ethereal can't open as root (capabilties problem)

[JP Foster]

http://bugzilla.ubuntu.com/show_bug.cgi?id=13558
sudo ethereal can't start as it tries to set capabilties and can't. even when running as root.
tcpdump is fine and ethereal can read tcpdump files when invoked by jp

[jp@cavan]# sudo su -
root@cavan:~ # strace ethereal
-------------8<--------------
munmap(0xb7150000, 73562) = 0
set_tid_address(0xb6831968) = 16118
rt_sigaction(SIGRTMIN, {0xb69c73d0, [], SA_SIGINFO}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0xb69c7450, [], SA_RESTART|SA_SIGINFO}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
_sysctl({{CTL_KERN, KERN_VERSION, 0, 20d91, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 2, 0xbfbc392c, 31, (nil), 0}) = 0
brk(0) = 0x8184000
brk(0x81a5000) = 0x81a5000
uname({sys="Linux", node="cavan", ...}) = 0
capget(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_SETPCAP|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000,
0}) = 0
capset(0x19980330, 0, {CAP_DAC_READ_SEARCH|CAP_NET_RAW,
CAP_DAC_READ_SEARCH|CAP_NET_RAW, 0}) = -1 EPERM (Operation not permitted)
write(2, "Could not set capabilities: Oper"..., 52Could not set capabilities:
Operation not permitted
) = 52
exit_group(1) = ?

[JP Foster (jeepster)]

Reported by <email address hidden> too.

[Loic Pefferkorn (loic)]

$ lcap
Current capabilities: 0xFFFFFEFF
   0) *CAP_CHOWN 1) *CAP_DAC_OVERRIDE
   2) *CAP_DAC_READ_SEARCH 3) *CAP_FOWNER
   4) *CAP_FSETID 5) *CAP_KILL
   6) *CAP_SETGID 7) *CAP_SETUID
   8) CAP_SETPCAP 9) *CAP_LINUX_IMMUTABLE
  10) *CAP_NET_BIND_SERVICE 11) *CAP_NET_BROADCAST
  12) *CAP_NET_ADMIN 13) *CAP_NET_RAW
  14) *CAP_IPC_LOCK 15) *CAP_IPC_OWNER
  16) *CAP_SYS_MODULE 17) *CAP_SYS_RAWIO
  18) *CAP_SYS_CHROOT 19) *CAP_SYS_PTRACE
  20) *CAP_SYS_PACCT 21) *CAP_SYS_ADMIN
  22) *CAP_SYS_BOOT 23) *CAP_SYS_NICE
  24) *CAP_SYS_RESOURCE 25) *CAP_SYS_TIME
  26) *CAP_SYS_TTY_CONFIG
    * = Capabilities currently allowed

[Yann Rouillard (yann-pleiades)]

This bug was also submitted on debian (bug #321204).

It seems it is caused by the fact that the capability module is not loaded.
modprobe capability
solve this problem
Maybe it should be a good idea to load this module by default or to compile it in the kernel like Debian Kernel 2.6.12.

Ethereal Debian Maintainer uploaded a new package where ethereal doesn't abord if it can't drop its capabilities because of the lack of capabilities support.

[JP Foster (jeepster)]

Yep capability is built as module but not loaded. Loading it gets rid of this problem.
Thanks,
JP

[Trent Lloyd (lathiat)]

Fix from debian has now been imported into breezy.