On 06/17/14 08:27, Alan Marchiori wrote:
I'm trying to build wireshark (1.10.6) from source on my Ubuntu 14.04
machine to work on a plugin. I also have the ubuntu wireshark package
installed and working properly from my user account and am able to
capture packets on eth0 (using the wireshark group). However, when I
build from source, my user account cannot capture on eth0.
I have tried various options with the configure script, eg:
./configure --enable-dumpcap --enable-setcap-install
--with-dumpcap-group=wireshark
And set the capture properties to match the ubuntu package's dumpcap:
$ getcap /usr/local/bin/dumpcap
/usr/local/bin/dumpcap = cap_net_admin,cap_net_raw+eip
src/wireshark-1.10.6$ getcap ./dumpcap
./dumpcap = cap_net_admin,cap_net_raw+eip
but still my compiled wireshark/dumpcap cannot access eth0.
Any ideas?
When you compile from source ./dumpcap isn't an binary executable, it's
a (libtool) shell script. Linux doesn't allow shell scripts to have
capabilities nor be setuid so when you run it, it'll run as you and
without the necessary capabilities.
Unfortunately the only ways around this are to install what you've built
(e.g., "make install" or build a package and install it) or run as root
(not a great idea--and if you're using a real plugin as opposed to a
built-in dissector, your plugin won't get loaded while running as root
from the build directory).
Personally when I'm doing development I use my build only for reading
capture files (except on the rare occasion I'm trying to fix something
in the capture mechanism).