tshark gives "permission denied" writing to (any) file in home dir.

kr0m3 · 06-22-2008, 07:46 PM

greetz~

first, the proper introduction:
Ubuntu Hardy Heron system
with the following tshark install:

Code:

user@host:~/Forensics$ tshark -vv
TShark 1.0.0

...<snip> ...

Compiled with GLib 2.16.1, with libpcap 0.9.8, with libz 1.2.3.3, with POSIX
capabilities (Linux), with libpcre 7.4, without SMI, with ADNS, with Lua 5.1,
with GnuTLS 2.0.4, with Gcrypt 1.2.4, with MIT Kerberos.

Running on Linux 2.6.24-19-generic, with libpcap version 0.9.8.

Built using gcc 4.2.3 (Ubuntu 4.2.3-2ubuntu7).

ok, now then;

Code:

user@hostname:~/Forensics$ sudo tshark -n -i wlan0 -s 1514 -w capfile.lpc

gives...

Code:

Running as user "root" and group "root". This could be dangerous.
Capturing on wlan0
tshark: The file to which the capture would be saved ("/home/user/capfile.lpc") could not be opened: Permission denied.

and even this;

Code:

user@hostname:~# sudo -i
root@hostname:~# tshark -n -i wlan0 -s 1514 -w /home/user/~Forensics/capfile.lpc

gives same.

however, if I specify file outside of my homedir, it functions correctly as either root or with 'sudo'

Code:

root@hostname:~# mount
/dev/sda1 on / type ext3 (rw,relatime,errors=remount-ro)
proc on /proc type proc (rw,noexec,nosuid,nodev)
/sys on /sys type sysfs (rw,noexec,nosuid,nodev)
varrun on /var/run type tmpfs (rw,noexec,nosuid,nodev,mode=0755)
varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777)
udev on /dev type tmpfs (rw,mode=0755)
devshm on /dev/shm type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
lrm on /lib/modules/2.6.24-19-generic/volatile type tmpfs (rw)
securityfs on /sys/kernel/security type securityfs (rw)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
gvfs-fuse-daemon on /home/user/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=user)

as i get this error writing to any location in the homedir, there is little (read: "no") chance that standard file/dir perms are the issue.

i have gone so far as to 'touch' the destination file first, still receive error.

i'm suspecting 'nosuid' as the culprit but this doesn't really jive with me. before I start tearing things down to t-shoot this i was wondering if anyone had any interesting input here.

thanks in advance;
~k

storkus · 06-23-2008, 04:00 AM

Wow, no wonder there haven't been any answers: that's a tough question! As root, you should *NEVER* receive permission errors unless you're doing something that really doesn't make sense, like running "more" on a directory or "ls" on a file.

"nosuid" could be a culprit; another possibility is a bug in that program. Since I've never used it, I can't help you there. If you
find something else about it, make sure to post about it.

Mike

xcecco1 · 12-16-2009, 06:40 AM

I ave the same problem.
The solution seems to be this:
Change the owner of the directory whom you are writing the
output file as the same user running tshark, or dumpcap...
E.g.: if you are root, make sure (che) your working dir
(who tshark are creating the file(s)) is owned by root..

Excuse (tanto) my poor english

BenEllerby · 04-15-2016, 05:24 AM

Hi,

I had the same issue, very strange bug.

Anyway, fixed by creating the file and setting the permissions for others to read and write it.

Code:

touch test.log
chmod o=rw test.log
sudo tshark -i wlan0 -w test.log

First line to create file.
Second line to change permissions to allow 'others' to read or write.
Third line to run tshark to write to this file.

Hope that helps
Ben

getgoodgrade · 08-16-2016, 04:30 AM

Thanks Ben, had the same issue that you had. Used your tips and they helped.

computersavvy · 08-16-2016, 11:22 AM

That sounds like a typical problem that can pop up with programs not running as the user whose home directory you are reading/writing in.

IIRC the default permissions for the users home directory are 710 and the user and group name are the same so no one except the user and root are allowed to read/write anything in the users home directory or sub-directories (at least on Fedora).
I had a similar problem using plexmediaserver in that the media files were located in sub-directories under my users home directory and until I modified the home directory permissions to allow access for the plex user the server could not access any files.
Running "ls -l /home" shows the problem here. (My laptop is not modified from the default permissions.)

Quote:

[user@laptop ~]$ ls -l /home
total 36
drwx--x---+ 68 user user 4096 Aug 14 17:55 user

Although I could have added the plex server user to my users group with the same result, I chose to give others execute permissions on my home directory to fix my problem. The same command on my media server machine shows the fix I used.

Quote:

drwxr-x--x. 104 user user 4096 Aug 11 13:12 user

sluge · 10-08-2019, 06:45 AM

My variant is to use

Code:

tshark -n -i wlan0 -s 1514 -w /tmp/capfile.lpc