nfqueue library setup requires root

nfqueue library setup requires root

[abirvalg]

Hi,
I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error.
When I setuid(0) no error is produced and everything works as expected.
Could you please confirm that Library setup operations require root.
Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions.
Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions?

Re: nfqueue library setup requires root

[U.Mutlu]

abirvalg@lavabit.com wrote, On 12/29/11 15:00:
> Hi,
> I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error.
> When I setuid(0) no error is produced and everything works as expected.
> Could you please confirm that Library setup operations require root.
> Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions.
> Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions?

On a host node I didn't need CAP_NET_ADMIN when starting it as root
(ie. maybe on my system root already has that cap by default; would make sense).

But on a VPS on the same host node I couldn't get it working yet.
It always gives errno=111 (ECONNREFUSED; "Connection refused").

Does yours work in a virtual machine, ie. on a VPS ?

Re: nfqueue library setup requires root

[Pablo Neira Ayuso]

On Wed, Feb 01, 2012 at 05:26:07PM +0100, U.Mutlu wrote:
> abirvalg@lavabit.com wrote, On 12/29/11 15:00:
> >Hi,
> >I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error.
> >When I setuid(0) no error is produced and everything works as expected.
> >Could you please confirm that Library setup operations require root.
> >Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions.
> >Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions?
> 
> On a host node I didn't need CAP_NET_ADMIN when starting it as root
> (ie. maybe on my system root already has that cap by default; would make sense).

Yes, root is fine. You should also get it running with CAP_NET_ADMIN.

> But on a VPS on the same host node I couldn't get it working yet.
> It always gives errno=111 (ECONNREFUSED; "Connection refused").

This has nothing to do with permissions (in that case you'll hit
-EPERM).

> Does yours work in a virtual machine, ie. on a VPS ?

By "virtual machine" you mean one linux container (lxc)?

Re: nfqueue library setup requires root

[U.Mutlu]

Pablo Neira Ayuso wrote, On 02/02/12 19:49:
> On Wed, Feb 01, 2012 at 05:26:07PM +0100, U.Mutlu wrote:
>> abirvalg@lavabit.com wrote, On 12/29/11 15:00:
>>> Hi,
>>> I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error.
>>> When I setuid(0) no error is produced and everything works as expected.
>>> Could you please confirm that Library setup operations require root.
>>> Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions.
>>> Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions?
>>
>> On a host node I didn't need CAP_NET_ADMIN when starting it as root
>> (ie. maybe on my system root already has that cap by default; would make sense).
>
> Yes, root is fine. You should also get it running with CAP_NET_ADMIN.
>
>> But on a VPS on the same host node I couldn't get it working yet.
>> It always gives errno=111 (ECONNREFUSED; "Connection refused").
>
> This has nothing to do with permissions (in that case you'll hit
> -EPERM).

So then why does it bring ECONNREFUSED in the VM,
but works fine on the host node?

>> Does yours work in a virtual machine, ie. on a VPS ?
>
> By "virtual machine" you mean one linux container (lxc)?

Yes, exactly. Have you tested it in such a container like LXC or openvz?