capabilities set with setcap are not honoured

Bug #1856045 reported by Lars Ekman
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
iproute2 (Ubuntu)
Won't Fix
Undecided
Unassigned
Eoan
Confirmed
Undecided
Unassigned

Bug Description

Hi,

In Ubuntu 19.10 I set capabilities as;

setcap cap_net_admin,cap_sys_admin+ep /bin/ip
getcap /bin/ip
/bin/ip = cap_net_admin,cap_sys_admin+ep

but;

> ip addr add 20.20.20.20/32 dev lo
RTNETLINK answers: Operation not permitted

*exactly* the same works perfect on 18.04.3 LTS.

BTW the set of a silly address on "lo" is just an example.
Nothing works on Ubuntu 19.10

Regards,

ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: libcap2-bin 1:2.25-2
ProcVersionSignature: Ubuntu 5.3.0-24.26-generic 5.3.10
Uname: Linux 5.3.0-24-generic x86_64
ApportVersion: 2.20.11-0ubuntu8.2
Architecture: amd64
Date: Wed Dec 11 15:27:00 2019
InstallationDate: Installed on 2019-12-09 (2 days ago)
InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017)
SourcePackage: libcap2
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Lars Ekman (uablrek) wrote :
tags: added: rls-ee-incoming
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in libcap2 (Ubuntu):
status: New → Confirmed
Changed in libcap2 (Ubuntu Eoan):
status: New → Confirmed
Changed in libcap2 (Ubuntu):
status: Confirmed → New
tags: added: id-5dfbada861bbb0737ab3648f
tags: removed: rls-ee-incoming
Changed in iproute2 (Ubuntu):
status: New → Confirmed
affects: libcap2 (Ubuntu) → iproute2 (Ubuntu)
Revision history for this message
Michael Hudson-Doyle (mwhudson) wrote :

Well this is a consequence of this upstream change in iproute2: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?h=v4.16.0&id=ba2fc55b99f8363c80ce36681bc1ec97690b66f5. Upstream discussion, such as it is, of the patch appears to be here: https://<email address hidden>/

Probably the next step is to email the netdev list about this. Is that something you would be interested in doing? You are probably better able to explain your use case than I am!

Changed in iproute2 (Ubuntu):
status: New → Triaged
Revision history for this message
Michael Hudson-Doyle (mwhudson) wrote :

Talking about this more, the Ubuntu solution for this sort of thing is to configure sudo appropriately, so we'll close the bug here.

Changed in iproute2 (Ubuntu):
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.