Wireshark-dev: Re: [Wireshark-dev] Error while installing wireshark 1.10.3

From: Vishnu Bhatt <vishnu.bhatt@xxxxxxxxxxx>
Date: Wed, 11 Dec 2013 19:55:49 +0530
I compiled the whole code with:

./configure --prefix=/home2/rahul.rohit/1.10.3._standalone_ra/install --disable-setcap-install  --enable-setuid-install --with-libcap --with-dumpcap-group=rncpet

But after installing the rpm, the machine is not able to find Wireshark (maybe it's not properly installed)

Whereis Wireshark gives the following output:

wireshark: /usr/share/Wireshark

There is nothing in the folder mentioned above. Why Wireshark is not getting installed in /usr/bin



-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, December 11, 2013 6:12 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Error while installing wireshark 1.10.3


On Dec 6, 2013, at 6:41 AM, Sreejith M M <sreejith.mm@xxxxxxxxx> wrote:

> Looks like some problem with rpm creation.

The problem appears to be that the RPM was created with the dumpcap program having some file capabilities set, and was unpacked into an NFS-mounted directory, which means that the capability bits can't be set.

If the capability bits aren't set, either you'd have to run Wireshark/TShark as root, which would be an Extremely Bad Idea (as doc/README.packaging says:

        In versions up to and including 0.99.6, it was necessary to run
        Wireshark with elevated privileges in order to be able to capture
        traffic. With version 0.99.7, all function calls that require elevated
        privileges have been moved out of the GUI to dumpcap.

        WIRESHARK CONTAINS OVER TWO MILLION LINES OF SOURCE CODE. DO NOT RUN
        THEM AS ROOT.

        Warnings are displayed when Wireshark and TShark are run as root.

so don't do it), or you'd have to make dumpcap set-UID root (as doc/README.packaging says:

        There are several configure-time options on non-Windows systems that
        affect the privileges a normal user needs to capture traffic and list
        interfaces:

            --enable-setcap-install   Install dumpcap with cap_net_admin and
                                      cap_net_raw capabilities. Linux only.

            --enable-setuid-install   Install dumpcap setuid root.

            --with-libcap             If running as root, try to grab
                                      CAP_NET_ADMIN and CAP_NET_RAW, then drop
                                      privileges. Linux only.

            --with-dumpcap-group=...  Restricts dumpcap execution to the
                                      specified group.

--enable-setcap-install might produce an RPM that can't be properly installed over NFS, so you'd have to try --disable-setcap-install and --enable-setuid-install; if you do --enable-setuid-install on Linux, you should probably use --with-libcap, and possibly --with-dumpcap-group=, as well, picking a group to which the ability to run dumpcap, and thus to do captures when not running as root, should be granted).
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe




===============================================================================
Please refer to http://www.aricent.com/legal/email_disclaimer.html
for important disclosures regarding this electronic communication.
===============================================================================