Use iptables trough iptc, enables rootless operation

[adisbladis]

Related to #38

Provided I do setcap 'cap_net_raw,cap_dac_override,cap_net_admin=+ep' $(which python2) I can run opensnitch with an unprivileged user.

Needed cap_net_raw because of how communication with the kernel happens from iptables.

I say we still keep #38 open though, this is a larger issue

[evilsocket]

is it dependant on this #43 ?

[adisbladis]

No it's not

[evilsocket]

Question: how do we execute setcap on first run in order not to have the user do it? Maybe we should require root for first run, setcap on ourself and then re-run without root?

[adisbladis]

We don't. We would have to do setcap on the whole python interpreter which is bad for obvious reasons.
I see this more as a nice PoC (and much better than invoking external commands).

This should also translate fairly well to libiptc if we decide to go down that route (writing the daemon in a compiled language).

[evilsocket]

Not sure if I want to merge it on master tbh ...

[adisbladis]

I think it's fine to leave this unmerged. It's not a very significant improvement.
This was mostly me wanting to explore what was needed to run something like this without running as root.

[evilsocket]

👍

[adisbladis]

I'm closing this, lets keep it in mind as a future reference :)

[evilsocket]

absolutely, great job btw 👍