<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><blockquote type="cite"><font class="Apple-style-span" color="#000000"><br></font>I was hoping that either via kernel capabilities or SE Linux that we <br></blockquote><blockquote type="cite">could avoid this. Both seem to offer exactly the feature we want, <br></blockquote><blockquote type="cite">opening raw sockets from unprivileged accounts. But it's really <br></blockquote><blockquote type="cite">unclear from all the doc's online how these two interact. Best we <br></blockquote><blockquote type="cite">could do was try all the examples and approaches we could find - none <br></blockquote><blockquote type="cite">worked.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I guess I can try trolling the kernel source ... ugh! ... to see if <br></blockquote><blockquote type="cite">your recollection is correct. I certainly hope there is another <br></blockquote><blockquote type="cite">option ...<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks<br></blockquote><blockquote type="cite">S<br></blockquote><br>I think Ross is right. At my last contract with IBM some years back, we<br>were doing some raw socket stuff. ISTR that we had no problems because<br>we were real root applications. IIRC, docs specified root privileges.<br></blockquote></div><div><br class="webkit-block-placeholder"></div>I completely agree with the fact that raw sockets require root privilege, that is the situation we're currently in and don't want to continue with. But am I then completely misunderstanding when I think that SE Linux can allow non-root access to certain "normally root only" capabilities, on a per process basis? Certainly all the ping-related SE Linux examples online all show precisely this: provide access to raw sockets for a non-root process. <div><br class="webkit-block-placeholder"></div><div>S</div></body></html>