Permission issue with ksysguard

[ghost]

Describe the bug

Network traffic pane of ksysguard is empty. Ksysguard prints this to stdout:

Couldn't start kglobalaccel from org.kde.kglobalaccel.service: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "The name org.kde.kglobalaccel was not provided by any .service files")
Icon theme "breeze" not found.
Icon theme "breeze" not found.
org.kde.ksysguard.plugin.network: Helper process terminated abnormally!
org.kde.ksysguard.plugin.network: "The process doesn't have permission to open the capture source\n"
org.kde.ksysguard.plugin.network: Helper process terminated abnormally!
org.kde.ksysguard.plugin.network: "The process doesn't have permission to open the capture source\n"

The helper executable in the ksysguard package fails with the same error message:

$ /nix/store/9d55kjm189a5rxp6c6dz0h8r2lmlpbkg-ksysguard-5.21.5/libexec/ksysguard/ksgrd_network_helper
The process doesn't have permission to open the capture source

The executable works correctly if ran as root:

[root@nixos:/home/fctorial]# /nix/store/9d55kjm189a5rxp6c6dz0h8r2lmlpbkg-ksysguard-5.21.5/libexec/ksysguard/ksgrd_network_helper
12:43:55
12:43:56
12:43:57
12:43:58
12:43:59

The main user is in the following groups:

$ groups
users audio video networkmanager docker adbusers

This used to work correctly but stopper working a couple months ago.

Expected behavior

ksysguard displays network traffic correctly when started as a normal user.

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

 - system: `"x86_64-linux"`
 - host os: `Linux 5.14.5, NixOS, 21.05.3248.6120ac5cd20 (Okapi)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.15`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[stale[bot]]

I marked this as stale due to inactivity. → More info

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/ksysguard-network-helper-process-terminated-abnormally/14582/2

[Zahrun]

This issue also affects systemmonitor and plasma-systemmonitor

[WojciechSadowski]

The issue is that ksysguard needs the cap_net_raw capability. https://discuss.kde.org/t/in-system-monitor-why-the-app-specific-upload-download-rates-might-not-work/5860/5

To get plasma-systemmonitor to show the app-specific download/upload rates I added the following to my configuration:

security.wrappers.plasma-systemmonitor = {
  source = "${pkgs.kdePackages.plasma-systemmonitor}/bin/plasma-systemmonitor";
  capabilities = "cap_net_raw+ep";
  owner = "root";
  group = "root";
};