Re: why doesn't tcpdump drop privileges?

[Andrew Pimlott <andrew () pimlott net>]

On Tue, Jan 20, 2004 at 09:42:28PM -0500, Andrew Pimlott wrote:
> On Tue, Jan 20, 2004 at 06:31:08PM -0600, Earl Hood wrote:
> > By default,
> > it fallsback to the pcap userid, but you can also explicitly specify
> > which user via a command-line option.
>
> I don't know what the pcap user is for on RedHat, but I don't see
> why you would change to pcap instead of nobody.

Well, I take that back, assuming that this is the only thing that
user pcap is for.  In that case, hijacked tcpdumps can't interfere
with daemons running as nobody.

Andrew
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe