Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a program that, at some point, create/destroys tun/tap virtual adapters.

Obviously, for these specific operations this program requires root privileges.

According to the program specifications, root privileges are dropped as soon as they are no longer needed (I assume after the tap adapter was created).

However, I'd like to secure this even more and to run it as non-root in the first place.

Is there a way of allowing a specific user to just create and destroy tun/tap adapters and leave out all other specific permissions to their default ?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Look into the sudo mechanism. man sudo and man sudoers.

share|improve this answer
    
Doesn't sudo changes the effective user of the command being run ? Ideally, I'd like some of "my" developers to be allowed to create tun/tap adapters without having root access. Using sudo in their case wouldn't work because they can't install the software properly on the system (and I don't want them to) nor can they set LD_LIBRARY_PATH within sudo. –  ereOn Feb 25 '13 at 10:50
    
You can allow sudo access to very specific commands, not only a general purpose shell. If you write a script that handles everything you need to create/destroy your tun/tap devices and grant sudo access to only this script, users can only do as root what this script does. –  SvW Feb 25 '13 at 10:58
    
Now I feel dumb for not having thought of using a script for that... Obviously, if I set the LD_LIBRARY_PATH and the PATH inside the script, users can call it, even as sudo. Thanks. –  ereOn Feb 25 '13 at 11:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.