From e455974fbe132047d1035497f05d53b9a228d0ac Mon Sep 17 00:00:00 2001 From: wind Date: Sat, 28 Feb 2026 16:51:24 +0100 Subject: [PATCH] fix: grant cap_net_raw to scanner binaries for non-root execution --cap-add=NET_RAW at runtime places NET_RAW in the container's bounding and permitted capability sets, but for a non-root user (uid 1000) the capability is never promoted to the effective set unless the binary itself has the file capability set via setcap. Fix: install libcap2-bin and run: setcap cap_net_raw+ep /usr/sbin/arp-scan setcap cap_net_raw+ep $(which nmap) This sets the effective+permitted bits on the binaries so the kernel grants NET_RAW in the effective set when uid 1000 executes them. --cap-add=NET_RAW must still be present at runtime to keep NET_RAW within the bounding set (file caps cannot exceed the bounding set). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docker/Dockerfile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index f46feb7..fe2ee1f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -33,13 +33,20 @@ LABEL org.opencontainers.image.title="NetworkCrawler" \ org.opencontainers.image.vendor="talesofthemoon" \ org.opencontainers.image.licenses="MIT" -# Install system-level scanning tools +# Install system-level scanning tools + libcap2-bin for setcap RUN apt-get update \ && apt-get install -y --no-install-recommends \ nmap \ arp-scan \ + libcap2-bin \ && rm -rf /var/lib/apt/lists/* +# Grant cap_net_raw to the scanner binaries so they can open raw sockets when +# running as non-root uid 1000. --cap-add=NET_RAW at runtime puts NET_RAW in +# the bounding set; setcap +ep promotes it to the effective set on exec. +RUN setcap cap_net_raw+ep /usr/sbin/arp-scan \ + && setcap cap_net_raw+ep "$(which nmap)" + # Create a dedicated non-root user RUN groupadd --gid 1000 crawler \ && useradd --uid 1000 --gid crawler --no-create-home --shell /usr/sbin/nologin crawler