Security: Running dhcpcd as non root ?

[ebanDev]

Hello, I'd wondering, is it possible to run dhcpcd as a non-root user by setting the right caps ? This could be interesting in a security perspective... Thanks :)

[rsmarples]

dhcpcd-9 already supports sandbox techniques for FreeBSD (capsicum), OpenBSD (pledge) and Linux (seccomp).

This means that the root owned process doesn't directly handle any input from anything other than non root owned dhcpcd processes. It also does the bare minimum - ie just carry out a pre-defined action from one of the non root processes.

You're welcome to try and patch the root process not to run as root though if you can set the right caps for it :)

https://github.com/NetworkConfiguration/dhcpcd/blob/master/src/privsep-root.c https://github.com/NetworkConfiguration/dhcpcd/blob/master/src/privsep-linux.c

[ebanDev]

Thanks for your answer :D I don't code in C, so I'll not be able to patch anything unfortunately 😅