In order to do ifconfig
in Linux and change the IP and VIP does it require root privileges?
Or it is also possible to do this via a non-root account?
3 Answers
You do not need root access to use ifconfig
to change IP addresses, only CAP_NET_ADMIN. Let's create a copy of ifconfig
with CAP_NET_ADMIN
enabled to see this:
cp /sbin/ifconfig .
sudo setcap cap_net_admin=eip ./ifconfig
./ifconfig eth0 1.2.3.4 # succeeds
# Wouldn't want to leave this copy of ifconfig around,
# It's a security hole!
rm ifconfig
-
-
2No, it's a capability. The idea is that you can grant just the
CAP_NET_ADMIN
capability to a process without having to grant the complete set or privileged capabilities that root (user ID 0) usually comes with.– CeladaFeb 20, 2013 at 19:48 -
And why is it a security hole?I mean if I need to do
ifconfig
via a process and do not run the process as a root.If I use your "trick" somehow would it be a security hole? Feb 20, 2013 at 19:50 -
If your kernel still allow changing dma/irq/base addresses, then a careful attacker may use your net_admin ifconfig to change these settings to overwrite memory and execute arbitrary code in kernel space.– BatchyXFeb 20, 2013 at 20:02
-
I used
setcap
to grant theCAP_NET_ADMIN
capability to anyone who could execute my test copy ofifconfig
. Since the permissions of that copy allowed unprivileged users to execute it, that means any user could make network changes. It was just a short-lived test on my desktop, but clearly a bad idea in general. That's why it was important to get rid of it after the test was done.– CeladaFeb 20, 2013 at 20:02
Yes, you must be root for use ifconfig since it is usually located in /usr/sbin
or /sbin
directory. Being non-root, ifconfig binary is not even in your PATH environment variable.
So, you should be root, or sudo must be set up.
But the modern way is to use ip
utility from iproute2
packet. You could use it under non-privileged user to see info about links, interfaces and routing. However, you must be root to change the settings.
-
1That a program is in your PATH or not is just a convenience issue. Even if, say, /sbin isn't in my PATH, I still can run /sbin/ifconfig like that. And PATH is completely under the user's control anyway.– vonbrandFeb 20, 2013 at 22:28
-
Yes, you are right, but
ip
is still much more convenient (unless you're on BSD system).– gevialFeb 21, 2013 at 4:33 -
1That wasn't my point at all. And if you are accustomed to use
ifconfig
for 20 odd years, it is hard to learn to useip
...– vonbrandFeb 21, 2013 at 12:10
This is trivial to test:
% ifconfig lo 1.2.3.4
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
So yes, it requires root.
-
... but that doesn't answer if there's a way to run it without being root. The Linux capabilities model is the defining matter in that. While root is traditionally granted these rights, other processors or users can be blessed with capabilities such as through SELinux contexts or as demonstrated by Celada using setcap (being rather like making a executable setuid, but for capbilities) Feb 20, 2013 at 21:04
sudo(1)
to allow selected users to run some programs as other users with the corresponding privileges (including root).