On Fri, Jan 15, 2010 at 1:21 PM, Denis Doroshenko <[email protected]> wrote: > I'd like to give some colleagues possibility to analyze and dump net > traffic to files, but it seems that in order to do that I need to > allow them to run a piece of software as root, when the software has a > possibility to write to a user-defined file and it does it as root. In > this case I believe they can write files where ever they want, also > some things won't work (e.g. quotas).
The current tcpdump code can only be run as root. You can patch the code to remove the privsep parts if necessary. Or, if you generally trust your users except for carelessly filling up the filesystem, note two things: 1. When writing to an existing file with -w, tcpdump will not change the owner. 2. When running "sudo tcpdump -w - > file", the file will be owned by the user calling sudo. If you don't trust your users to not mess up the file system (what kind of users are they?), I'd modify the source to only accept a single -w argument, then force the argument via a shell script they can run with sudo. But be careful, you'll also have to add NOFOLLOW to the open call in privsep.c, or they could still overwrite system files.
