Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In order to do ifconfig in Linux and change the IP and VIP does it require root privileges?
Or it is also possible to do this via a non-root account?

share|improve this question
2  
All system-wide configuration is restricted to root, for obvious reasons. You can set up sudo(1) to allow selected users to run some programs as other users with the corresponding privileges (including root). –  vonbrand Feb 20 '13 at 19:18
    
@vonbrand That's an old view of Unix systems. In modern Linux, UID 0's power is only traditional as far as function goes. Capabilities are the defining matter, so any user can be given all or portions of that power. Similarly, a system can have a root / UID 0 user with no special privileges. –  Jeff Ferland Feb 20 '13 at 21:06
    
@JeffFerland, that is true (I remember some SELinux experiment with a machine with root without password exposed to the Internet), but most systems are still managed the traditional way. –  vonbrand Feb 20 '13 at 22:25

3 Answers 3

up vote 7 down vote accepted

You do not need root access to use ifconfig to change IP addresses, only CAP_NET_ADMIN. Let's create a copy of ifconfig with CAP_NET_ADMIN enabled to see this:

cp /sbin/ifconfig .
sudo setcap cap_net_admin=eip ./ifconfig
./ifconfig eth0 1.2.3.4    # succeeds

# Wouldn't want to leave this copy of ifconfig around,
# It's a security hole!
rm ifconfig
share|improve this answer
    
CAP_NET_ADMIN is a special group? –  user76678 Feb 20 '13 at 19:44
1  
No, it's a capability. The idea is that you can grant just the CAP_NET_ADMIN capability to a process without having to grant the complete set or privileged capabilities that root (user ID 0) usually comes with. –  Celada Feb 20 '13 at 19:48
    
And why is it a security hole?I mean if I need to do ifconfig via a process and do not run the process as a root.If I use your "trick" somehow would it be a security hole? –  user76678 Feb 20 '13 at 19:50
    
If your kernel still allow changing dma/irq/base addresses, then a careful attacker may use your net_admin ifconfig to change these settings to overwrite memory and execute arbitrary code in kernel space. –  BatchyX Feb 20 '13 at 20:02
    
I used setcap to grant the CAP_NET_ADMIN capability to anyone who could execute my test copy of ifconfig. Since the permissions of that copy allowed unprivileged users to execute it, that means any user could make network changes. It was just a short-lived test on my desktop, but clearly a bad idea in general. That's why it was important to get rid of it after the test was done. –  Celada Feb 20 '13 at 20:02

Yes, you must be root for use ifconfig since it is usually located in /usr/sbin or /sbin directory. Being non-root, ifconfig binary is not even in your PATH environment variable. So, you should be root, or sudo must be set up. But the modern way is to use ip utility from iproute2 packet. You could use it under non-privileged user to see info about links, interfaces and routing. However, you must be root to change the settings.

share|improve this answer
    
That a program is in your PATH or not is just a convenience issue. Even if, say, /sbin isn't in my PATH, I still can run /sbin/ifconfig like that. And PATH is completely under the user's control anyway. –  vonbrand Feb 20 '13 at 22:28
    
Yes, you are right, but ip is still much more convenient (unless you're on BSD system). –  slimsuperhero Feb 21 '13 at 4:33
    
That wasn't my point at all. And if you are accustomed to use ifconfig for 20 odd years, it is hard to learn to use ip... –  vonbrand Feb 21 '13 at 12:10

This is trivial to test:

% ifconfig lo 1.2.3.4
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied

So yes, it requires root.

share|improve this answer
    
... but that doesn't answer if there's a way to run it without being root. The Linux capabilities model is the defining matter in that. While root is traditionally granted these rights, other processors or users can be blessed with capabilities such as through SELinux contexts or as demonstrated by Celada using setcap (being rather like making a executable setuid, but for capbilities) –  Jeff Ferland Feb 20 '13 at 21:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.