https://bugzilla.novell.com/show_bug.cgi?id=349782 User krahmer@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c1 Sebastian Krahmer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |krahmer@novell.com --- Comment #1 from Sebastian Krahmer 2008-02-04 02:59:36 MST --- I dont think we want to have wireshark or its helper binaries setuid. They link to a lot of libraries; users shouldnt be able to sniff traffic anyways. Wireshark is probably a good candidate for something like a chroot. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User prusnak@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c3 Pavol Rusnak changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #3 from Pavol Rusnak 2008-03-31 10:25:57 MST --- Gentoo has following flags for wireshark binaries: -r-sr-s--- 1 root wireshark 46848 2008-03-16 19:21 /usr/bin/dumpcap -rwxr-xr-x 1 root root 67552 2008-03-16 19:21 /usr/bin/rawshark -r-sr-s--- 1 root wireshark 162200 2008-03-16 19:21 /usr/bin/tshark -rwxr-xr-x 1 root root 1318388 2008-03-16 19:21 /usr/bin/wireshark So user has to be in group wireshark in order to sniff traffic. What about this solution? PS: Wireshark now prints message box "Running as user 'root' and group 'root. This could be dangerous' when running as root. Fortunately this dialog also contains checkbox "Don't show this message again." :)) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c5 --- Comment #5 from Ludwig Nussel 2008-04-01 06:13:05 MST --- Well, it does make sense to run the gui (which does the error prone packet disassembly) as non-root. That goal is reached by the s-bit. With that bit however there is no authentication of the privileged operation anymore. I am not convinced by the group approach either. Although we have a similar case already, mtr. It's setuid root for group dialout. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c7 --- Comment #7 from Ludwig Nussel 2008-04-01 06:43:04 MST --- Does that work? Does wireshark communicate via stdin/stdout with the helper or does it use some external file/socket? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User mmarek@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c9 --- Comment #9 from Michal Marek 2008-04-01 06:56:10 MST --- OK, it's not rawshark but dumpcap and it uses (also) stdout. And it's run several times (to get the list of interfaces, to show the traffic on each interface and finally to capture), so xdg-su won't work here :-( -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User casualprogrammer@yahoo.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c11 --- Comment #11 from Casual J. Programmer 2008-05-08 02:44:57 MST --- As I pointed out in Bug 387706 Comment #2 there has to be a reason why wireshark ( as well as other applications ) think its inappropriate to run them as root. So forcing them to run as root is probably causing more issues than it avoids. If creating a new group for them is not wanted ( for whatever reason ) any of the existing privileged groups could be used to that end. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 Pavol Rusnak changed: What |Removed |Added ---------------------------------------------------------------------------- Found By|--- |Development -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=349782 User casualprogrammer@gmail.com added comment https://bugzilla.novell.com/show_bug.cgi?id=349782#c13 --- Comment #13 from Casual J. Programmer 2009-01-14 11:16:23 MST --- Are we collecting duplicates here, or is this going to be fixed eventually ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.