I want to allow some users on a redhat server run wireshark via sudoers. This works fine. However, when they save a capture file the file has root permissions and will not allow them to move or copy it. Is there anything I can do to get around this issue?

Here is a sample visudo entry:

username ALL=(root) NOPASSWD:/usr/sbin/wireshark

You could allow them to use sudo to change the permissions afterwards. You would need to be very careful to not allow them to change any other files. One way would be to require them to save to a particular filename, and only allow them to change that filename. (After the change, they could then move or rename it as desired.)

You could define an alias for them:

And create the corresponding entry in sudoers to allow this to work. The one thing I am not sure of is if sudo will barf at the embedded id command in there, and I am not at a *nix machine to try it out. (If you only have a handful of users that need this, you could instead give each one their own command with their username explicitly in the command, and therefore not need to use id.)

Thanks for the reply. Looks like that may be the best way to get around it.