                                      
                      *)(*      # setcap
CAP_DAC_OVERRIDE,CAP_NET_BIND_SERVICE,CAP_NET_RAW=p+e *gtk2    *)(*  
                                                                     
   *)(*      Note that capabilities are stored as extended attributes,
which DO NOT  *)(*      normally accompany a file if it is
subsequently copied.                 *)(*                            
                                                *)(*  *   If linked
with Qt, the program may be run setuid root:                  *)(*   
                                                                     
  *)(*      # chown root:root *qt                                    
             *)(*      # chmod u+s *qt                               
                        *)(*      # chmod g+s *qt                    
                                   *)(*                              
                                              *)(*      or have extra
capabilities as above.                                    *)(*       
                                                                   
 *)(*  *   In any case, the program may be started by the superuser
(i.e. run as   *)(*      root).                                      
                          *)(*                                       
                                     *)(*  *   It may be debugged by
being run like                                    *)(*               
                                                             *)(*    
 # gdbserver :2345 ./WatchPxx-x86_64-linux-gtk2                      
  *)(*                                                               
             *)(*      with the Lazarus IDE debugger backend set to
remote/gdbserver.          *)(*                                      
                                      *)(* After the ports have been
bound, the CAP_DAC_OVERRIDE, CAP_NET_BIND_SERVICE  *)(* and
CAP_NET_RAW permitted and effective capabilities are relinquished. If
  *)(* the program is running setuid root, then it reverts to the
actual user; if   *)(* it is running as root it assumes group and user
IDs as given by the          *)(* ownership of the executable, or ID
65534 as ultimate fallback ("nobody" in   *)(* recent Debian
releases).                                     MarkMLl.        *) 
Martin might have comments on alternative debuggers etc.

HTH, MarkMLl