fix: grant cap_net_raw to scanner binaries for non-root execution - #35
Merged
Merged
Conversation
--cap-add=NET_RAW at runtime places NET_RAW in the container's bounding and permitted capability sets, but for a non-root user (uid 1000) the capability is never promoted to the effective set unless the binary itself has the file capability set via setcap. Fix: install libcap2-bin and run: setcap cap_net_raw+ep /usr/sbin/arp-scan setcap cap_net_raw+ep $(which nmap) This sets the effective+permitted bits on the binaries so the kernel grants NET_RAW in the effective set when uid 1000 executes them. --cap-add=NET_RAW must still be present at runtime to keep NET_RAW within the bounding set (file caps cannot exceed the bounding set). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
arp-scan and nmap fail with
Operation not permittedeven when the container is started with--cap-add=NET_RAW.Root Cause
Linux capability model has three relevant sets:
--cap-add=NET_RAWadds it hereWhen a non-root process (uid 1000) executes a binary, the effective set starts empty. The bounding set alone is not enough — the capability must also be on the binary file via
setcap, or in the ambient set.Fix
Install
libcap2-binand applysetcap cap_net_raw+epto both scanner binaries in the Dockerfile:+ep= effective + permitted bits on the file. When uid 1000 executes the binary, the kernel promotes NET_RAW to the effective set.--cap-add=NET_RAWmust still be present at runtime — file capabilities cannot exceed the bounding set.