wireshark: cannot see any interface without ignore=caps.keep (private-dev)

[crocket]

With ignore=caps.keep, I can see some interfaces. With caps.keep, I see no interface in wireshark.
If I add ignore=private-dev, I can see even more interfaces in wireshark.

[crocket]

Does caps.keep require nonewprivs via seccomp?

[glitsj16]

I can confirm private-dev prevents showing interfaces. I see the same interfaces with or without caps.keep, which suggests the caps.keep is working as expected inside the sandbox.

My user is in the wireshark group on Arch Linux, as advised on the wiki. Arch Linux sets packet capturing capabilities on /usr/bin/dumpcap:

$ sudo getcap /usr/bin/dumpcap
/usr/bin/dumpcap cap_dac_override,cap_net_admin,cap_net_raw=eip

Is this also the case on your setup?

[crocket]

$ firejail tshark -i xxx
Capturing on 'xxx'
tshark: Couldn't run /usr/bin/dumpcap in child process: Operation not permitted
$ firejail --profile=tshark dumpcap --help
Cannot start application: Operation not permitted

[crocket]

I packed all documented capabilities into caps.keep in wireshark.local, but

$ firejail --profile=wireshark dumpcap --help
Cannot start application: Operation not permitted

[glitsj16]

I don't get why you need changing caps.keep. The only thing I needed to correct on my Arch Linux box to get tshark/wireshark working was to ignore private-dev (which we should fix in our profile). In other words, to your question 'Why does wireshark require ignore=caps.keep?' I'd reply 'It doesn't, only needs ignore=private-dev to properly show interfaces'. The latter is a profile bug you've discovered and it would be helpful if you could open an issue on that. I'll fix it asap once such an issue is filed.

$ cat /etc/firejail/wireshark.local
# Firejail profile for wireshark
# Persistent local customizations

# private-dev stops the sharks from showing interfaces
ignore private-dev

This is what I get from a command similar to yours above:

$ firejail /usr/bin/tshark -i wifi0 -a duration:10 -w ~/Downloads/wifi0.pcapng
Capturing on 'wifi0'
 ** (tshark:5) 11:54:20.930032 [Main MESSAGE] -- Capture started.
 ** (tshark:5) 11:54:20.930164 [Main MESSAGE] -- File: "/home/glitsj16/Downloads/wifi0.pcapng"

What exactly was in your {tshark,wireshark}.local when you ran that command? Can you re-run that while only using ignore private-dev? BTW, we haven't ascertained OS and firejail version you are seeing these issues on yet. Throw those in too if you will.

[crocket]

What is the output of ls -lh $(which dumpcap)?

$ ls -lh /usr/bin/dumpcap
-rwx--x--- 1 root pcap 121K Jan 23 18:01 /usr/bin/dumpcap*

With ~/.config/firejail/wireshark.local

ignore private-dev

I get

$ firejail tshark -i xxx
tshark: Couldn't run /usr/bin/dumpcap in child process: Operation not permitted

Perhaps, is this related to execution permission for pcap group?

[crocket]

With ~/.config/firejail/wireshark.local

caps.keep dac_read_search,net_admin,net_raw
ignore caps.keep

most interfaces are shown on wireshark.

With ~/.config/firejail/wireshark.local

caps.keep dac_read_search,net_admin,net_raw
ignore caps.keep
ignore private-dev

all interfaces including esoteric interfaces that I don't know about are shown on wireshark.

With ~/.config/firejail/wireshark.local

caps.keep dac_read_search,net_admin,net_raw

or

caps.keep dac_read_search,net_admin,net_raw
ignore private-dev

wireshark shows no interface.

It seems the last occurrence of caps.keep overrides previous occurrences.

[crocket]

It turns out that ~/.config/firejail/wireshark.local

caps.keep dac_read_search,net_admin,net_raw
ignore caps.keep

is needed to prevent

caps.keep dac_override,net_admin,net_raw

in /etc/firejail/wireshark.local from overriding

caps.keep dac_read_search,net_admin,net_raw

in ~/.config/firejail/wireshark.local.

Does dumpcap require dac_override instead of dac_read_search on other linux distributions? On gentoo linux, it requires dac_read_search.

[crocket]

@rusty-snake I think I shall add dac_read_search to caps.keep in /etc/firejail/wireshark.profile because gentoo linux slaps cap_dac_read_search instead of cap_dac_override to /usr/bin/dumpcap.

[kmk3]

Related PR:

• profiles: wireshark: disable private-dev #4958