Re: OpenBSD work on Tcpdump privilege separation

[Pekka Savola <pekkas () netcore fi>]

On Sun, 22 Feb 2004, Pekka Savola wrote:
> The current tcpdump just drops privileges before pretty much anything 
> is done.  Now looking at the code, maybe the privilege separation 
> could be done even slightly earlier in the "pcap_open_live" branch, 
> e.g., after pcap_open_live, but I haven't tested this.  I guess it 
> depends on whether pcap_set_datalink, pcap_snapshot (this one might 
> be dangerous with root!) or pcap_lookupnet requires root privileges.
>
> This might be worth experimenting with.

Ok, I've tested that this works at least with Linux.  The attached 
patch moves dropping privileges a bit earlier.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

Attachment: tcpdump-droprootearlier.patch
Description: