Guy Harris wrote:
On Jun 3, 2010, at 9:13 AM, Jakub Zawadzki wrote:
What about dropping root privilages after invoking dumpcap?
If you mean "what about having dumpcap drop privileges when it no longer needs them?", as I remember, it does that in 1.2 and later, and perhaps even in 1.0 and later.
If, instead, you mean Wireshark could drop privileges after invoking
dumpcap (with privileges) I think that wouldn't work: GTK won't allow
you to start Wireshark if Wireshark is setuid-root and without being
setuid-root I don't think Wireshark could know what user id to drop down
to (but I've never taken the time to understand the ins and outs of euids).