Support Linux capabilities for non-root raw packet scanning#3333
Support Linux capabilities for non-root raw packet scanning#3333ali-keys wants to merge 1 commit into
Conversation
Nmap previously required root (geteuid()==0) for any scan type that uses raw sockets. On Linux, setcap(8) can grant the necessary access without a full root UID: sudo setcap cap_net_raw=ep /usr/bin/nmap Add have_net_capabilities() to nbase/nbase_misc.c, which reads CapEff from /proc/self/status and tests for CAP_NET_RAW (bit 13). Both NmapOps::Initialize() and NpingOps::Initialize() now set isr00t when either geteuid()==0 or CAP_NET_RAW is effective, suppressing the "You requested a scan type which requires root privileges." error. CAP_NET_RAW is sufficient for raw sockets and promiscuous capture via PACKET_MR_PROMISC on an AF_PACKET socket. The capability check is Linux-only (#ifdef __linux__); all other platforms retain their existing behaviour.
|
This is indeed a great idea. 👍 That said, I believe that it would be better to accept the need for linking with an additional library for the benefit of simpler and more future-proof code. Please take a look at #3356. |
|
Wonder why it hasn't been implemented before. |
I do not recall any recent discussion about it. Users are likely happy with what they find at SecWiki. As for myself, I set
I agree that new dependencies should not be introduced frivolously but these particular libraries are already in place for many distros by default, which makes it palatable to me. |
Yes,
Yes, you're right. |
Nmap previously required root (
geteuid()==0) for any scan type that uses raw sockets. On Linux, setcap(8) can grant the necessary access without a full root UID:Add
have_net_capabilities()tonbase/nbase_misc.c, which readsCapEfffrom/proc/self/statusand tests forCAP_NET_RAW(bit 13). BothNmapOps::Initialize()andNpingOps::Initialize()now setisr00twhen eithergeteuid()==0orCAP_NET_RAWis effective, suppressing the "You requested a scan type which requires root privileges." error.CAP_NET_RAW is sufficient for raw sockets and promiscuous capture via
PACKET_MR_PROMISCon anAF_PACKETsocket. The capability check is Linux-only (#ifdef __linux__); all other platforms retain their existing behaviour.