4 ms·
These days can't you do it with CAP_NET_RAW linux capabilities ? It is what is used for ping traceroute et al. if I recall correctly
by antoinealb 6y ago
These days can't you do it with CAP_NET_RAW linux capabilities ? It is what is used for ping traceroute et al. if I recall correctly
- vlovich123 6y agoSure but you still need to grant your binary that (eg scripting languages need that for the interpreter itself which isn’t great since all programs get it) and it’s just the administrator of the machine going “I know this is dangerous but I’m deciding to do it anyway”. It doesn’t address the underlying issues (eg if I compromise your binary with this capability I have some pretty powerful capabilities including sniffing all traffic on the machine through a promiscuous socket).
- antoinealb 6y agoDid not think about the interpreted languages use case, thanks for pointing that out.