Wireshark · Ethereal-users: Re: [Ethereal-users] Mandrake 7.2 and Ethereal User Privliges

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Tue, Nov 07, 2000 at 02:26:53PM -0800, Palmer C Byrne wrote:
> I guess I forgot to supply all of the information in my original post. I 
> can start the program and it will load and read captured data from file ok. 
> The problem is it complains about permissions when I try to capture in real 
> time from my eth0 port "(socket: Operation not permitted)".

Yes, and I think John forgot to supply all of the information in his
reply:

	chown root /*/ethereal
	chown root /*/tethereal

That, plus the "chmod 4755" (or, for those of us who rejoiced when The
UNIX Time-Sharing System, Seventh Edition added *symbolic* modes to the
"chmod" command back in 1979, "chmod u+s"), would make Ethereal and
Tethereal set-UID root, so that, when run by a normal user, they run
with root privileges, allowing them to open a SOCK_PACKET or PF_PACKET
socket (which is what libpcap does on Linux to do a live capture,
libpcap being the library that Ethereal and Tethereal - and tcpdump, and
a number of other programs - use to do live captures) rather than
getting EPERM ("Operation not permitted") as an error when they try to
do that.