[MacOS] Failed to activate interface

kpcyrd / sniffglue

Secure multithreaded packet sniffer

https://crates.io/crates/sniffglue

GNU General Public License v3.0

1.08k stars 94 forks source link

Open yatzbim opened 1 year ago

yatzbim commented 1 year ago

Out of the box, running sniffglue with or without arguments on MacOS Monterey 12.6 returns the following error:

Error: Failed to activate interface: (cannot open BPF device) /dev/bpf0: Permission denied

Failure appears to be originating here: https://github.com/kpcyrd/sniffglue/blob/main/src/sniff.rs#L36
sniffglue was installed via Homebrew
Docs for pcap_sys::pcap_activate() can be found here (they're blank)
It works if you run with sudo

yatzbim commented 1 year ago

The man page for pcap_activate() (link) describes the following failure mode:

PCAP_ERROR_PERM_DENIED if the process doesn't have permission to open the capture source

Which makes sense as sniffglue works when run as root.

Question is--how do we check those permissions either during or immediately following install?