search

coreos / go-iptables

Go wrapper around iptables utility
Apache License 2.0
1.11k stars 256 forks source link

CAP_NET_ADMIN capability ? #81

Open papey opened 3 years ago

papey commented 3 years ago

Hi,

Is it possible to run a program using go-iptables as an unprivileged user with the cap_net_admincap ?

From the the capabilities(7) man page : 

     CAP_NET_ADMIN
              Perform various network-related operations:
              * interface configuration;
              * administration of IP firewall, masquerading, and
                accounting;
              * modify routing tables;
              * bind to any address for transparent proxying;
              * set type-of-service (TOS);
              * clear driver statistics;
              * set promiscuous mode;
              * enabling multicasting;

administration of IP firewall is somewhat vague, but I've tried with a small example by setting cap_net_admin using setcap on the compiled binary but I get :

exit status 4: Fatal: can't open lock file /run/xtables.lock: Permission denied

Thanks for this project.

athoune commented 3 years ago

It's hardcoded https://github.com/coreos/go-iptables/blob/521ee6c1700638dc6444e0a9a7511ad3fd7d966a/iptables/lock.go#L29