mtr: unable to get raw sockets

DesiSniper · #1 19th March 2008, 02:50 PM

Hi,

I have a fedora 6 box, and on it I have installed MTR using YUM. Logged on as root I can use mtr and it works. However after creating a restricted user, I cannot use mtr, I get the following error:

mtr: unable to get raw sockets.

Could anyone shed any light on as to why this is occuring, it only happens if i log in using a restricted user profile.

Regards

nucleo · #2 20th March 2008, 06:53 AM

Try this as root

Code:

chmod 4755 /usr/sbin/mtr

DesiSniper · #3 20th March 2008, 05:13 PM

sweet that worked man, thanks.

Now I would like to know what exactly 4755 permissions do?

over5characters · #4 20th February 2012, 08:11 PM

4000 is setuid "set user id on execution"

http://en.wikipedia.org/wiki/Setuid

from "man chmod"

"SETUID AND SETGID BITS
chmod clears the set-group-ID bit of a regular file if the file’s group ID does not
match the user’s effective group ID or one of the user’s supplementary group IDs,
unless the user has appropriate privileges. Additional restrictions may cause the
set-user-ID and set-group-ID bits of MODE or RFILE to be ignored. This behavior
depends on the policy and functionality of the underlying chmod system call. When
in doubt, check the underlying system behavior.

chmod preserves a directory’s set-user-ID and set-group-ID bits unless you explic-
itly specify otherwise. You can set or clear the bits with symbolic modes like u+s
and g-s, and you can set (but not clear) the bits with a numeric mode."

755 is just rwxr-xr-x. standard permissions.

nucleo · #5 20th February 2012, 08:24 PM

Capabilities used instead of SETUID beginig from Fedora 15 http://fedoraproject.org/wiki/Features/RemoveSETUID

So, now to get mtr working it is needed to run setcap

Code:

# setcap cap_net_raw+ep /usr/sbin/mtr

(this is set when mtr package installing so if capabilities not set then package reinstalling can help).

getcap can check file capabilities:

Code:

$ getcap /usr/sbin/mtr
/usr/sbin/mtr = cap_net_raw+ep