Using route command with a non root process

seepatplay · 09-15-2010, 02:21 PM

Hello,
Heres the scenario -
I use the system command route from a process (using the system() call). For security reasons the process does not have root privilege and for some reason I cannot use ioctl() either.
I tried to set the capabilities of the process to NET_ADMIN and SYS_ADMIN but the route command still failed due to insufficient permissions.

Question --
What are the capabilities that I need to set for route to be successful?

Thanks in advance

estabroo · 09-15-2010, 08:52 PM

All you need is NET_ADMIN. Where did you set the capabilities? If you tried to do them from within the process you probably didn't have sufficient privs to do so.

if you did the following as root:
setcap cap_net_admin=+eip /sbin/route

anyone that could run the route command could do routing changes. so a possibility is to make /sbin/route mode 0550 and a special routing group and have the process be run by a user in that routing group.